A DS-160 holds passport details, travel history and answers about health and criminal history, and your reputation depends on keeping them confidential. This page sets out what we commit to in writing, how we protect that information and how you can verify it.
Filing your own DS-160? The same safeguards cover your account.
These are obligations in our Data Processing Agreement, which is part of the Terms for every business workspace. Each one links to its section, so you can read the wording yourself.
After we become aware of a personal data breach, we tell you what happened, who is affected and what we are doing about it, and update you as we learn more.
DPA, section 5We delete a workspace's or an applicant's data within 30 days of your request.
DPA, section 8You can object on data protection grounds. If we cannot resolve it, you can leave with a pro-rata refund of unused prepaid fees.
DPA, section 6You or an independent auditor can inspect us once in any 12 months, on 30 days' written notice and at your cost, and more often after a breach.
DPA, section 9When you stop using DS160.io, we make a machine-readable export available for 30 days, then delete the data.
DPA, section 8If a copy of our database or a backup ever got out, your clients' answers could not be read from it without the encryption key.
Answers are encrypted at rest with AES-256-GCM. The key is held in a managed key store, separate from the database and its backups. All traffic to DS160.io uses HTTPS.
Answers and their edit history, messages about a form, the copy made at each filing, Application IDs, security answers, filing diagnostics and the details entered for an import from CEAC.
Your clients' answers are open to the people you add to your workspace, and each client reaches only their own form through their link.
Workspace membership is checked on every request, so removing someone takes effect at once. Repeated sign-in guesses are limited, and a session lasts 4 hours.
Every member can open and edit every form in the workspace. Roles control people, settings and billing, not which forms a member sees.
Two-factor authentication is available on every account, but it is optional and a workspace cannot yet require it. We recommend asking your team to turn it on.
How to turn on two-factor authenticationYou need to know that problems get noticed and that work can be recovered.
The database, application servers and filing browser run on our own hardware at our US headquarters, on locked premises, and only our team can reach production. Systems are logged and monitored. The database is backed up daily, with a copy kept off-site, and backups are kept for 7 days.
Connections are decrypted on our hardware: a network relay can carry the encrypted traffic, but it holds no certificate and cannot read it. Vulnerabilities are managed with timely patching, and uptime is checked from outside and published on a public status page.
The database, application servers and filing automation run on our own hardware in the United States, and no hosting provider holds this data. Visa photos are checked here too.
Answers are sent when a filing starts: they are entered on CEAC, the State Department's Consular Electronic Application Center. Importing a DS-160 sends CEAC the details that retrieve it. We do not control what CEAC holds.
Some work is done by the providers below, so not all applicant data stays on our servers. We do not sell personal data.
Searches of our docs are not stored as typed. The security-code images we keep to train our own software are not linked to any application.
The binding lists are in the Privacy Policy and in Annex III of the Data Processing Agreement. Privacy Policy · Data Processing Agreement
Write to us and we delete a form, an applicant's data or a workspace within 30 days. Deleted data leaves our backups 7 days later. Your team can delete uploaded documents itself.
We provide copies on your request, and a machine-readable export for 30 days when you leave DS160.io.
Archiving a form only hides it. A DS-160 already filed stays with the US Department of State and cannot be deleted through DS160.io. A firm's client should ask the firm, which instructs us.
Whoever started the run gets an email saying it was not submitted, and the answers stay on the form. We keep encrypted diagnostic records for 90 days to find the cause.
Our public status page shows current availability. If data has to be restored, the 24-hour recovery target above applies. We have no contractual uptime SLA.
System statusWe take reasonable steps to contain it. Under the DPA, we notify affected business customers within 48 hours of becoming aware of a personal data breach, with what we know then, and follow up as we learn more.
Found a vulnerability, or think your account has been exposed? Write to privacy@ds160.io with what you saw.
privacy@ds160.ioDS160.io is an independent service. It is not affiliated with, accredited by or endorsed by the US Department of State or any government.
Answers are, with AES-256-GCM, and all traffic uses HTTPS. A few fields that lists show and uploaded files are outside that key; uploaded files are encrypted at rest at Backblaze.
In the United States: on our own hardware, with uploaded files at Backblaze.
Yes, to named providers for stated purposes. Google's Gemini API translates free-text answers and, when someone asks, extracts passport details. We do not sell personal data.
Yes. Your team can delete uploaded documents. For everything else, write to privacy@ds160.io and we delete within 30 days.
Whoever started the run gets an email saying it was not submitted, and the answers stay on the form.
We work to contain it and, under the DPA, notify affected business customers within 48 hours of becoming aware of a personal data breach.
No. We hold no SOC 2 or ISO 27001 certification and have no independent assessment to publish. Business customers can audit us under section 9 of the DPA.
No. DS160.io is an independent service operated by Galah Enterprises Pty Ltd, an Australian company.
Yes. Write to privacy@ds160.io. The DPA commits us to answering reasonable written questions about how we process your data.
Complete your security review before you share any client information. Send us your questions, or talk them through with the founder.
This page summarizes our practices as of 2026-11-02. The Privacy Policy and the Data Processing Agreement are the binding documents.