What Llamus does with the details and documents you provide.
Llamus is the software your migration agent uses to prepare your visa application. This page explains what happens to your information inside it.
A visa application asks for more personal information than almost anything else you will fill in — your passport, your family, your money, your health, your history. You are entitled to know how that is handled.
This page says what we actually do. It also says what we do not do yet, further down. We would rather you read the gaps here than find them later.
Each of these is built into the product and checked automatically every time we change the software.
Everything you enter in the application form — passport number, addresses, family details, employment, travel history — is encrypted before it is stored. If someone obtained a copy of our database, the answers would be unreadable. They are unlocked only when you or your agent open your application.
We keep a record of who changed what, and when. It notes which field changed — for example, "passport number" — but never the value before or after. The record is useful to us without becoming another copy of your personal information.
Once an entry is written, nobody can change it or delete it — including us. If something were ever disputed, the history stands.
Your application belongs to the practice handling it. No other agent using Llamus can reach it, search it or see that it exists. This is enforced in the software itself, not just hidden from view.
Agents and their staff cannot sign in with a password alone. They also need a code from an authenticator app or their email. This is required of them, not optional.
Staff at a practice are given one of three levels of access, so someone who only needs to view cases cannot change them, and only the practice owner can add new people to the team.
The document is frozen at the moment it is sent to you, so it cannot change afterwards. When you sign, we record the date and time, your IP address and your browser, and keep the exact document you saw.
The protections on this page are not a policy someone wrote down and filed. They are checked by 1154 automated tests that run every time we change the software, so a change that broke one of them would not reach you.
Everything you send to us, and everything we send to the services we rely on, travels over an encrypted connection.
If an encryption key ever needs to be replaced, we can do it without making your existing information unreadable. The procedure is written down and kept with the software.
Documents you upload are kept in private storage with no public web address. Each download is checked first: only you, the agent handling your case, or an administrator can open one.
Llamus uses AI in three specific places, listed below. Nowhere else. In each case we have said exactly what leaves our systems.
What is sent The passport image or PDF you uploaded.
This reads your name, passport number, nationality and expiry date so you do not have to type them. You can correct anything it gets wrong, and you can type the details yourself instead of photographing your passport at all.
What is sent The text of the note or reply being translated, and the earlier messages in that conversation so the translation makes sense.
This lets you and your agent write to each other in English, Spanish or Portuguese. Only notes that are shared between the two of you are translated.
What is sent The subject and messages of your support request, along with your name, email, account status, your payments and your applications.
This is used to sort your request, summarise it and draft a reply. A drafted reply is never sent to you until a person has read and approved it.
These features are provided by Anthropic (Claude). They are not used anywhere else in Llamus.
We rely on a small number of outside services to run Llamus. This is all of them, including one we have configured but do not currently use.
What it does Takes the payment for your case
What it receives Your name, email and billing details, and the amount. Your card details go straight to Stripe and never reach Llamus. Stripe does not receive your visa answers or your documents.
What it does Stores the documents you upload
What it receives The files themselves — passport pages, bank statements, employment evidence, itineraries, invitation letters — and any PDFs generated for your case.
What it does Provides the AI features described above
What it receives Only what is listed in the AI section above.
What it does Delivers our emails to you
What it receives Your name and email address, and the contents of the message.
What it does Hosts the application and its database
What it receives All of your case information, encrypted as described above.
What it does Offers "sign in with Google", if you choose it
What it receives Your name, email address and profile picture — and only if you choose to sign in this way.
What it does An alternative way of reading passports
What it receives Nothing at present. This is switched off; passport scanning goes through Claude. We list it because the connection exists in our software.
What it does Confirms your agent is registered
What it receives Your agent's own registration number, checked against the public register. None of your information is sent.
Being straight about this matters more to us than looking finished. Here is what we cannot currently claim.
We have no ISO 27001 or SOC 2 certificate. The protections above are real and tested, but no certification body has audited them.
We have not commissioned or published an independent penetration test.
Your documents are stored in the storage region our deployment is configured for, and our database is run by our hosting provider. We do not currently offer a choice of country or a contractual promise about it.
Your information is kept until someone decides to remove it. Your migration agent sets how long their practice keeps closed files, and a person always makes the decision — no automatic job deletes old cases. You can delete your own case from your dashboard, and you can ask your agent to remove your data, though they may be required to keep some records.
Agents are required to use a second step when signing in. Applicant accounts currently sign in with a password, an emailed link, or Google, without one.
Our hosting platform takes database backups on its own schedule. We do not run a separate backup of our own, and we have not carried out and documented a practice restore.
Unlike your form answers, which we encrypt ourselves before storing, uploaded files are protected by the storage service's own encryption settings.
The AI features above cannot currently be disabled one by one by a practice. We are building that, together with a written AI policy each practice accepts.
You can delete your case from your dashboard at any time, which removes its answers, documents and participants. For anything else — a copy of what we hold, a correction, or a question about any of the above — speak to your migration agent, who is the person responsible for your file, or contact us through the support section of your portal.