Product and intended use
Define the configuration, people, information and tasks being assessed.
Product, package and parent
Public claim only
The product FAQ checked 27 September 2026 states InfoTrackID is a digital identity verification platform that forms the foundation of InfoTrack's Onboarding & VOI package, and that for firms providing a designated service under the AML/CTF Tranche 2 reforms a separate AML Onboarding & VOI package builds on InfoTrackID with broader AML/CTF features. InfoTrackID is therefore a module inside a wider InfoTrack subscription, not a standalone contract. The sibling profile data/profiles/infotrack.json covers the InfoTrack search platform, the Tilly AI agent and the iTrack MCP server, which are outside this profile.
Ask: Is InfoTrackID on our account as part of Onboarding & VOI or the AML Onboarding & VOI package, and what changes between the two for identity data handling?
Deployment and Australian hosting
Public claim only
The product is browser-based and the page states no app or software download is required. The InfoTrackID security page states documents entered into the VOI platform are transmitted and stored in a write-only private-cloud database, accessible for read access only via a private VPC to a small number of privileged InfoTrack administrators. The privacy policy section 7 states personal information is stored and retained in Australia and that, for InfoTrackID and verification of identity services, no data collected for the purposes of the service will ever be transferred or stored outside Australia. No on-premises option is published.
Ask: Does the never-leave-Australia commitment in section 7 of the privacy policy cover the facial-recognition, liveness and OCR processing steps themselves, and not only storage and transfer of the resulting records?
Machine-learning components in the verification chain
Public claim only
Three machine-learning components are named on the product page checked 27 September 2026: 'Facial recognition technology detects facial patterns and matches images'; 'Liveness checks ensure the user's physical presence and effectively counters impersonation attempts'; and 'Optical Character Recognition (OCR) extracts text from images and auto-populates the data'. The FAQ ties the first two to the verification decision alongside a government database lookup: identity documents are checked against the Australian Government Document Verification Service, facial recognition matches a person's face to their ID, and liveness checks confirm physical presence. No generative or language-model feature is described. Separately, the vendor's 'How InfoTrack Uses Artificial Intelligence' page lists 'Verification of Identity - InfoCheck' among products built with InfoTrack artificial intelligence, and names Amazon Textract for a different product, SettleIT discharge mortgage authority.
Ask: Which steps in an InfoTrackID verification are model decisions rather than lookups, and what confidence threshold is applied before a facial match or liveness check is reported as passed?
VOI standards met, by jurisdiction
Public claim only
The product page states in-person verification meets the VOI Standard at clause 6.5.2(a) using a photo ID and an ID document checked face to face, and that remote verification meets the VOI Reasonable Steps standard under the same clause, adding a video call. The security and legislation page states VOI legislation differs in each Australian state, that requirements apply to solicitors and conveyancers, and links the relevant Registrar General, land registry or land services requirement for New South Wales, the Australian Capital Territory, Victoria, Queensland, South Australia, Western Australia, Tasmania and the Northern Territory. The compliance assertion is the vendor's own; no regulator endorsement is published on either page.
Ask: For each state and territory we practise in, which published VOI requirement does the InfoTrackID remote method satisfy, and has any land registry confirmed that in writing?
Vendor content directing how AI describes the product
Not confirmed
Checked 27 September 2026. Both candidate pages on this domain were read: 'How InfoTrack Uses Artificial Intelligence' at /powered-by-infotrack-ai/ and the AI Solutions page at /ai-solutions/, together with the InfoTrackID product page, the InfoTrackID security page, the General Terms, the privacy policy and the information security page. No page or block addressed to AI models, AI assistants, crawlers or large language models was found, no 'Instructions for AI Assistants' heading appeared, and no llms.txt path was referenced in the navigation or footers of those pages. The domain was not mapped in full.
Ask: Do you publish any page, block or file setting out how AI assistants, crawlers or large language models should describe InfoTrack or InfoTrackID, and if so where is it?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority, consents and biometric capture
Public claim only
General Terms clause 9.3 states the client agrees that documents, data and materials stored against a matter file may be processed by AI Services, and that the client is responsible for ensuring it has all necessary rights and consents, including third-party privacy consents, to provide Matter Data for that purpose. Clause 9.4 is a client warranty to the same effect and clause 9.5 is a client indemnity for failure to obtain those consents, with the express statement that InfoTrack has not advised the client on what consents are required in its jurisdiction. The privacy policy treats biometric-adjacent material within its sensitive-information definitions. No model consent wording for facial-recognition or liveness capture is supplied by InfoTrack on any page read.
Ask: What consent wording do you expect us to obtain from a client before their face is captured for facial matching and a liveness check, and does InfoTrack rely on our consent or obtain its own from the individual in the capture flow?
Model and biometric providers
Not confirmed
No provider is named for the facial-recognition, liveness or OCR components on any page read. The product page and FAQ describe the capabilities without attribution. The privacy policy names the Australian Government Document Verification Service as the third-party supplier for the document check and ACIC and NPCS for criminal-history checks, but names no biometric or model vendor. The vendor's AI page names Amazon Textract only for SettleIT, a different product, and lists 'Verification of Identity - InfoCheck' among products built with InfoTrack artificial intelligence without naming a supplier. No sub-processor register is published.
Ask: Name the supplier and legal entity behind the facial-recognition, liveness-detection and OCR components of InfoTrackID, the country each processes in, and whether biometric templates are created, stored or discarded after the match.
Sub-processors and third-party recipients
Public claim only
No dated sub-processor register is published. The privacy policy instead lists categories and some named recipients: reseller partners; integration partners named as Sympli Pty Ltd, Practice Evolve, LEAP, PEXA, Smokeball, Actionstep and Adrant; contractors and subcontractors described as providers of CRM and marketing database services, technology providers including cloud, software and development services, marketing consultants, promotion companies and website hosts, and professional advisers; and Third Party Suppliers named as the Document Verification Service, state and territory land registry offices, and ACIC and NPCS. General Terms clause 8.3 has the client consent to InfoTrack sub-licensing and disclosing Client Data to Third Party Suppliers and subcontractors during the term for the limited purpose of providing the systems and products. No biometric or model provider appears anywhere on the list.
Ask: Provide a dated sub-processor register for InfoTrackID with entity, country, purpose and data types, including the supplier of the facial-recognition and liveness components, and state our notice and objection rights when it changes.
Training on customer content
Not confirmed
No express no-training commitment was found. General Terms clause 8.2 grants InfoTrack a non-exclusive licence to use Client Data during the term solely to provide the InfoTrack Systems and Products, and states InfoTrack must not use Client Data for any other purpose without the client's prior written consent or, for personal information, a lawful basis. Clause 9.3 says processing of Matter Data by AI Services 'align[s] with our products' primary uses and is consistent with our Privacy Policy'. A separate General Terms clause permits InfoTrack to gather analytics in relation to any and all activity on the InfoTrack Systems, use of the InfoTrack Products and Client Data. Whether identity images, biometric material or OCR output are used to train or tune any model is not addressed in any document read.
Ask: Confirm in writing that client face images, identity documents, biometric templates and OCR output from InfoTrackID are never used to train, tune or evaluate any model, by InfoTrack or by any supplier, and identify the clause that says so.
Analytics and product improvement
Public claim only
The General Terms permit InfoTrack to gather analytics in relation to any and all activity on the InfoTrack Systems, use of the InfoTrack Products and Client Data. The privacy policy states InfoTrack may combine personal information with information available from other sources, including the recipients it lists, to help provide services, and that it operates an ISMS whose policies safeguard against unnecessary retention. Section 8 states InfoTrack takes reasonable steps to destroy or de-identify personal information after it is no longer needed for business purposes or legal compliance. No opt-out from the analytics permission is described, and no in-product feedback control for the verification result is described.
Ask: Does the analytics permission in the General Terms extend to InfoTrackID verification records, face images and OCR output, and can it be switched off for our account?
Retention of identity data
Public claim only
The InfoTrackID security page and the product FAQ, both checked 27 September 2026, state that personal identity information and identity documentation are retained for 90 days in alignment with Registrar General and OSR standards, after which the full three-page VOI report is replaced with a Summary Report that excludes page 3, the copies of the complete identity documents. The same page states that where a PMS is used the full report remains available in the PMS, and that a practice ordering through the InfoTrack website must download and retain the full report before the 90 days expire or it will be replaced. Both statements sit on product marketing pages. The General Terms and privacy policy read on the same day contain no 90-day figure: the privacy policy gives 12 to 15 months for criminal-history-check data and otherwise commits only to destroying or de-identifying personal information when no longer needed.
Ask: Which signed document commits you to the 90-day retention and replacement, and does the 90-day clock also govern face images, liveness video, biometric templates, DVS transaction records and audit logs, not just the report?
Deletion, replacement and certification
Public claim only
The InfoTrackID security page describes a 'strict non-storage policy' under which, after 90 days, the full VOI report is replaced with a Summary Report without the identity documents. The product FAQ states more broadly that 'after 90 days, all personal identity information is permanently deleted'. Those two statements differ in scope: one describes replacing a report page, the other deleting all personal identity information. General Terms clause 18 defines Retained Information that may survive termination, including material required for accounting, corporate governance or regulatory purposes and material held in archived backups, and requires it to be kept confidential, not used for any other purpose, and permanently deleted once no longer required. No certified-deletion undertaking was found.
Ask: At 90 days, exactly what is deleted and what is retained, including archived backups under clause 18, and will you certify deletion of face images and biometric material in writing on request?
Vendor and overseas access to content
Public claim only
The InfoTrackID security page states the VOI database is write-only and is accessible for read access only via a private VPC to 'a few highly privileged InfoTrack administrators'. The privacy policy section 7 states people located overseas, in Vietnam, may have read-only access to personal information to provide development services, strictly limited, under secure protocols and under the supervision and control of Australian-based teams, and that such access occurs only where there is an enforceable contractual arrangement requiring Privacy Act compliance. The same section states that for InfoTrackID no data collected for the purposes of the service will ever be transferred or stored outside Australia; the read-only development access and that commitment are stated in the same section and their interaction is not explained. No access log is offered to clients.
Ask: Can Vietnam-based development staff read InfoTrackID identity records or face images, and if not, which control excludes them? Can we obtain the administrator access log for our own verifications?
Access control and credentials
Public claim only
The InfoTrackID security page describes a write-only database with read access restricted via a private VPC to a small number of privileged administrators. The privacy policy section 8 lists firewalls across all office networks and sites, anti-virus software on all workstations, cyber-security training for all employees at onboarding and through the year, restrictions on physical access to paper files, contractual assurances from third parties, and supplier vetting through risk assessment. Neither document read describes single sign-on, SCIM, enforced multi-factor authentication or role-based restriction of who in a practice may order a VOI. The information security page's 2023 advisory recommends clients set up multi-factor authentication, which is guidance rather than a product control.
Ask: Is single sign-on with enforced multi-factor authentication available for the InfoTrack portal, and can we restrict which of our users may order an InfoTrackID verification and view page 3 of a completed report?
Encryption in transit and at rest
Public claim only
The InfoTrackID security page states all data at rest is secured using AES256, all data in transit is secured end to end using TLS v1.2 as the minimum version, all documents ordered as part of the report are encrypted on the server using AES256, and all transport between the VOI platform and servers is secured using SSL. These are product-page statements, not contractual ones; the General Terms clause 22 obligation read on the same day speaks to a security standard rather than to named algorithms. Customer-managed keys are not offered on any page read.
Ask: Confirm the encryption standards and key management for face images, liveness video and biometric templates specifically, and whether the same standards apply on the path to the facial-recognition and OCR suppliers.
Independent security assurance
Not confirmed
Three published statements about the same subject do not line up. General Terms clause 22 requires each party to maintain controls that meet or exceed ISO 27001:2022 or any equivalent or successor standard. The InfoTrackID security page states 'InfoTrack complies with the ISO27001 Certification for storing data' and that the VOI database is in an 'ISO27001 certified private cloud provided database', without a version, certificate number or certifying body, and the certification described attaches to the cloud provider's database as much as to InfoTrack. The privacy policy states InfoTrack operates an Information Security Management System 'with full consideration of the ISO27001:2013 standard', which is an earlier version and is not a certification. The information security page displays a badge image whose file name is SOC-2-Type-II-and-ISO and offers a security pack by request form; no report, certificate or scope statement is published. No certificate was inspected.
Ask: Provide the current ISO/IEC 27001 certificate and the SOC 2 Type II report with their scope statements, and confirm whether InfoTrackID and its facial-recognition, liveness and OCR components are inside that scope.
Contracting entity and contract structure
Public claim only
The privacy policy states InfoTrack means InfoTrack Pty Limited (ABN 36 092 724 251) and its Australian subsidiaries, and that InfoTrack is bound by the Privacy Act 1988 (Cth) including the Australian Privacy Principles. The General Terms page states these terms are current from 1 August 2026 for new clients and from 1 September 2026 for existing clients, and includes clause 9, 'Use Of AI in the InfoTrack Services', which applies where InfoTrack offers AI Services. Clause 4 creates a separate Supplier Contract between the client and each Third Party Supplier, entered into by InfoTrack as agent and held on trust, with claims in respect of Third Party Products lying against the Third Party Supplier and not InfoTrack except where law prevents the exclusion. No standalone data processing agreement is published.
Ask: Will InfoTrack Pty Limited be our contracting entity for InfoTrackID, does clause 9 apply to the facial-recognition and liveness components, and is a separate Supplier Contract created with any biometric supplier under clause 4?
Cross-border transfers
Public claim only
The privacy policy section 7 states InfoTrack stores and retains personal information in Australia and does not presently disclose personal information to organisations located overseas, though it discloses information in Australia to some multinational organisations that are located both in Australia and overseas, including the United Kingdom, the United States and New Zealand. It then states a product-specific commitment: 'With respect to InfoTrackID and verification of identity services provided by InfoTrack, no data collected for the purposes of this service will ever be transferred or stored outside of Australia.' A parallel commitment is given for ACIC criminal-history data, subject to a Permitted Offshore Transfer arrangement being granted, with no such qualification on the InfoTrackID sentence. Overseas read-only development access from Vietnam is disclosed in the same section.
Ask: Does the InfoTrackID never-offshore commitment in section 7 also bind the supplier that performs facial matching and liveness detection, and is that commitment repeated in the General Terms or only in the privacy policy?
Incident notification
Public claim only
General Terms clause 21 requires a party to notify the other in writing, without undue delay and within no more than 72 hours of becoming aware, of a compliance notice or request from a Regulator or a breach of clause 21 or any applicable privacy law. Where a party has reasonable grounds to suspect a Notifiable Data Breach, it must notify the other in writing with all relevant details without undue delay and no later than 72 hours after becoming aware, cooperate in the investigation, take reasonable steps to mitigate and prevent recurrence, cooperate in good faith to minimise reputational damage including liaising on communications with the Regulator and affected individuals, and cooperate in preparing and submitting notifications. Clause 21 survives termination. The privacy policy points complainants to the Office of the Australian Information Commissioner.
Ask: Does the 72-hour clause 21 obligation cover a breach at a Third Party Supplier or the biometric supplier, and who in InfoTrack is the notifying contact for our account?
Change notice for terms, suppliers and features
Public claim only
The General Terms page states these terms are current from 1 August 2026 for new clients and from 1 September 2026 for existing clients. The terms allow InfoTrack to amend the Third Party Terms from time to time where directed or required by a Third Party Supplier or to comply with its agreement with that supplier, with at least 14 days written notice. Clause 7.3 lets the client terminate if InfoTrack exercises its clause 7.1 rights to the client's material detriment, and clause 11.8 lets the client terminate immediately if it objects to a fee increase. The privacy policy states it may be revised or updated from time to time and that the revised version will be published on the websites. No notice obligation specific to changing a biometric, facial-recognition or OCR supplier was found.
Ask: What written notice will we get before the facial-recognition, liveness or OCR supplier behind InfoTrackID changes, and do we have a right to object?
Export and exit
Not confirmed
The clearest published exit mechanism for InfoTrackID data is operational rather than contractual: the security page states the practice must download and retain the full VOI report before the 90-day replacement if it ordered through the InfoTrack website, and that the full report remains in the PMS where one is used. General Terms clause 18 addresses Retained Information after termination and requires it to be kept confidential, not used for other purposes and permanently deleted when no longer required. Clause 19 vests rights in derivative works and outputs in InfoTrack, its affiliates or Third Party Suppliers on creation. No bulk export of historical verification records, audit logs or reports is described on any page read.
Ask: On exit, what bulk export of our historical InfoTrackID verifications, reports and audit logs is available, in what format, and within what period?
Connectors and third-party products
Public claim only
General Terms clause 4 provides that many InfoTrack Products incorporate or compile Third Party Products supplied by Third Party Suppliers subject to Third Party Terms, that a separate Supplier Contract is formed between the client and the Third Party Supplier with InfoTrack acting as agent and holding the benefit on trust, and that claims in respect of Third Party Products lie against the Third Party Supplier rather than InfoTrack except where law prevents the exclusion. Clause 8.3 has the client consent to Client Data being sub-licensed and disclosed to Third Party Suppliers and subcontractors for the limited purpose of providing the systems and products. The privacy policy names the integration partners with whom information may be shared with the client's consent. The wider InfoTrack site also publishes an iTrack MCP server and a Claude Cowork listing; those are recorded in the sibling InfoTrack profile and are outside this product.
Ask: For an InfoTrackID verification, which Third Party Suppliers are we contracting with directly under clause 4, and can any AI assistant or MCP client reach InfoTrackID verification records on our account?
Retrieval from sources outside the tenant
Public claim only
The verification chain reaches defined external systems rather than the open web. The product FAQ states identity documents are checked against the Australian Government Document Verification Service, and the privacy policy names the DVS and state and territory land registry offices as Third Party Suppliers, and ACIC and NPCS for criminal-history checks. No open-web search, browsing or adverse-media retrieval is described for InfoTrackID on any page read, and the components described - facial matching, liveness and OCR - operate on the captured images rather than on retrieved content.
Ask: Does any part of an InfoTrackID verification query a source other than the DVS and the named Third Party Suppliers, including any open-web or adverse-media lookup?
What the product does without a practitioner action
Not confirmed
The verification is initiated by the practice and the report is returned to it, but the pages read do not say whether a pass or fail determination is made automatically. The product page states liveness checks 'ensure the user's physical presence and effectively counters impersonation attempts' and that OCR 'extracts text from images and auto-populates the data', so at least one step writes data into the record without a practitioner keying it. Page 2 of the report 'contains the results of the Verification of Identity'. Whether a failed facial match or liveness check blocks the transaction, flags it for review or simply appears on the report is not stated, and no setting is described. This is a design a firm must confirm and accept.
Ask: When a facial match or liveness check fails, what does the product do - block, flag or report - and can a practice configure that behaviour or require a manual decision before the report issues?
Human review before the verification is relied on
Public claim only
General Terms clause 9.6 states AI Services may not have been developed or approved by legal practitioners and carry no legal or professional endorsement, may not reflect applicable laws, suit the client's circumstances or be current, do not constitute legal advice and must not be relied on as such, that a qualified lawyer should review any AI Services output before it is relied upon, and that the client is responsible for validating AI Services on its own professional skill, judgement and experience. Clause 10.1 states InfoTrack is entitled to rely on Client Data as provided. No product control that forces a named reviewer before a VOI report is accepted onto a matter is described on any page read.
Ask: Does clause 9.6 apply to the InfoTrackID facial-match and liveness output, and what product control can require a named practitioner to review and sign off a verification before it is relied on for a conveyancing transaction?
