---
title: "InfoTrackID (InfoTrack Pty Limited)"
url: "https://ailawframework.com/software/infotrackid"
type: "software_profile"
site: "AI Law Framework"
id: "infotrackid"
vendor: "InfoTrack Pty Limited"
category: "Legal-specific"
segment: "Compliance and privacy"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# InfoTrackID (InfoTrack Pty Limited)

> Online verification of identity for Australian legal and conveyancing practices, pairing a government document check with facial recognition, liveness and OCR, with results returned to the practice-management system.

Canonical page: https://ailawframework.com/software/infotrackid  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: InfoTrackID verification of identity, in person and remote, in InfoTrack's Onboarding & VOI package, on the General Terms current from 1 August 2026 (new clients) and 1 September 2026 (existing). AML Onboarding & VOI needs separate review.

## Capabilities

- Intake and triage
- Identity verification

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia |
| Australian region | Yes |
| Assurance | ISO 27001:2022 |
| Training on customer content | Unknown |
| Retention | The InfoTrackID security page and product FAQ state that personal identity information and identity documentation are retained in InfoTrack's system for 90 days, aligned by the vendor to Registrar General and OSR standards, after which the full three-page VOI report is replaced with a Summary Report that excludes the third page containing copies of the identity documents. The same page states that where a practice-management system is used the full VOI report remains available in the PMS, and that when ordering through the InfoTrack website it is the requesting person's responsibility to download and retain the full report before the 90 days expire. The privacy policy states data collected for criminal-history checks is held for no less than 12 and no more than 15 months. General Terms clause 18 defines Retained Information that survives termination and requires it to be kept confidential, not used for any other purpose and permanently deleted once no longer required. |
| Integrations | Practice management systems, LEAP, Smokeball, Actionstep, Practice Evolve, PEXA, Sympli Pty Ltd, Adrant |
| Legal content coverage | Australian verification of identity requirements, which differ by state. In-person verification is stated to meet VOI Standard clause 6.5.2(a) and remote verification the VOI Reasonable Steps standard under the same clause. The security and legislation page links the state or territory VOI requirement for New South Wales, the Australian Capital Territory, Victoria, Queensland, South Australia, Western Australia, Tasmania and the Northern Territory. |
| Pricing | No price is published. The product page states costs and reports are returned directly to the practice-management system, which is a per-verification charge, and that InfoTrackID forms the foundation of InfoTrack's Onboarding & VOI package. The General Terms provide for Fees, Authority Fees and charges imposed by Third Party Suppliers, and allow fee increases with reasonable advance written notice, or less where a Third Party Supplier gives little notice, with a right to terminate if the client objects. |
| Australian presence | Yes. The privacy policy read on 27 September 2026 states that InfoTrack means InfoTrack Pty Limited (ABN 36 092 724 251) and its Australian subsidiaries, and that InfoTrack is bound by the Privacy Act 1988 (Cth) including the Australian Privacy Principles. No ACN is published on the pages read; the ABN is. Section 7 states personal information is stored and retained in Australia, and adds a product-specific commitment: 'With respect to InfoTrackID and verification of identity services provided by InfoTrack, no data collected for the purposes of this service will ever be transferred or stored outside of Australia.' The same section states that people located overseas, in Vietnam, may have read-only access to personal information to provide development services, under secure protocols and under the supervision and control of Australian-based teams. Two named clients appear as testimonials on the product page, both small Australian practices; they are not recorded here because the catalogue does not carry individuals' names and the entities are quoted about ease of use rather than as reference sites. |
| Website | https://www.infotrack.com.au/infotrackid/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product, package and parent | Public claim only | The product FAQ checked 27 September 2026 states InfoTrackID is a digital identity verification platform that forms the foundation of InfoTrack's Onboarding & VOI package, and that for firms providing a designated service under the AML/CTF Tranche 2 reforms a separate AML Onboarding & VOI package builds on InfoTrackID with broader AML/CTF features. InfoTrackID is therefore a module inside a wider InfoTrack subscription, not a standalone contract. The sibling profile data/profiles/infotrack.json covers the InfoTrack search platform, the Tilly AI agent and the iTrack MCP server, which are outside this profile. | Is InfoTrackID on our account as part of Onboarding & VOI or the AML Onboarding & VOI package, and what changes between the two for identity data handling? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/) |
| Deployment and Australian hosting | Public claim only | The product is browser-based and the page states no app or software download is required. The InfoTrackID security page states documents entered into the VOI platform are transmitted and stored in a write-only private-cloud database, accessible for read access only via a private VPC to a small number of privileged InfoTrack administrators. The privacy policy section 7 states personal information is stored and retained in Australia and that, for InfoTrackID and verification of identity services, no data collected for the purposes of the service will ever be transferred or stored outside Australia. No on-premises option is published. | Does the never-leave-Australia commitment in section 7 of the privacy policy cover the facial-recognition, liveness and OCR processing steps themselves, and not only storage and transfer of the resulting records? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Machine-learning components in the verification chain | Public claim only | Three machine-learning components are named on the product page checked 27 September 2026: 'Facial recognition technology detects facial patterns and matches images'; 'Liveness checks ensure the user's physical presence and effectively counters impersonation attempts'; and 'Optical Character Recognition (OCR) extracts text from images and auto-populates the data'. The FAQ ties the first two to the verification decision alongside a government database lookup: identity documents are checked against the Australian Government Document Verification Service, facial recognition matches a person's face to their ID, and liveness checks confirm physical presence. No generative or language-model feature is described. Separately, the vendor's 'How InfoTrack Uses Artificial Intelligence' page lists 'Verification of Identity - InfoCheck' among products built with InfoTrack artificial intelligence, and names Amazon Textract for a different product, SettleIT discharge mortgage authority. | Which steps in an InfoTrackID verification are model decisions rather than lookups, and what confidence threshold is applied before a facial match or liveness check is reported as passed? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrack - How InfoTrack Uses Artificial Intelligence](https://www.infotrack.com.au/powered-by-infotrack-ai/) |
| VOI standards met, by jurisdiction | Public claim only | The product page states in-person verification meets the VOI Standard at clause 6.5.2(a) using a photo ID and an ID document checked face to face, and that remote verification meets the VOI Reasonable Steps standard under the same clause, adding a video call. The security and legislation page states VOI legislation differs in each Australian state, that requirements apply to solicitors and conveyancers, and links the relevant Registrar General, land registry or land services requirement for New South Wales, the Australian Capital Territory, Victoria, Queensland, South Australia, Western Australia, Tasmania and the Northern Territory. The compliance assertion is the vendor's own; no regulator endorsement is published on either page. | For each state and territory we practise in, which published VOI requirement does the InfoTrackID remote method satisfy, and has any land registry confirmed that in writing? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/) |
| Fees and fee changes | Public claim only | No InfoTrackID price is published. The product page states costs and reports are returned directly to the practice-management system. General Terms clause 11.5 states many InfoTrack Products rely on Third Party Products subject to Third Party Supplier terms, and that additional charges imposed by Third Party Suppliers may be passed on, with reasonable advance written notice where possible but noting this may not always be possible where a Third Party Supplier gives little or no notice. Clause 11.8 gives the client a right to terminate immediately if it objects to a fee increase under clauses 11.6 or 11.7. | What is the per-verification charge for in-person and remote InfoTrackID, which component is a Third Party Supplier pass-through, and what notice applies to a change in that component? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Practice-management and platform integration | Public claim only | The product page states costs and reports are returned directly to the practice-management system, and the InfoTrackID security page adds that where a PMS is used the full VOI report remains available in the PMS after the 90-day replacement. The privacy policy names InfoTrack's integration partners with whom information may be shared with the client's consent: Sympli Pty Ltd, Practice Evolve, LEAP, PEXA, Smokeball, Actionstep, Adrant, and other integration partners named on the websites from time to time. It also names reseller partners with whom information may be shared. | When our PMS receives the full VOI report, which of the named integration partners has received client identity information along the way, and on what recorded consent? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Support and security contact | Public claim only | The privacy policy publishes a Privacy Officer contact by post, email and phone and says the HelpDesk or Sales staff can generally assist with updating personal information over the phone, with escalation to the Privacy Officer. The information security page publishes security@infotrack.com.au for reporting a security issue and an InfoTrack Trust Centre at https://trust.infotrack.com, and offers a security pack on request through a form. No service level agreement or response target for a failed or disputed verification was found on the pages read. | What is the support path and response target when a client fails a liveness check or a facial match and the transaction is time-critical, and what does the security pack contain? | [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - Information Security](https://www.infotrack.com.au/information-security/) |
| Published accuracy evidence | Not confirmed | No false-accept rate, false-reject rate, demographic performance data, threshold, benchmark or third-party evaluation was found for the facial recognition, liveness or OCR components on any page read. The product page describes the components and states an outcome ('effectively counters impersonation attempts') without a measurement. The only published quality-related claim is 'award-winning VOI solution', with no award named. Client testimonials on the page are about ease of use, not accuracy. | Provide the false-accept and false-reject rates for the facial-match and liveness steps, the threshold at which a verification is reported as passed, and any demographic performance breakdown, with the test method and date. | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/) |
| Task boundary and the practitioner's residual obligation | Public claim only | The product performs the verification steps and returns a three-page report: page 1 with a photo of the client, the last three digits of the licence or passport and the document expiry date; page 2 with the verification result; page 3 with copies of the complete identity documents. General Terms clause 10.1 states InfoTrack is entitled to rely on Client Data as provided by the client, and clause 9.6 states AI Services may not have been developed or approved by legal practitioners, carry no legal or professional endorsement, do not constitute legal advice, may not be accurate or current, and that the client is responsible for validating them on its own professional skill, judgement and experience. The VOI decision and the practitioner's reasonable-steps obligation remain with the practice. | Does InfoTrack accept that clause 9.6 of the General Terms applies to the facial-recognition and liveness components of InfoTrackID, and if so what does the practice have to do to discharge its own reasonable-steps obligation? | [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Vendor content directing how AI describes the product | Not confirmed | Checked 27 September 2026. Both candidate pages on this domain were read: 'How InfoTrack Uses Artificial Intelligence' at /powered-by-infotrack-ai/ and the AI Solutions page at /ai-solutions/, together with the InfoTrackID product page, the InfoTrackID security page, the General Terms, the privacy policy and the information security page. No page or block addressed to AI models, AI assistants, crawlers or large language models was found, no 'Instructions for AI Assistants' heading appeared, and no llms.txt path was referenced in the navigation or footers of those pages. The domain was not mapped in full. | Do you publish any page, block or file setting out how AI assistants, crawlers or large language models should describe InfoTrack or InfoTrackID, and if so where is it? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrack - Information Security](https://www.infotrack.com.au/information-security/); [InfoTrack - How InfoTrack Uses Artificial Intelligence](https://www.infotrack.com.au/powered-by-infotrack-ai/); [InfoTrack - AI Solutions](https://www.infotrack.com.au/ai-solutions/) |
| Client authority, consents and biometric capture | Public claim only | General Terms clause 9.3 states the client agrees that documents, data and materials stored against a matter file may be processed by AI Services, and that the client is responsible for ensuring it has all necessary rights and consents, including third-party privacy consents, to provide Matter Data for that purpose. Clause 9.4 is a client warranty to the same effect and clause 9.5 is a client indemnity for failure to obtain those consents, with the express statement that InfoTrack has not advised the client on what consents are required in its jurisdiction. The privacy policy treats biometric-adjacent material within its sensitive-information definitions. No model consent wording for facial-recognition or liveness capture is supplied by InfoTrack on any page read. | What consent wording do you expect us to obtain from a client before their face is captured for facial matching and a liveness check, and does InfoTrack rely on our consent or obtain its own from the individual in the capture flow? | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Model and biometric providers | Not confirmed | No provider is named for the facial-recognition, liveness or OCR components on any page read. The product page and FAQ describe the capabilities without attribution. The privacy policy names the Australian Government Document Verification Service as the third-party supplier for the document check and ACIC and NPCS for criminal-history checks, but names no biometric or model vendor. The vendor's AI page names Amazon Textract only for SettleIT, a different product, and lists 'Verification of Identity - InfoCheck' among products built with InfoTrack artificial intelligence without naming a supplier. No sub-processor register is published. | Name the supplier and legal entity behind the facial-recognition, liveness-detection and OCR components of InfoTrackID, the country each processes in, and whether biometric templates are created, stored or discarded after the match. | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - How InfoTrack Uses Artificial Intelligence](https://www.infotrack.com.au/powered-by-infotrack-ai/) |
| Sub-processors and third-party recipients | Public claim only | No dated sub-processor register is published. The privacy policy instead lists categories and some named recipients: reseller partners; integration partners named as Sympli Pty Ltd, Practice Evolve, LEAP, PEXA, Smokeball, Actionstep and Adrant; contractors and subcontractors described as providers of CRM and marketing database services, technology providers including cloud, software and development services, marketing consultants, promotion companies and website hosts, and professional advisers; and Third Party Suppliers named as the Document Verification Service, state and territory land registry offices, and ACIC and NPCS. General Terms clause 8.3 has the client consent to InfoTrack sub-licensing and disclosing Client Data to Third Party Suppliers and subcontractors during the term for the limited purpose of providing the systems and products. No biometric or model provider appears anywhere on the list. | Provide a dated sub-processor register for InfoTrackID with entity, country, purpose and data types, including the supplier of the facial-recognition and liveness components, and state our notice and objection rights when it changes. | [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Training on customer content | Not confirmed | No express no-training commitment was found. General Terms clause 8.2 grants InfoTrack a non-exclusive licence to use Client Data during the term solely to provide the InfoTrack Systems and Products, and states InfoTrack must not use Client Data for any other purpose without the client's prior written consent or, for personal information, a lawful basis. Clause 9.3 says processing of Matter Data by AI Services 'align[s] with our products' primary uses and is consistent with our Privacy Policy'. A separate General Terms clause permits InfoTrack to gather analytics in relation to any and all activity on the InfoTrack Systems, use of the InfoTrack Products and Client Data. Whether identity images, biometric material or OCR output are used to train or tune any model is not addressed in any document read. | Confirm in writing that client face images, identity documents, biometric templates and OCR output from InfoTrackID are never used to train, tune or evaluate any model, by InfoTrack or by any supplier, and identify the clause that says so. | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Analytics and product improvement | Public claim only | The General Terms permit InfoTrack to gather analytics in relation to any and all activity on the InfoTrack Systems, use of the InfoTrack Products and Client Data. The privacy policy states InfoTrack may combine personal information with information available from other sources, including the recipients it lists, to help provide services, and that it operates an ISMS whose policies safeguard against unnecessary retention. Section 8 states InfoTrack takes reasonable steps to destroy or de-identify personal information after it is no longer needed for business purposes or legal compliance. No opt-out from the analytics permission is described, and no in-product feedback control for the verification result is described. | Does the analytics permission in the General Terms extend to InfoTrackID verification records, face images and OCR output, and can it be switched off for our account? | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Retention of identity data | Public claim only | The InfoTrackID security page and the product FAQ, both checked 27 September 2026, state that personal identity information and identity documentation are retained for 90 days in alignment with Registrar General and OSR standards, after which the full three-page VOI report is replaced with a Summary Report that excludes page 3, the copies of the complete identity documents. The same page states that where a PMS is used the full report remains available in the PMS, and that a practice ordering through the InfoTrack website must download and retain the full report before the 90 days expire or it will be replaced. Both statements sit on product marketing pages. The General Terms and privacy policy read on the same day contain no 90-day figure: the privacy policy gives 12 to 15 months for criminal-history-check data and otherwise commits only to destroying or de-identifying personal information when no longer needed. | Which signed document commits you to the 90-day retention and replacement, and does the 90-day clock also govern face images, liveness video, biometric templates, DVS transaction records and audit logs, not just the report? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Deletion, replacement and certification | Public claim only | The InfoTrackID security page describes a 'strict non-storage policy' under which, after 90 days, the full VOI report is replaced with a Summary Report without the identity documents. The product FAQ states more broadly that 'after 90 days, all personal identity information is permanently deleted'. Those two statements differ in scope: one describes replacing a report page, the other deleting all personal identity information. General Terms clause 18 defines Retained Information that may survive termination, including material required for accounting, corporate governance or regulatory purposes and material held in archived backups, and requires it to be kept confidential, not used for any other purpose, and permanently deleted once no longer required. No certified-deletion undertaking was found. | At 90 days, exactly what is deleted and what is retained, including archived backups under clause 18, and will you certify deletion of face images and biometric material in writing on request? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Vendor and overseas access to content | Public claim only | The InfoTrackID security page states the VOI database is write-only and is accessible for read access only via a private VPC to 'a few highly privileged InfoTrack administrators'. The privacy policy section 7 states people located overseas, in Vietnam, may have read-only access to personal information to provide development services, strictly limited, under secure protocols and under the supervision and control of Australian-based teams, and that such access occurs only where there is an enforceable contractual arrangement requiring Privacy Act compliance. The same section states that for InfoTrackID no data collected for the purposes of the service will ever be transferred or stored outside Australia; the read-only development access and that commitment are stated in the same section and their interaction is not explained. No access log is offered to clients. | Can Vietnam-based development staff read InfoTrackID identity records or face images, and if not, which control excludes them? Can we obtain the administrator access log for our own verifications? | [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Access control and credentials | Public claim only | The InfoTrackID security page describes a write-only database with read access restricted via a private VPC to a small number of privileged administrators. The privacy policy section 8 lists firewalls across all office networks and sites, anti-virus software on all workstations, cyber-security training for all employees at onboarding and through the year, restrictions on physical access to paper files, contractual assurances from third parties, and supplier vetting through risk assessment. Neither document read describes single sign-on, SCIM, enforced multi-factor authentication or role-based restriction of who in a practice may order a VOI. The information security page's 2023 advisory recommends clients set up multi-factor authentication, which is guidance rather than a product control. | Is single sign-on with enforced multi-factor authentication available for the InfoTrack portal, and can we restrict which of our users may order an InfoTrackID verification and view page 3 of a completed report? | [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - Information Security](https://www.infotrack.com.au/information-security/) |
| Encryption in transit and at rest | Public claim only | The InfoTrackID security page states all data at rest is secured using AES256, all data in transit is secured end to end using TLS v1.2 as the minimum version, all documents ordered as part of the report are encrypted on the server using AES256, and all transport between the VOI platform and servers is secured using SSL. These are product-page statements, not contractual ones; the General Terms clause 22 obligation read on the same day speaks to a security standard rather than to named algorithms. Customer-managed keys are not offered on any page read. | Confirm the encryption standards and key management for face images, liveness video and biometric templates specifically, and whether the same standards apply on the path to the facial-recognition and OCR suppliers. | [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Independent security assurance | Not confirmed | Three published statements about the same subject do not line up. General Terms clause 22 requires each party to maintain controls that meet or exceed ISO 27001:2022 or any equivalent or successor standard. The InfoTrackID security page states 'InfoTrack complies with the ISO27001 Certification for storing data' and that the VOI database is in an 'ISO27001 certified private cloud provided database', without a version, certificate number or certifying body, and the certification described attaches to the cloud provider's database as much as to InfoTrack. The privacy policy states InfoTrack operates an Information Security Management System 'with full consideration of the ISO27001:2013 standard', which is an earlier version and is not a certification. The information security page displays a badge image whose file name is SOC-2-Type-II-and-ISO and offers a security pack by request form; no report, certificate or scope statement is published. No certificate was inspected. | Provide the current ISO/IEC 27001 certificate and the SOC 2 Type II report with their scope statements, and confirm whether InfoTrackID and its facial-recognition, liveness and OCR components are inside that scope. | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - Information Security](https://www.infotrack.com.au/information-security/) |
| Contracting entity and contract structure | Public claim only | The privacy policy states InfoTrack means InfoTrack Pty Limited (ABN 36 092 724 251) and its Australian subsidiaries, and that InfoTrack is bound by the Privacy Act 1988 (Cth) including the Australian Privacy Principles. The General Terms page states these terms are current from 1 August 2026 for new clients and from 1 September 2026 for existing clients, and includes clause 9, 'Use Of AI in the InfoTrack Services', which applies where InfoTrack offers AI Services. Clause 4 creates a separate Supplier Contract between the client and each Third Party Supplier, entered into by InfoTrack as agent and held on trust, with claims in respect of Third Party Products lying against the Third Party Supplier and not InfoTrack except where law prevents the exclusion. No standalone data processing agreement is published. | Will InfoTrack Pty Limited be our contracting entity for InfoTrackID, does clause 9 apply to the facial-recognition and liveness components, and is a separate Supplier Contract created with any biometric supplier under clause 4? | [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Cross-border transfers | Public claim only | The privacy policy section 7 states InfoTrack stores and retains personal information in Australia and does not presently disclose personal information to organisations located overseas, though it discloses information in Australia to some multinational organisations that are located both in Australia and overseas, including the United Kingdom, the United States and New Zealand. It then states a product-specific commitment: 'With respect to InfoTrackID and verification of identity services provided by InfoTrack, no data collected for the purposes of this service will ever be transferred or stored outside of Australia.' A parallel commitment is given for ACIC criminal-history data, subject to a Permitted Offshore Transfer arrangement being granted, with no such qualification on the InfoTrackID sentence. Overseas read-only development access from Vietnam is disclosed in the same section. | Does the InfoTrackID never-offshore commitment in section 7 also bind the supplier that performs facial matching and liveness detection, and is that commitment repeated in the General Terms or only in the privacy policy? | [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Incident notification | Public claim only | General Terms clause 21 requires a party to notify the other in writing, without undue delay and within no more than 72 hours of becoming aware, of a compliance notice or request from a Regulator or a breach of clause 21 or any applicable privacy law. Where a party has reasonable grounds to suspect a Notifiable Data Breach, it must notify the other in writing with all relevant details without undue delay and no later than 72 hours after becoming aware, cooperate in the investigation, take reasonable steps to mitigate and prevent recurrence, cooperate in good faith to minimise reputational damage including liaising on communications with the Regulator and affected individuals, and cooperate in preparing and submitting notifications. Clause 21 survives termination. The privacy policy points complainants to the Office of the Australian Information Commissioner. | Does the 72-hour clause 21 obligation cover a breach at a Third Party Supplier or the biometric supplier, and who in InfoTrack is the notifying contact for our account? | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Change notice for terms, suppliers and features | Public claim only | The General Terms page states these terms are current from 1 August 2026 for new clients and from 1 September 2026 for existing clients. The terms allow InfoTrack to amend the Third Party Terms from time to time where directed or required by a Third Party Supplier or to comply with its agreement with that supplier, with at least 14 days written notice. Clause 7.3 lets the client terminate if InfoTrack exercises its clause 7.1 rights to the client's material detriment, and clause 11.8 lets the client terminate immediately if it objects to a fee increase. The privacy policy states it may be revised or updated from time to time and that the revised version will be published on the websites. No notice obligation specific to changing a biometric, facial-recognition or OCR supplier was found. | What written notice will we get before the facial-recognition, liveness or OCR supplier behind InfoTrackID changes, and do we have a right to object? | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| Export and exit | Not confirmed | The clearest published exit mechanism for InfoTrackID data is operational rather than contractual: the security page states the practice must download and retain the full VOI report before the 90-day replacement if it ordered through the InfoTrack website, and that the full report remains in the PMS where one is used. General Terms clause 18 addresses Retained Information after termination and requires it to be kept confidential, not used for other purposes and permanently deleted when no longer required. Clause 19 vests rights in derivative works and outputs in InfoTrack, its affiliates or Third Party Suppliers on creation. No bulk export of historical verification records, audit logs or reports is described on any page read. | On exit, what bulk export of our historical InfoTrackID verifications, reports and audit logs is available, in what format, and within what period? | [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/); [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) |
| Connectors and third-party products | Public claim only | General Terms clause 4 provides that many InfoTrack Products incorporate or compile Third Party Products supplied by Third Party Suppliers subject to Third Party Terms, that a separate Supplier Contract is formed between the client and the Third Party Supplier with InfoTrack acting as agent and holding the benefit on trust, and that claims in respect of Third Party Products lie against the Third Party Supplier rather than InfoTrack except where law prevents the exclusion. Clause 8.3 has the client consent to Client Data being sub-licensed and disclosed to Third Party Suppliers and subcontractors for the limited purpose of providing the systems and products. The privacy policy names the integration partners with whom information may be shared with the client's consent. The wider InfoTrack site also publishes an iTrack MCP server and a Claude Cowork listing; those are recorded in the sibling InfoTrack profile and are outside this product. | For an InfoTrackID verification, which Third Party Suppliers are we contracting with directly under clause 4, and can any AI assistant or MCP client reach InfoTrackID verification records on our account? | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy); [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/) |
| Retrieval from sources outside the tenant | Public claim only | The verification chain reaches defined external systems rather than the open web. The product FAQ states identity documents are checked against the Australian Government Document Verification Service, and the privacy policy names the DVS and state and territory land registry offices as Third Party Suppliers, and ACIC and NPCS for criminal-history checks. No open-web search, browsing or adverse-media retrieval is described for InfoTrackID on any page read, and the components described - facial matching, liveness and OCR - operate on the captured images rather than on retrieved content. | Does any part of an InfoTrackID verification query a source other than the DVS and the named Third Party Suppliers, including any open-web or adverse-media lookup? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) |
| What the product does without a practitioner action | Not confirmed | The verification is initiated by the practice and the report is returned to it, but the pages read do not say whether a pass or fail determination is made automatically. The product page states liveness checks 'ensure the user's physical presence and effectively counters impersonation attempts' and that OCR 'extracts text from images and auto-populates the data', so at least one step writes data into the record without a practitioner keying it. Page 2 of the report 'contains the results of the Verification of Identity'. Whether a failed facial match or liveness check blocks the transaction, flags it for review or simply appears on the report is not stated, and no setting is described. This is a design a firm must confirm and accept. | When a facial match or liveness check fails, what does the product do - block, flag or report - and can a practice configure that behaviour or require a manual decision before the report issues? | [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/); [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/) |
| Human review before the verification is relied on | Public claim only | General Terms clause 9.6 states AI Services may not have been developed or approved by legal practitioners and carry no legal or professional endorsement, may not reflect applicable laws, suit the client's circumstances or be current, do not constitute legal advice and must not be relied on as such, that a qualified lawyer should review any AI Services output before it is relied upon, and that the client is responsible for validating AI Services on its own professional skill, judgement and experience. Clause 10.1 states InfoTrack is entitled to rely on Client Data as provided. No product control that forces a named reviewer before a VOI report is accepted onto a matter is described on any page read. | Does clause 9.6 apply to the InfoTrackID facial-match and liveness output, and what product control can require a named practitioner to review and sign off a verification before it is relied on for a conveyancing transaction? | [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms); [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/) |

## Notes

The Australian facts are on published documents read on 27 September 2026 rather than carried across from the sibling profile: the privacy policy names InfoTrack Pty Limited (ABN 36 092 724 251), commits to storage and retention in Australia, and carries an InfoTrackID-specific sentence that no data collected for the service will ever be transferred or stored outside Australia. No ACN is published on the pages read; only the ABN. Three things the profile deliberately does not assert. First, whether the facial-recognition, liveness and OCR processing itself runs in Australia: section 7 of the privacy policy speaks to transfer and storage, not to where a model executes, and no page names the supplier, so modelProvider is not_verified and the transfers and deployment questions put the point to the vendor. Second, whether biometric templates are created, stored or discarded: nothing read addresses it. Third, the 90-day retention and deletion figure remains vendor_claim: it appears twice on product marketing pages, in two versions that differ in scope (report page replaced versus all personal identity information deleted), and appears nowhere in the General Terms or privacy policy read the same day. The assurance position is recorded as conflicting_evidence because the General Terms require ISO 27001:2022 controls, the InfoTrackID page claims ISO27001 certification without a version or certificate, the privacy policy describes an ISMS built with consideration of ISO27001:2013, and the information security page shows only a badge image and a form to request a security pack; no certificate or report was inspected, so facts.assurance records the contractual 2022 standard and the consideration sets out the discrepancy. The AI-directing-content check is now complete for the two candidate pages Phase 2 left open, /ai-solutions and /powered-by-infotrack-ai: both were read from cache and neither contains content addressed to AI models. Pricing model is recorded as per_document on the published statement that costs are returned per verification to the practice-management system; no price is published and no pricing page was found for this product. One capability gap was reported to the Maestro rather than invented here: identity verification, which is the whole of what this product does and which no CAPABILITY value expresses; intake-triage is used as the closest defensible existing value. Named client testimonials on the product page are not carried into customersNamed because the catalogue does not record individuals' names and the practices are quoted about ease of use rather than as reference sites. Capability list updated 2026-09-27 when the controlled vocabulary was extended from 19 to 38 values: added identity-verification. Values already present were kept, because they remain true descriptions of what the product does.

## Sources

- [InfoTrackID - product page, benefits, security of personal data and FAQs](https://www.infotrack.com.au/infotrackid/) (checked 2026-09-27)
- [InfoTrackID - Security and Legislation Compliance](https://www.infotrack.com.au/infotrackid/security-legislation-compliance/) (checked 2026-09-27)
- [InfoTrack - Privacy Policy](https://www.infotrack.com.au/legal/PrivacyPolicy) (checked 2026-09-27)
- [InfoTrack - General Terms (current from 1 August 2026 / 1 September 2026)](https://www.infotrack.com.au/legal/GeneralTerms) (checked 2026-09-27)
- [InfoTrack - Information Security](https://www.infotrack.com.au/information-security/) (checked 2026-09-27)
- [InfoTrack - How InfoTrack Uses Artificial Intelligence](https://www.infotrack.com.au/powered-by-infotrack-ai/) (checked 2026-09-27)
- [InfoTrack - AI Solutions](https://www.infotrack.com.au/ai-solutions/) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.