Security
How we protect client data, the controls we hold and the evidence we share with assessors.
A program, not a poster.
Our security program is structured around governance, risk management, technical controls, monitoring, awareness, incident response, and continuous improvement. The director is accountable as our security lead, and every policy is reviewed annually.
The controls behind the posture.
Policies
23 information security policies, reviewed annually, available to clients and assessors on request.
Identity
Multi-factor authentication on every staff account and least-privilege access. Our most recent access review was in June 2026.
Classification
Microsoft Purview sensitivity labels for OFFICIAL, OFFICIAL: Sensitive and PROTECTED information.
SPF, DKIM and DMARC enforced on our domains.
Hosting
Client sites we host run in AWS Sydney, with daily backups held in Australia. We test restores; the most recent test was on 29 September 2026.
AI
Our AI assistants call models through Amazon Bedrock in Australia. Client data is not used to train models.
Insurance
Professional indemnity $5 million, public and products liability $20 million, cyber $2 million.
Assessments
We complete client security questionnaires and due diligence. Ask us for our policy pack, data residency statement and latest restore test report.
23 policies, reviewed annually.
Our program is documented across the domains below. The full policies are commercial in confidence; we share them with clients and assessors on request.
- 01Information Security
- 02Information Risk Management
- 03Access Management
- 04Encryption
- 05Patch & Vulnerability Management
- 06Network Security
- 07Secure Configuration & SOE
- 08Audit & Logging
- 09Data Handling & Classification
- 10Asset Management
- 11Email & Web Security
- 12Physical Security
- 13Acceptable Use
- 14Awareness & Training
- 15Third-Party & Subcontractor Security
- 16Compliance & Audit
Evidence on request
Clients and assessors can request our policies, risk register summary, and access and backup records as part of due diligence.
Reporting a concern
Found a security issue with one of our sites or services? Email [email protected] and we will route it to our security lead promptly.
Running a procurement or security review?
We are happy to complete your security questionnaire and share the evidence behind this page. Tell us what you need.