Your clients' data stays in Sydney.
A plain-language account of every third party that touches data on Casen: who they are, what they see and where it goes. Written for the questions migration agents ask before they put a client file into any AI tool.
Last verified 28 October 2026. Casen is operated by Integrated Platforms Pty Ltd (ACN 693 247 513).
Sydney
Where client data is stored, and where the AI processes it (australia-southeast1).
Zero
Data retention at the AI layer. Nothing we send is used to train any model.
Every upload
Scanned for malware in Sydney before anyone can open it.
Built for the documents your clients trust you with
Client data is stored and processed in Sydney. The AI runs with zero data retention and never trains on client documents.
The AI keeps no copy of your client's documents once it has read them.
Zero data retention
Your clients' documents are never used to train AI models. Their details stay theirs.
Never trains on client documents
Our security controls are published on the Cloud Security Alliance's public registry, so you can check them before you trust us with a file.
CSA STAR Level 1
Stored and processed in Sydney
How our AI handles client data is self-assessed against the Cloud Security Alliance's AI controls and published for you to review.
CSA STAR for AI Level 1
We're a partner of the Australian Signals Directorate, so we get Australia's official cyber threat advice as it's issued.
ASD Cyber Security Business Partner
Built secure. Designed for compliance.
Australian Data Residency
All client documents and AI processing stay in the Sydney region (australia-southeast1).
Encryption
AES-256 encryption at rest and TLS 1.3 in transit, designed to keep every client document protected.
AI Privacy
Processed by Google's AI in Sydney with zero data retention. Never used to train AI.
Compliance
Designed for the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Migration Act 1958 and the MARA Code of Conduct.
The questions to ask any AI vendor, answered
You stay responsible for your clients' confidentiality when you use any AI tool (see OMARA's guidance on AI), so here are straight answers to the questions agents ask.
Where is client data stored?
In Google Cloud's Sydney region (australia-southeast1): the database, file storage and compute that hold your clients' files.
Where does the AI process it?
Also in Sydney. Intake and document analysis run on Google Vertex AI (Gemini) in australia-southeast1, so client data is both stored and processed onshore.
Our AI provider?
Google Vertex AI (Gemini), deployed in Sydney, from Google LLC, is listed below as a subprocessor with exactly what it receives, and it's named in our Privacy Policy and DPA.
Does any data leave Australia?
Client data doesn't, unless you switch on a connector yourself (see below). Some practice-level data does, and we list all of it: account emails, CRM records, website analytics and agent sign-in. If we ever propose an overseas disclosure of your data under APP 8, our DPA commits us to tell you first, and to proceed only with your consent or where another APP 8 exception applies.
Who can get into our practice's data?
Every person in your practice signs in with their own account and role, and each practice's data is kept logically separate from every other practice's.
Are uploads checked before anyone opens them?
Yes. Every document, from you or from a visa applicant, is scanned for malware on our own infrastructure in Sydney before it can be downloaded or analysed. Files are never sent to a third-party scanning service, and each file's type is checked against its actual contents.
Every third party, named
Who they are, what they see, and where it goes. Last verified 28 October 2026.
Who processes your clients' data
These process actual client and applicant information: passports, financial records, intake conversations and document analysis.
Google Cloud Platform
Google LLC (USA) / Google Australia Pty Ltd
Google Vertex AI (Gemini)
Google LLC (USA)
Who processes your practice data
These process your own practice and account information (billing, email, CRM and website analytics), never a client's case data.
Stripe
Stripe Payments Australia Pty Ltd (ABN 66 160 180 343)
Google Workspace
Google LLC (USA)
HubSpot, Inc.
HubSpot, Inc. (USA)
Google Analytics
Google LLC (USA)
Entities and hosting regions for Google Cloud Platform, Vertex AI, Stripe, HubSpot and Google Analytics were verified directly with each vendor on 12 August 2026. The Google Workspace entry was added on 24 September 2026. Agent sign-in (Firebase Authentication) and the app's content delivery (Firebase Hosting) are Google services that may use infrastructure outside Australia; they don't store client data. See our Privacy Policy.
Your data, your decisions
What happens to a file after it's processed, and how you remove it. Nothing waits on a request to us.
Does the AI train on your clients' data?
No.
Zero Data Retention means nothing we send is ever used to train any model, for anyone.
Does the AI company keep a copy after processing?
No.
Zero Data Retention discards the prompt and response the moment the call is complete. That's a different commitment from “no training”, and we don't want to blur the two.
Does Casen keep a copy of my files?
Yes, and you decide how long.
Documents uploaded for a one-off analysis are deleted automatically after 24 hours. The analysis results stay in your account.
Documents attached to a client or a lead, including anything an applicant uploads during an intake conversation, are kept in your practice's own private storage until you delete them. Casen never deletes them on its own, because a migration matter can run for years and agents must keep client records for seven years after the last action on a file.
Delete a client
Deleting a client removes their record, files and document analyses from Casen. Recovery copies are kept for up to 14 days in case of a system failure, then they are gone. The intake conversation they came in through stays in your leads, unlinked from the deleted client.
Delete a lead
Deleting a lead removes the intake conversation, the assessment, linked document analyses and uploaded files from Casen. If the lead became a client, its files stay with the client. Recovery copies are kept for up to 14 days, then they are gone.
Deletion record
Casen keeps a record of each file deletion (who deleted it, when, and the file's type and size, never its name or contents) for 7 years, matching the client-file rule.
Audit us
Our DPA lets you audit how we process your data, or appoint an independent auditor to do it, with 30 days' written notice.
Connectors you switch on stay under your own account.
If you connect Casen to other software, through our API or the Claude.ai MCP connector, data flows into that tool under your own account and your own relationship with that provider. Casen isn't a subprocessor for that data, because we don't control what happens to it once it leaves our platform at your direction.
Claude.ai (Anthropic), via our MCP connector: results we generate go into your own Claude.ai account, under your own terms with Anthropic.
Any other tool you connect through our API: the same principle applies.
Your OMARA obligation
Get your clients' consent before enabling any connector that sends their information to a third party outside Casen's control. Connecting Casen to something else doesn't change who owns that responsibility.
