ImmigrantDeskSecurity & Data Protection
This statement is also Annex 2 of the Data Processing Agreement.
ImmigrantDesk holds identity documents and sensitive case information, so access is restricted to the people working on each case. These are the measures in use today.
| Area | Measures in place |
|---|---|
| Hosting | Dedicated server (contabo, german). The application, database, search, OCR, virus scanning and document conversion each run in a separate container |
| Encryption in transit | HTTPS only: browsers are told to always use HTTPS (HSTS), and the login cookie is sent only over HTTPS |
| Sign-in | Passwords are stored as one-way hashes. After 3 failed attempts the account is locked for 10 minutes, and repeated failures from one network address are blocked |
| Sessions | A session lasts 12 hours. Signing out ends the session on the server, so a copied login cookie stops working |
| Access control | Every request is checked against the user's organisation, role, client and case. The system-owner functions are kept separate from client and professional work |
| Uploads | Every file is scanned for viruses before it is stored. Files are kept outside the public web folder and served only to authorised users |
| Browser protection | Other sites cannot show ImmigrantDesk inside a frame; browsers are told not to guess file types or pass case addresses to other sites |
| Secrets | API keys and passwords stay on the server. Provider keys are stored encrypted and never shown in the browser |
| AI | All AI requests go through one central gateway, which sends only the case information the task needs and records the usage per client |
| Backups | Database, documents and settings are backed up every night and kept for 7 days. Each backup is checked automatically |
| Logging | Sign-ins, administrative changes, data-protection actions and errors are logged |
| Change control | Every code change is recorded with a restore point, tested on all pages before and after, and undone automatically if any page changes unexpectedly |
Incidents
Suspected incidents are recorded at once, contained, and assessed for risk to the people affected. Customers are told within 48 hours. Where required, the ICO is told within 72 hours, and the people affected are told without undue delay.
Shared responsibility
Customers are responsible for their staff accounts and passwords, the security of their own devices, files they download, and reporting suspected compromise to us promptly.
Reporting a concern
Report security concerns to sarker@siasolution.com. No system is free of risk; we review these measures whenever the platform changes.