Security & data handling
This page describes controls that are implemented today. It makes no claim to a certification we do not hold: Immacél has not completed a SOC 2 or ISO 27001 audit, and we will say so here when that changes.
Every firm’s records are kept apart
Every firm’s records are kept apart from every other firm’s. The database itself enforces the separation, not only the application: a signed-in person can read their own firm’s records and nothing else.
Immacél staff can read a firm’s records only through one recorded path, which writes a permanent log entry naming the person, the firm and what was read.
Card data never touches our infrastructure
Payments run through a merchant-of-record provider. Card entry happens in the provider’s PCI-DSS compliant environment; Immacél stores only the resulting customer and subscription identifiers. No primary account number, expiry, or CVC is ever transmitted to, logged by, or persisted on Immacél servers or in our database.
Payment notices are verified and never applied twice
Every notice from our payment provider is checked against its signature before anything happens. A notice that fails the check is refused and never processed. Your tier changes only through a verified notice, never from your browser.
Each payment carries a unique reference, so a notice delivered twice cannot charge, credit or change a tier twice.
Two-factor authentication on financial surfaces
A second sign-in step, a code from an authenticator app, is required to open billing and the performance-fee ledger. You set it up the first time you open them, and it is tied to your own sign-in, not to a setting anyone can switch off.
Billing is never gated
Any client charged a performance fee can read the full ledger behind that fee, at every tier. We treat withholding billing visibility from a paying client as a defect, not a packaging decision.
What is not in place yet
Stated plainly, so no one assumes otherwise: Immacél holds no SOC 2 Type I or Type II report, no ISO 27001 certificate, and no HIPAA or PCI attestation of its own (card handling is delegated entirely to the merchant-of-record provider). We do not currently run an external penetration test on a fixed schedule, we do not offer customer-managed encryption keys, and we do not yet publish an uptime SLA with financial remedy. Data is stored in our cloud provider’s managed database, encrypted at rest and in transit; regional data-residency selection is not available.
Any of the above that changes will be updated on this page with the date it changed. We will not describe a control here before it is actually running.
Reporting a vulnerability
Send findings to security@immacel.com with reproduction steps. We acknowledge reports and will confirm remediation once a fix ships. We do not currently operate a paid bounty programme.