Security

Last updated 11 August 2026. This page states what is true of the platform today — it is updated as the security program matures, not ahead of it.

Where client data lives

All client data at rest — the database and uploaded documents — is stored in Sydney, Australia (AWS ap-southeast-2, via Supabase), with daily backups. Application compute runs in Vercel's Sydney region. Transactional email transits offshore infrastructure and is disclosed as such below.

Tenant isolation

Every firm's data is isolated by PostgreSQL row-level security at the database layer: policies keyed to the authenticated user are part of the schema and covered by the automated test suite, so ordinary application access is confined to that firm's own records at the database. Privileged server operations that run with elevated rights are gated by server-side authorization checks and audit-logged.

Access and authentication

• Multi-factor authentication (TOTP) for adviser accounts.
• Sign-ins, MFA verifications and failed attempts are audit-logged; sign-in attempts are rate-limited per account and per source address to bound brute-force guessing.
• Multi-factor authentication is enforced for adviser accounts — a password alone cannot reach client data.
• Idle sessions time out. Client-facing links use single-purpose 256-bit tokens, scoped to their task and rate-limited.
• All traffic over TLS with HSTS; a restrictive Content-Security-Policy blocks external script loads.

Document integrity

Once advice is issued, the record is immutable — enforced by database triggers, not application convention. The signed PDF is the advice document itself; each issued document snapshots the assumptions used to produce it.

Privacy by architecture

• Meeting recordings are transcribed on-device in the browser — audio never leaves the adviser's machine until they choose to save.
• The application is excluded from search indexing at the header level, so a leaked client link cannot be indexed even if crawled.
• Client data is portable: the data layer is standard PostgreSQL with no proprietary format.

The Privacy Act, applied

• Client records are handled consistent with the Australian Privacy Principles (Privacy Act 1988): collected for advice, used for advice, and nothing else.
• Client data is never sold and never used to train AI models — the only transcription that touches client audio runs on-device, in the browser.
• Suspected eligible data breaches are assessed and notified under the Notifiable Data Breaches scheme — to the OAIC and to affected individuals.
• Firms can export their full dataset at any time. Deletion requests are honoured subject to the record-keeping obligations that apply to financial advice.

Sub-processors

Verification

Over 1,250 automated tests run before any change ships, including golden tests that pin the modelling engine to the regulator's own published worked figures. Changes deploy through a single audited pipeline.