Trust & Security | Reports Hub

What is in place

Encryption in transit

All traffic is served over HTTPS with TLS. HTTP Strict Transport Security (HSTS) is enabled with a one-year max-age, includeSubDomains, and preload — your browser is told to refuse any non-HTTPS connection to this domain.

Encryption at rest

Your data is stored in PostgreSQL (Supabase) with AES-256 encryption at rest. Backups and database volumes are encrypted by the platform.

Row Level Security

Every database table is protected by Row Level Security policies enforced by the database itself, not just the application. A query for your data can only ever return rows you own — even if application code were bypassed.

Access control

Accounts are authenticated through Supabase Auth. Access to records is scoped per user, with an explicit role model (owner, admin, technician, viewer) enforced server-side on every privileged action.

Your card data stays with Stripe

Card numbers, expiry dates and CVC codes are entered directly into Stripe and never reach our servers. We receive only a customer identifier and subscription status. This keeps cardholder data out of our infrastructure entirely.

Security headers

Responses carry X-Frame-Options (clickjacking protection), X-Content-Type-Options: nosniff, Referrer-Policy, and HSTS. Every response is verifiable with curl or your browser developer tools.

Zero-downtime deployments

Releases ship blue-green: a new build is stood up beside the running one, health-checked, and only then does traffic cut over. A failed build never reaches you — the previous version keeps serving.

Automated database backups

A full database dump runs automatically on every release and is retained for 90 days, with the three most recent copies kept. Backups are stored outside the application server.

Who we rely on

We use a small number of established providers to run the platform. Each is responsible for a specific part of the service:

Supabase

Database, authentication, file storage

Cloudflare

DNS, CDN, DDoS protection, email routing

Stripe

Payment processing and subscription billing

Brevo

Transactional and delivery email

Contabo

Application hosting

Each provider is bound by its own data processing terms and security programme. We hold a direct relationship with each and no data is sold or shared for advertising purposes.

What we do not yet have

We would rather be precise than impressive. These are the gaps a security reviewer would find today:

No SOC 2 or ISO 27001 certification

We have not completed an independent audit. We do not display audit badges because we would rather describe the controls that exist than imply a certification we do not hold.

Multi-factor authentication is not yet available

Accounts are protected by a password only. MFA is on the roadmap and is the next significant access-control change we intend to ship.

No public uptime figures

We do not publish an uptime percentage or an SLA, because we do not yet run a third-party monitoring service producing figures we could stand behind.

Reporting a vulnerability

If you believe you have found a security issue, please contact us at [email protected]. Include enough detail to reproduce the issue and please give us a reasonable window to fix it before any public disclosure. We will acknowledge your report and keep you updated on remediation.

Please do not test against data that is not yours, and do not run automated scanning that degrades service for other users.

Privacy

How we collect, use and retain personal information is set out in our Privacy Policy, which covers our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Questions

Security questionnaires, due-diligence requests or a copy of our sub-processor list: contact us at [email protected] or through our contact page and we will respond directly.