Legal-specific · Compliance and privacy · High confidence
Livesign Verify
THELAWSTORE.COM.AU PTY LTD (trading as Livesign) · Livesign Verify identity verification, including the Document Verification Service checks, on the vendor's own platform. Livesign Docs signing, Livesign AML, and the Dye & Durham Unity Search distribution need separate review.
Identity verification for Australian conveyancing, legal and AML onboarding: the client scans government-issued identity documents and takes a selfie in a mobile app, and the practitioner receives a VOI report and an Identity Opinion.
Opens a private software assessment of Livesign Verify for one task, with this profile’s questions to hand.
Intake and triageElectronic signing and executionIdentity verificationRedaction
Published facts
Deployment
SaaS
Hosting regions
Australia
Australian region
Yes
Training on customer content
Unknown
Retention summary
Privacy policy Part 8.3: DVS transaction records (query fields and outcome) are retained in accordance with the vendor's AML/CTF record-keeping obligations; other identification information is retained for the period applicable to the relevant purpose; facial images collected for facial-verification purposes are destroyed once no longer required for the verification transaction unless a specific legal obligation requires retention. Part 8.4 then requires destruction or de-identification under APP 11.2. Terms clause 3.7.4 requires the business customer to destroy personal information once the purpose is fulfilled, and clause 3.7.5 requires it to keep DVS transaction records for at least seven years. The distributor page states VOI reports are stored for seven years in Australian hosted data centres.
Integrations
Dye & Durham Unity Search, electronic Client Authorisation Form (eCAF), Commonwealth Document Verification Service via the Attorney-General's Department DVS Hub, an unnamed Identity Service Provider gateway
Pricing summary
Terms clause 5.1 states that fees for the Services are displayed on the Website, and clause 5.2 allows the fee to be paid by the business by credit or debit card or by a third party, with a GST-compliant tax invoice issued to the payer. No price, plan or unit appears on the pages read, and the site URL map returned no pricing page. The distributor page states VOI reports are available for seven years at no extra cost.
Australian presence
Yes — Australian contracting entity is THELAWSTORE.COM.AU PTY LTD (ACN 653 541 729), named in both the terms of use (clause 1.1) and the privacy policy, with a postal address at Level 16, 60 Carrington Street, Sydney NSW 2000. Terms clause 15.1 states the Website and Services are intended to be provided to residents of Australia only, and clause 15.2 applies the laws of New South Wales; clause 3.2.1 limits DVS features to legal entities carrying on business in Australia and/or New Zealand. The vendor holds a DVS ID Service Provider Participation Agreement with the Commonwealth Attorney-General's Department as Framework Administrator (terms clause 3.1.2). The site trades as Livesign; no ABN and no ASIC extract were published on the pages read.
Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Terms clause 1.1 states the website provides Australian or New Zealand domiciled businesses with the ability to create and send an electronic document for signature and to request or complete a Verification of Identity, which may include verification via the Document Verification Service. The vendor's own site splits this into Livesign Verify, Livesign Docs and Livesign AML, and the how-it-works page states the products work in combination in one envelope, so a document can be sent with VOI and AML inside it. This profile covers the identity-verification product.
Ask: Which of Livesign Verify, Livesign Docs and Livesign AML are in our subscription, and can VOI be sent without signing and without an AML check?
The product page states that the client scans their government-issued identity document from a mobile device and that the app 'authenticates the encrypted data inside the passport chip and confirms the face match in real time', reading passports from over 170 countries. The how-it-works page states that at the point of signing the client transfers to the Livesign app, uploads identity documents and takes a selfie, and that the document is then 'signed and biometrically matched to the signer's identity'; a Verification of Identity and AML report is returned to the practitioner. The distributor page adds facial biometric verification, DVS checks, anti-tampering ID checks and optional redaction of personally identifiable information from VOI reports, with no mechanism stated for the last two. The how-it-works page also states support is 'Supported also by a chat bot avail 24/7'.
Ask: Which steps use a model rather than a deterministic check - specifically the face match, the anti-tampering ID check, the optional PII redaction and the chat bot - and what does each one output to the practitioner?
The service is a hosted web platform with registration and sign-in at app.live-sign.com plus a mobile app the client downloads from a secure link to complete verification (terms clause 4, how-it-works page). Terms clause 7.1 refers to access codes and clause 7.4 states that while the vendor 'may implement multi-factor authentication, it does not guarantee against unauthorised use'. No on-premises or private-tenancy option appears on the pages read.
Ask: Is there any deployment option other than the shared hosted platform, and where are the client app's captured images held before the VOI report is produced?
Terms clause 15.1 states the Services are intended to be provided to residents of Australia only, and clause 3.2.1 limits the DVS features to legal entities carrying on business in Australia and/or New Zealand that are subject to the Australian Privacy Act 1988 (Cth), the New Zealand Privacy Act 2020 or an applicable state or territory privacy law. The privacy policy is issued under the Privacy Act 1988 (Cth), the Identity Verification Services Act 2023 (Cth), the Identity Verification Services Rules 2024 and a Participation Agreement with the Attorney-General's Department. The product page separately states, as a vendor claim, that the product 'meets both ARNECC and AUSTRAC ID requirements'.
Ask: Which registrar or ARNECC Model Participation Rules requirement does each element of the VOI report evidence, and what is your position where a state registrar imposes additional requirements?
Vendor content directing how AI describes the product
Not confirmed
Checked 2026-09-27 for a page or block directing how AI models, assistants or crawlers should describe the product. The cached URL map of live-sign.com (63 URLs) lists no /llms.txt, /ai-info, /ai or /for-ai path, and none of the four vendor pages read carries such a block. A map lists linked pages, so an unlinked file at that root cannot be excluded from what was checked.
Ask: Do you publish any file or page - llms.txt, an AI-information page or similar - that tells AI assistants how to describe Livesign, and if so at what address?
Record the practical work needed to introduce and maintain the software.
Fees and licence unit
Public claim only
Terms clause 5.1 states that the fees payable for the Services are displayed on the Website; clause 5.2 allows payment by the business by card or by a third party, and clause 5.3 provides for a GST-compliant tax invoice to the payer. No price, unit or plan was found on any page read, and the site URL map of 63 pages returned no pricing page, so the fee schedule the clause refers to was not located.
Ask: Provide the current fee schedule referred to in clause 5.1, stating the unit (per VOI, per envelope or per seat), the charge for a failed or re-sent verification, and any charge for accessing stored VOI reports.
Terms clause 7.6 directs security and account notifications to support@live-sign.com. The privacy policy names a Privacy Officer with a Sydney postal address and states complaints are acknowledged within five business days with a substantive response within 30 calendar days, and that access requests under APP 12 are answered within 30 days. The how-it-works page states a local support team is available and that support is also 'Supported also by a chat bot avail 24/7'. No service level, uptime commitment or escalation matrix appears on the pages read.
Ask: Provide the support hours, response targets and escalation path for a failed verification on a settlement day, and state whether the first response is the chat bot or a person.
Compare complete work at the required quality, including checking and correction.
Published performance claims
Public claim only
The product page carries unquantified performance claims with no method, sample or measurement published: 'Australia's only verification solution that reads passport chips for global coverage and confirms real face biometrics simultaneously', 'This ensures 100% data accuracy, resulting in less flags on identity verification and AML reports', and verification taking 'Seconds'. The distributor page carries 'Highest Standard for ID verification', 'High Rate of Passed VOIs' and 'Anti-Tampering ID Checks to guarantee that all submitted ID documents are authentic'. No false-accept or false-reject rate, no evaluation report and no independent test result appears on any page read.
Ask: Provide measured false-accept and false-reject rates for the face match and the chip authentication, the test population, and the rate at which a verification is referred for manual review.
On the vendor's own documents the product assists the firm's own verification of identity: clause 2.2 states the vendor is not the firm's Identity Agent and does not warrant regulatory compliance, clause 6.1(2) requires the firm to review each completed VOI, and clause 3.3.3 bars sole reliance on DVS-derived information in proceedings involving the individual. The distributor page states VOI requests do not expire, can be sent worldwide, can be resent and carry automatic reminder emails, and that VOI can be used without document signing.
Ask: For our matter types, what remains a practitioner task after a completed VOI - including a non-match, an unreadable chip and a client without a passport - and what evidence does the report give us for each of those paths?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional responsibility
Public claim only
Terms clause 2.2 states the vendor is not acting as the firm's agent and in particular is not acting as an Identity Agent as defined in the ARNECC Model Participation Rules, that the Services are provided solely to assist the firm to undertake its own verification of identity, that the firm is responsible for satisfying any legal requirement to verify identity, and that the vendor does not warrant that the Services comply with any regulatory requirement to verify identity. Clause 3.6.1 states the vendor obtains the individual's express electronic consent before a DVS check, and the privacy policy Part 6 sets out the IVS Act consent elements; clause 3.6.4 requires the firm to notify the vendor immediately if it learns consent has been revoked.
Ask: Given clause 2.2, what does our file need to record for our own VOI obligation to be discharged, and will you provide the consent records you hold under clause 3.6.3 on request?
No model, biometric engine, document-authentication vendor or cloud AI service is named on any page read. The product page describes 'live image check' and 'passport chip-reading technology' and the how-it-works page describes the signer being 'biometrically matched', without naming who performs the match. The privacy policy names the Attorney-General's Department DVS Hub, the issuing agencies and 'our nominated IDSP gateway provider' but names no biometric provider. The site URL map returned no security page or trust centre where such a list might sit.
Ask: Name the biometric face-matching engine, the passport-chip authentication component and the provider behind the 24/7 chat bot, their vendors and legal entities, and the country in which each runs.
Privacy policy Part 7.2 and 7.3 disclose the chain: identification information goes to the Attorney-General's Department via the DVS Hub and on to the issuing agency, and may be transmitted through the gateway infrastructure of the vendor's nominated Identity Service Provider, which the policy states is bound by its own participation agreement with the department and is not authorised to use or retain the information for any other purpose. The IDSP is not named. No subprocessor list, register or hosting-provider name is published, and the site URL map returned none.
Ask: Name the Identity Service Provider gateway, the hosting provider for the platform and the VOI report store, and provide a dated subprocessor list with our notice and objection rights.
The privacy policy limits use rather than addressing training. Part 7.1 states identification information is used solely to complete the consented DVS transaction and record the outcome; Part 5.3 records the IVS Act section 9(4) prohibitions on data profiling, direct marketing and behavioural advertising; Part 9.2 states 'We do not collect or store biometric information derived from your facial image' and Part 9.3 that the facial image will not be retained, used or disclosed 'for any purpose other than providing the ID Service Client with our Identity Opinion for which your express consent was given'. Neither the terms nor the privacy policy mentions model training, tuning or product improvement anywhere, and the privacy policy is incorporated as part of the agreement by terms clauses 9.1 and 15.6.
Ask: Will you warrant that no identity document image, facial image, verification outcome or VOI report - ours or our clients' - is used to train, tune or evaluate any model, including any third-party biometric provider's?
Nothing on the pages read describes what happens to a practitioner's or a support agent's correction of a verification outcome, or to a failed or disputed verification, beyond terms clause 6.1 requiring the firm to review each completed VOI and notify the vendor of any inaccuracy. No in-product rating, review-queue or quality-monitoring mechanism is described, and no statement addresses whether such reports are used to adjust the checks.
Ask: When we report an inaccurate VOI under clause 6.1(3), what happens to that report - is it used to adjust the face match or document checks, and is the underlying material retained for that purpose?
Privacy policy Part 8.3 retains DVS transaction records (query fields and outcome) in accordance with the vendor's AML/CTF record-keeping obligations, retains other identification information for the period applicable to the relevant purpose, and destroys facial images collected for facial-verification purposes once no longer required for the verification transaction unless a specific legal obligation requires retention. Part 4.3 states complete copies of original identity documents are not collected or retained for DVS record-keeping purposes unless an independent legal obligation requires it. Terms clause 3.7.5 requires the firm to keep its own DVS transaction records for at least seven years. The distributor page states VOI reports are stored for seven years. No single retention period for the VOI report itself is stated in either binding document.
Ask: State the retention period for the VOI report, the captured document images, the selfie and the audit log, who holds them, and whether we can shorten or extend it for our matters.
Privacy policy Part 8.4 states that on expiry of the applicable retention period the vendor will take reasonable steps to destroy or de-identify identification information under APP 11.2, and Part 10.4 and 6.5 allow an individual to withdraw consent at any time, which may mean the service cannot continue. Terms clause 3.7.4 puts a destruction obligation on the firm once the purpose is fulfilled. No certified-deletion undertaking, no deletion service level and no statement about deletion by the IDSP gateway or the hosting provider appears on the pages read.
Ask: On our instruction or on exit, what is deleted from the platform and from your gateway and hosting providers, in what period, and will you certify the deletion in writing?
Privacy policy Part 8.2 states security measures include access controls ensuring that only authorised personnel can access identification information, audit logging of all DVS requests and of access to identification information, regular security assessments and penetration testing, and staff privacy training. Terms clause 3.8.1 prohibits the firm from allowing any person outside Australia or New Zealand to access DVS features or identification information without the vendor's prior written approval, which is an obligation on the firm rather than a statement about the vendor's own personnel. Nothing states where the vendor's own staff or support team are located, or whether access is ticketed and disclosed to the firm; the how-it-works page refers to a 'local support team'.
Ask: Which of your personnel and contractors can view our clients' identity documents, facial images and VOI reports, in which countries are they located, under what approval, and can we receive the access log Part 8.2 says you keep?
Terms clause 4.1 collects user profile and privileges plus accreditation (solicitor, licensed conveyancer or employee or contractor of the member organisation) at registration; clause 4.3 makes the firm's own administrator responsible for promptly removing a departing user's privileges; clause 7.3 forbids credential sharing; clause 7.4 states that while the vendor may implement multi-factor authentication it does not guarantee against unauthorised use; clause 7.6 requires notification if the telephone number linked to the account changes or unauthorised use is suspected. Single sign-on, enforced multi-factor authentication and exportable audit logs are not addressed on the pages read.
Ask: Is multi-factor authentication available and can we make it mandatory for all our users, is single sign-on supported, and can we export a per-user log of who opened which VOI report?
Privacy policy Part 8.2 states identification information is encrypted in transit 'using TLS or equivalent' and at rest. The product page FAQ states 'Data is encrypted and securely stored in Australian-hosted data centres with ISO 27001 accreditation'. Terms clause 7.2 states that no data transmission over the internet can be guaranteed as totally secure and that the vendor does not warrant the security of information transmitted using the website. No algorithm, key-management description or customer-managed-key option appears on the pages read.
Ask: Confirm the encryption algorithms and key management for VOI reports, document images and facial images at rest, who holds the keys, and whether customer-managed keys are available.
The only certification statement found attributes the certification to the hosting facility, not to the vendor: the product page FAQ states data is 'securely stored in Australian-hosted data centres with ISO 27001 accreditation'. No SOC 2, ISO 27001, IRAP or penetration-test report for Livesign itself is published, and the site URL map returned no security page and no trust centre. The privacy policy does record assurance machinery tied to the DVS framework: Part 8.2 refers to regular security assessments and penetration testing, Part 13 to annual OAIC assessment of the identity verification services under section 40 of the IVS Act, annual reporting tabled in Parliament under section 41 and annual compliance reporting by participants against participation agreements, and the Schedule C note states a Privacy Impact Assessment is available on request from the Privacy Officer.
Ask: Provide the ISO 27001 certificate and its scope - whether it covers Livesign's own systems or only the data centre operator - plus your DVS Privacy Impact Assessment, your latest penetration-test summary and your most recent annual DVS compliance report.
The published contract is online Terms and Conditions of Use operated by THELAWSTORE.COM.AU PTY LTD (ACN 653 541 729), accepted by using the website (clause 1.1). Clause 10.1 provides the Services on an 'as is' and 'as available' basis and clause 10.2 excludes liability for loss including corruption or loss of data, subject to the Australian Consumer Law carve-out in clause 10.4 limiting liability for implied warranties to re-supply or the cost of re-supply. No liability cap figure is stated. Clause 11 requires the firm to indemnify the vendor, including for its own DVS misuse. Clause 13 requires notice, good-faith negotiation and mediation in New South Wales before proceedings; clause 15.1 and 15.2 set New South Wales courts and law; clause 15.6 makes the Terms plus the Privacy Policy the entire agreement. Clause 14.1 extends the disclaimers, exclusions and indemnities to the benefit of the Framework Administrator. No data processing agreement is published.
Ask: Will you enter a signed services agreement and data processing schedule with our firm, and if so how does it vary these online Terms on liability, indemnity, the clause 5.1 fee schedule and notice of change?
Privacy policy Part 7.6 states the vendor does not disclose identification information to overseas recipients except as described in the policy, being New Zealand organisations approved to use the DVS where applicable under the IVS Act, and that it takes reasonable steps under APP 8 before any permitted overseas disclosure. Part 15 records the same position against APP 8. Terms clause 3.8 restricts overseas access by the firm's own personnel without written approval. Neither document states where the biometric face match, the chip authentication or the platform hosting physically run; the product page states data is stored in Australian-hosted data centres, and the distributor page states seven-year storage in Australian data centres.
Ask: Confirm in writing that the face match and the passport-chip authentication are performed in Australia and identify every country in which our clients' identity data is processed, stored, backed up or supported.
Privacy policy Part 12.1 states that on becoming aware of an eligible data breach involving identification information the vendor will assess the incident as soon as practicable and in any event within 30 days, notify the OAIC and affected individuals where the Notifiable Data Breaches scheme requires, notify the Attorney-General's Department under its Participation Agreement, and take remediation steps. Terms clauses 7.6 and 7.7 place notification obligations on the firm, including additional obligations where a breach may relate to DVS features or identification information. No period for notifying the business customer is stated, and no incident history appears on the pages read.
Ask: What is the contractual period from discovery for notifying our firm of an incident affecting our clients' identity data, who notifies the affected clients, and have there been any notifiable incidents in the last 24 months?
Terms clause 1.3 reserves the right to review and change any of the Terms by updating the page at the vendor's sole discretion, with reasonable endeavours to give notice, changes taking immediate effect from publication and continued use deemed acceptance. Privacy policy Part 16 allows updates published on the website with reasonable steps to notify affected individuals where changes are material, and records the version date on the cover page. Clause 3.11.1 prohibits the firm from making any public statement about the DVS or its access to it without the vendor's prior written consent. No notice obligation attaches to a change of the IDSP gateway, the biometric component or the hosting arrangement.
Ask: What advance written notice will we receive before a change to the Terms, the gateway provider, the biometric component or the hosting location, and may we object or terminate without penalty?
Terms clause 12.2 allows the firm to terminate by notifying the vendor and closing its accounts, and clause 12.3 allows the vendor to terminate for breach, where required by law, where provision of the Services is no longer commercially viable in its opinion, or as a consequence of the Framework Administrator suspending or terminating its DVS access; clause 12.4 allows suspension or denial of access without notice in the stated circumstances. Clause 3.7.5 requires the firm to keep DVS transaction records for at least seven years, and the distributor page states VOI reports are available for seven years at no extra cost. No export format, data-return obligation or post-termination access period is stated in the Terms.
Ask: On termination, how do we export completed VOI reports, signed documents and audit trails, in what format, for how long does access continue, and what is your process if your DVS access is suspended mid-matter?
The distributor page and announcement describe Livesign VOI and the electronic Client Authorisation Form integrated into Dye & Durham's Unity Search, with the practitioner downloading VOI documents from their practice-management system, Livesign or Unity Search. The vendor's how-it-works page describes a single envelope combining documents, VOI and AML, a practitioner dashboard, and a 24/7 chat bot in support. The privacy policy adds the IDSP gateway and the DVS Hub. No connector list, API documentation or data-flow description for any of these was found on the pages read.
Ask: List every integration that will be enabled for us - Unity Search, any practice-management system, the chat bot - and state exactly what client data each receives and where it is held.
Nothing on the pages read describes any open-web retrieval. The lookups that are described are a government database check through the DVS Hub to the issuing agency and a chip read from the presented document. Whether the AML component or the chat bot queries any external source with client details is not addressed anywhere on the pages read, and the AML product was not examined for this profile.
Ask: Does any component - the verification flow, the AML check or the 24/7 chat bot - send our client's name or identifiers to the open web, a search engine or a commercial data broker?
What the product decides and what the firm can inspect
Public claim only
Terms clause 3.4.1 states that as an ID Service Provider under the Participation Agreement the vendor is required to give the firm an Identity Opinion rather than a raw match result, described as its opinion about whether the document appears genuine based on multiple identity checks and capable of being expressed in absolute terms or as a grade or risk level. Clause 3.4.2 states the firm 'must not seek to ascertain, derive or disclose the underlying Information Match Result from the DVS' and may only use the Identity Opinion; clause 3.4.3 states match results have not been independently verified by the vendor and opinions are provided on an 'as is' basis. The product therefore issues a composite automated opinion whose underlying DVS component the firm is contractually barred from deriving.
Ask: What values or grades can an Identity Opinion take, which component checks feed it, and what may we record on the file about its basis given clause 3.4.2?
Terms clause 6.1(2) requires the firm to review each completed E-Document or VOI to confirm its accuracy and clause 6.1(3) to notify the vendor immediately of any inaccuracy. Clause 3.3.3 states DVS-derived information must not be used as the sole evidence of an individual's identity in any criminal or civil proceedings to which the individual is a party. Clause 10.3(c) requires the firm to ensure its processes can be conducted through alternative means of identity verification if the DVS is faulty, interrupted or unavailable. No product control forcing or recording a practitioner's review is described on the pages read.
Ask: What must a practitioner inspect to discharge the clause 6.1(2) review, does the platform record who performed it, and what is the documented fallback when a verification fails or the DVS is unavailable?
