Trust & Safety
Zero Trust security policy & data practices
This page explains, plainly, what we collect, how logins work, and how we enforce our community rules. We'd rather under-promise than use vague security marketing language.
What "Zero Trust" means here
Every request to a signed-in area of ImmiClub — your account page, admin actions — is independently verified on our server, every time. No page or button is trusted just because a request reached it; the server re-checks who you are and what you're allowed to do on every single call. There's no standing session on our servers that can be reused without a valid, signed token.
How login works
We use email-only sign-in: you request a 6-digit code, it's emailed to you, and it expires in 10 minutes. We never ask for or store a password. The code itself is never stored in plain text — only a one-way cryptographic hash of it, so even we can't read out a valid code from the database.
What we collect
Just your email address and a display name you choose. We do not collect phone numbers, government ID, visa documents, or payment details — none of that is needed for community membership, and we've deliberately kept it out of scope.
Session security
Once you log in, your session is a signed token stored in an HttpOnly, Secure cookie — meaning it can't be read or stolen by page scripts, and it's only ever sent over an encrypted connection.
Admin accountability
Every admin action — banning a member, awarding points or a badge — is written to an audit log with the admin's ID and timestamp. Admin access itself is limited to a short, explicit list of email addresses, not a role anyone can grant themselves.
Community conduct & bans
Obviously abusive display names are blocked automatically at sign-up. Day-to-day conversation happens in our Discord server, which has its own automated filtering and human moderators — that's where most enforcement happens, and where you should report abusive behaviour. Website accounts can be suspended by an admin for violations of our community rules, with the reason logged.
What this site is not
ImmiClub is an independent community project, not a bank, government service, or enterprise platform with a dedicated security team or compliance certifications. We apply solid, standard practices (hashing, signed sessions, audit logs, data minimisation) — but we don't claim formal certifications we don't hold.
Data deletion
Want your account and data removed? Email hello@immiclub.com.au and we'll delete your account record on request.