Product and intended use
Define the configuration, people, information and tasks being assessed.
Product, plans and what sits outside them
Public claim only
Three annual plans are published on the Subscriptions page, checked 2026-09-27: Basic $264 incl. GST a year (read-only access to all chapters, basic search, AustLII legislation integration), Pro $330 (Basic plus 'Q&A with The Kit', the 'Explain this' feature and integration with AustLII and Jade case-law libraries) and Student $220 (Basic features at a discounted rate). The FAQ states Basic and Pro are billed annually and renew automatically, while Student is a one-off 12-month subscription that does not auto-renew and requires a valid USI. The AI feature sits on the Pro plan only; on the publisher's own description the Basic and Student plans carry text and search with no AI feature.
Ask: Which plan will our subscribers be on, and is there an organisation agreement for 5 or more users that differs from the self-service sign-up in what it covers?
Release stage and product history
Public claim only
The About page describes the platform as 'a new interactive online platform' and the FAQ states the resource 'has been around for more than 30 years - starting as a binder of information, becoming a textbook, and now transforming into a digital resource in 2026', built from The Immigration Kit 10th Edition textbook. Checked 2026-09-27. No beta, general-availability or version label is published for the digital platform, and no release-notes page was found on the pages read.
Ask: Is the Pro-plan Q&A tool in general release or still being trialled, and where are its changes published?
Deployment model and hosting
Public claim only
The FAQ states the platform is reached 'online through any web browser on your computer, tablet or phone' at theimmigrationkit.iarc.org.au, that it is 'a live online tool' with no offline availability, and that an internet connection is required for full functionality. Checked 2026-09-27. No hosting location, cloud provider, region or data-centre statement appears on any page read, and the platform's own terms and privacy notice were not reached within the credit budget, so the hosting region is recorded as unknown rather than assumed to be Australian.
Ask: Which cloud provider and region host the platform, the text and the Q&A index, and is Australian data residency available or contracted?
What the product does
Public claim only
On the publisher's own pages, checked 2026-09-27: the full text of The Immigration Kit on Australian immigration and citizenship law is presented chapter by chapter with a per-section 'last updated' date; all plans include a search bar and integration with AustLII legislation; the Pro plan adds 'Q&A with The Kit - our interactive AI-powered tool: type your questions and get plain English answers drawn only from the expert legal text written by IARC's immigration lawyers, fully sourced', an 'Explain this' feature where the user highlights a word or sentence, clicks Explain and the Q&A tool states what it means, and integration with AustLII and Jade case-law libraries. Display preferences (light and dark mode, font size, content width) are published.
Ask: Which features are counted as part of the Pro plan for the whole subscription term, and how would we be told if one were withdrawn?
Who the publisher says it is for
Public claim only
The About page lists the intended audience as lawyers and migration agents, community, social and frontline workers, public sector staff, educators and university staff, students, visa holders and people navigating migration law issues, anyone supporting visa holders, and decision makers and policy professionals, and states it is also designed as a resource for organisations including law firms, government departments and agencies, community legal centres, universities, libraries and non-profits. Checked 2026-09-27. The FAQ states it can be used without legal training.
Ask: Where the same subscription is used by both practitioners and members of the public, does the publisher place any different conditions on use by each group?
Legal content and jurisdiction covered
Public claim only
The About page states the content covers 'all areas of Australian immigration and citizenship law' and that 'All content is written and reviewed by IARC's immigration law experts, providing clear context and interpretation of legislation and policy'. The FAQ states every chapter has been written, updated and reviewed by IARC's immigration lawyers and that the content can be updated to reflect legal and policy changes, with each section displaying the date it was last updated. Checked 2026-09-27. Only English is available; the FAQ states multilingual access is hoped for in future.
Ask: What is the publisher's update cycle and service commitment for keeping each chapter current after a legislative or policy change?
Check for vendor content directing how AI describes the product
Not confirmed
Checked 2026-09-27. The three publisher pages read for this product (About, FAQs, Subscriptions) and the platform login page were examined for a heading or block addressed to AI models, assistants, crawlers or LLMs, and were searched for 'Instructions for AI Assistants', 'ai assistant', 'llms', 'for ai models', 'crawler' and 'robots'. No such content was found. No map of iarc.org.au or theimmigrationkit.iarc.org.au was run within the credit budget, so whether an /llms.txt file exists is unknown rather than absent, and crawler allow and disallow directives were not examined. The FAQ answers no comparative or superlative question about the product against any other vendor; the only comparison it draws is against the publisher's own print textbook, answered on features.
Ask: Does IARC publish any file or page addressed to AI models, assistants or crawlers - an llms.txt, an AI-information page, or guidance on how the platform should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client information into the tool
Not confirmed
Nothing published on the pages read states whether a subscriber may type client facts, client names or matter detail into the Q&A tool, or what confidentiality position the publisher takes on what is typed. The closest statement is the FAQ's 'The Q&A tool does not retain or store personal data from your session. All interactions are private and temporary', checked 2026-09-27, which addresses retention rather than authority to input. The platform's own terms and privacy notice, linked from the login footer, were not reached within the credit budget.
Ask: Are subscribers permitted to enter client information or matter facts into the Q&A tool, and does the platform's privacy notice say what happens to it?
Model and model provider
Not confirmed
No model, model family, model provider or cloud AI service is named anywhere on the About, FAQs, Subscriptions or platform login pages, checked 2026-09-27. The About page states only that IARC and Lext built the platform 'By combining immigration law expertise with carefully designed AI', and the FAQ that the tool 'provides answers using AI'. Lext Australia is named as the builder on the About page, the FAQ and the platform login footer; a builder is not a model provider and is not recorded as one.
Ask: Which model and which model provider answer a Q&A question, and would we be told before either changed?
Subprocessors and third parties in the chain
Not confirmed
No subprocessor list, DPA or third-party schedule was found for this platform. The only third parties named on the pages read, checked 2026-09-27, are Lext Australia as the builder of the platform, AustLII and Jade as content libraries reached through integrations, and the payment methods listed on the FAQ (credit card, debit card, direct deposit, Link and Apple Pay/Google Pay). The organisation enquiry form is hosted on a Microsoft Forms address. None of these is published as a processor of subscriber data.
Ask: Can IARC provide a current list of the processors and hosting providers behind the platform and the Q&A tool, including any model provider?
Use of subscriber input to train models
Not confirmed
Nothing on the pages read states whether text typed into the Q&A tool, or search terms, are used to train or improve any model. The nearest statement is the FAQ's 'Does the Q&A tool store what I type? No. The Q&A tool does not retain or store personal data from your session', checked 2026-09-27, which is narrower than a statement that prompts are never used for training, and is framed around personal data rather than prompts generally.
Ask: Is anything typed into the Q&A tool, or any search term, used to train, fine-tune or evaluate a model, by IARC or by any provider behind it?
Use of feedback and thumbs-up signals
Not confirmed
The FAQ states feedback is submitted through the Help Button and that 'we welcome feedback as we continue to refine the platform', checked 2026-09-27. Nothing published says what is captured with a feedback submission, whether the question and answer are attached to it, how long it is kept, or whether it is used to tune the Q&A tool.
Ask: When a subscriber submits feedback through the Help Button, is the question and the answer captured with it, and what is it used for?
Retention of prompts, answers and search history
Public claim only
Two retention statements are published in the FAQ, checked 2026-09-27, both about the tools rather than the account: 'The Q&A tool does not retain or store personal data from your session. All interactions are private and temporary'; and of the search bar, 'The search bar stores a history of the search results you have clicked so that you can find them again later. This history is stored in your browser and can be deleted at any time. It is not stored in our database.' No retention period is published for account records, subscription and payment records, support tickets, feedback, logs or any server-side record of Q&A use, and IARC's organisational privacy policy sets no retention period for any category.
Ask: What is retained server-side when the Q&A tool is used - the question, the answer, or a log entry - and for how long is each kept?
Deletion on request and on cancellation
Public claim only
The FAQ states search history 'is stored in your browser and can be deleted at any time', and that on cancellation 'You will continue to have access to The Immigration Kit and all features included in your plan until the end of your billing period', checked 2026-09-27. IARC's organisational privacy policy provides for a written request to access or amend personal information, directed to the Principal Solicitor, with review by the Management Committee if refused; it does not provide a deletion right or a deletion timeframe, and it is written about legal clients, staff, volunteers and donors rather than platform subscribers.
Ask: On cancellation or on request, what account and usage data is deleted, within what period, and what is kept and why?
Human access to subscriber content
Not confirmed
Nothing on the pages read states who at IARC, at Lext or at any provider can see what a subscriber types into the Q&A tool or searches for, whether such access is logged, or whether support staff can view a session. Checked 2026-09-27. IARC's organisational privacy policy states its lawyers are bound by obligations of confidentiality and legal professional privilege, but is written about client matters and not about the platform.
Ask: Who can see what a subscriber types into the Q&A tool, under what circumstances, and is that access logged and reviewable?
Accounts, logins and administration
Public claim only
The FAQ states an account is required, that 'each user requires their own individual account and subscription' and that a shared login is not permitted; sign-up for 1 to 4 users is self-service with name, email address and a password, 5 or more users goes through an enquiry form, and an organisation can issue a code a user applies in place of payment. Account Settings allow a subscription to be managed and display preferences changed. Checked 2026-09-27. No multi-factor authentication, single sign-on, password policy, session timeout, role or organisation-administrator control is published.
Ask: Is multi-factor authentication or single sign-on available, and can an organisation administrator add, remove and audit its own users?
Encryption in transit and at rest
Not confirmed
No encryption statement was found for this platform. The Subscriptions page carries the words 'Secure online payment | Instant access | Annual subscription', checked 2026-09-27, which is not an encryption statement about subscriber content. IARC's organisational privacy policy contains no encryption commitment. The platform's own privacy notice was not reached within the credit budget.
Ask: Is subscriber content encrypted in transit and at rest, with which algorithms, and who holds the keys?
Independent assurance and certification
Not confirmed
No assurance certification, audit report or security attestation is published on any page read, checked 2026-09-27 - no SOC 2, no ISO/IEC 27001, no ISO/IEC 42001, and no trust centre or security page exists for this platform. The publisher's published accreditations are of the organisation rather than the software: ACNC charity registration and accreditation through Community Legal Centres Australia.
Ask: Has the platform or its builder been independently assessed against any security or AI management standard, and can the report or certificate be shared?
Contract documents and the contracting entity
Not confirmed
The platform publishes its own Terms and Privacy documents: the login page footer at theimmigrationkit.iarc.org.au links 'Terms' to https://theimmigrationkit.iarc.org.au/terms and 'Privacy' to https://theimmigrationkit.iarc.org.au/privacy, and states '(c) 2026 Immigration Advice and Rights Centre. All rights reserved.' and 'Proudly built by Lext Australia', checked 2026-09-27. Neither document was fetched: the five-operation research budget for this product was exhausted, so their contents, effective dates and contracting entity are unread and nothing is recorded from them. The three marketing pages link only to IARC's organisational privacy policy, which is about legal clients, staff, contractors, volunteers, students and donors, carries no effective date, and does not mention the platform, subscribers or the Q&A tool.
Ask: Please provide the current platform terms and privacy notice, the named contracting entity with its ABN, and confirmation of which document governs an organisation subscription.
Offshore transfer and cross-border disclosure
Not confirmed
No statement about offshore storage, cross-border disclosure or overseas recipients was found for the platform, checked 2026-09-27. IARC's organisational privacy policy refers to the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Privacy and Personal Information Protection Act 1998 (NSW) and the Health Records and Information Privacy Act 2002 (NSW), and lists third parties to whom client information may be disclosed - barristers, experts and other parties to a matter - but it addresses legal matters, not the platform, and names no overseas recipient or country.
Ask: Is any subscriber content, including Q&A questions, stored or processed outside Australia, and in which countries?
Incident notification
Not confirmed
No incident or data-breach notification commitment was found for the platform, checked 2026-09-27, and no notification period or contact is published. IARC's organisational privacy policy does not address notifiable data breaches.
Ask: Within what period would subscribers be notified of a data breach affecting the platform, and who is the named contact?
Notice of changes to the product and the documents
Public claim only
Two change statements are published. Of the content, the FAQ states 'Now that The Immigration Kit is online, it can be updated in real time to reflect the latest legal changes and policy updates. Each section displays the date it was last updated', with the date shown on an individual section rather than under 'Read Full Chapter'. Of the documents, IARC's organisational privacy policy states 'From time to time, IARC will update our privacy policy in response to any changes in legislation and/or technology'. Checked 2026-09-27. Neither statement commits to notice before a change, and no change log for the platform or the Q&A tool was found.
Ask: How much notice is given before the terms, the privacy notice or the Q&A tool's behaviour changes, and where is the change published?
Exit, cancellation and taking content away
Public claim only
The FAQ states a subscription can be cancelled 'at any time before it renews' with access continuing 'until the end of your billing period', that Basic and Pro renew automatically each year, that Student does not auto-renew, and that an upgrade is charged pro rata. Checked 2026-09-27. Nothing published provides for export of anything a subscriber has created - saved searches, search history beyond the browser, or Q&A transcripts - and no post-cancellation data handling is described.
Ask: On cancellation, can we export our search history or any saved material, and what happens to our account record afterwards?
Connections to other systems
Public claim only
The published connections are to legal content libraries, not to firm systems: 'Integration with AUSTLII legislation' on all plans and 'Integration with AUSTLII & Jade case-law libraries' on Pro, checked 2026-09-27. No connector to a practice management system, document management system, email or file store is published, and no API is published. The organisation enquiry form is hosted on a Microsoft Forms address, which is a sign-up channel rather than a product connector.
Ask: Is there an API or any connector to a practice management or document system, and can a firm restrict which integrations its users can reach?
Whether the tool reaches outside its own corpus
Public claim only
The FAQ states of the Q&A tool that it 'provides answers using AI by drawing only on the expert legal content written by IARC's immigration lawyers - it has guardrails in place, so it does not pull from any external sources', and separately that answers arrive 'with sources shown at the bottom of the page', checked 2026-09-27. The same pages also publish AustLII and Jade integrations, which are external libraries, without stating whether the Q&A tool can reach them or whether they are links for the reader. What 'guardrails' means technically is not described anywhere on the pages read.
Ask: Does the Q&A tool ever retrieve from AustLII, Jade or any other source outside IARC's own text, and what technically enforces the stated limit?
Whether the tool can take actions
Not confirmed
Nothing on the pages read describes the Q&A tool or the 'Explain this' feature taking any action beyond returning an answer or an explanation in the interface - no document creation, no sending, no writing to another system, and no agent or tool-use behaviour is published. Checked 2026-09-27. Because no capability statement exists either way, this is recorded as unverified rather than as a confirmed absence.
Ask: Can the Q&A tool or any future feature take an action on a subscriber's behalf, such as producing or sending a document, and is that switchable?
Human authorship, review and the publisher's own warning
Public claim only
The publisher states the text is human-written and reviewed and that the AI output needs checking. The FAQ: 'Every chapter has been written, updated and reviewed by IARC's immigration lawyers. The Q&A tool draws responses only from the text written by us.' And: 'Our Q&A tool is powered by AI and may make mistakes - it is important to check responses carefully. It does not replace professional advice. Responses provided by the Q&A tool are intended as a guide only. You should always seek advice from a Registered Migration Agent or a qualified immigration lawyer.' Checked 2026-09-27. No human review of an individual Q&A answer before it is shown is described, and no in-product review or approval step is published.
Ask: Is any Q&A answer reviewed by a person before the subscriber sees it, and how is the warning about checking answers presented inside the product?
