Data Handling

• Customer data is encrypted at rest with AES-256 and in transit with TLS 1.3. Requests over plain HTTP are rejected.
• Production data sits in Supabase managed PostgreSQL and object storage, hosted in Australia by default, and is delivered through Vercel. Both maintain their own SOC 2 reports, which we can point you to during review.
• Evidence files and audit exports live in storage buckets with bucket-level policies, so an object is only readable through a path your organisation membership authorises.

• Isolation is enforced in the database by row-level security policies scoped to organisation membership, not by application filtering. A query that omits the org predicate returns nothing rather than another tenant's rows.
• Access within an organisation is role-based, with privileged actions restricted to owner and admin roles and TOTP multi-factor available for enforcement.
• Administrative access to production is restricted, environments are separated, and security-relevant actions are recorded in the audit log.

Audit rows are chained with an HMAC-SHA256 signature over the preceding row, the chain top is anchored daily to an external transparency log, and a database trigger rejects any update or delete against audit rows. That is what stands behind the tamper-evident and chain-of-custody claims made elsewhere on the site.

Retention periods are configurable per organisation and can be set to match the rules you are subject to, for example NDIS evidence retention or seven-year financial records. Compliance data, evidence artefacts, and audit records export as CSV, JSON, or ZIP before deletion. Deletion timing and written confirmation on completion are set in your executed agreement rather than promised generally here.