Built for compliance from the ground up.

Australian Data Residency (Sydney)

All customer and practice data is stored and processed strictly within Australia:

• Application & Database: Hosted on Vultr in Sydney.
• Document Storage: Amazon S3 in Sydney (ap-southeast-2).
• AI Processing: Google Cloud Gemini models in Sydney (australia-southeast1).

Fail-Closed Binary TFN Redaction

Tax File Numbers are permanently redacted at the binary PDF level prior to storage and prior to AI processing, complying with the Privacy (Tax File Number) Rule 2015.

Fail-closed protection: If any unredacted TFN persists past the redaction pipeline, processing stops immediately. Unredacted TFNs are never stored, never logged, and never transmitted.

MFA Enforced (Cannot Be Disabled)

Multi-factor authentication via TOTP (authenticator app) is strictly mandatory for every user account across all practice roles. It cannot be disabled by users or administrators.

When an administrator resets an authenticator, the account does not revert to password-only access; re-enrolment is enforced on the immediate next login before access is restored.

Session Security & Inactivity Limits

Active session protection prevents unattended practice workstations from remaining vulnerable:

• 10-minute idle warning: Warns the user after 10 minutes of inactivity and pauses session access until re-confirmed.
• 4-hour absolute session ceiling: Hard session limit forces re-authentication after four hours, regardless of activity.

Strict Practice Tenant Isolation

Each practice's data is strictly partitioned and walled off from every other practice.

Multi-tenancy is enforced at the database level with PostgreSQL Row-Level Security (RLS) policies and reinforced with explicit practice-scoping (PracticeId) on every API endpoint and query.

Encryption & Access Controls

AES-256 encryption at rest. TLS (HTTPS) encryption in transit across all endpoints. PDFs are accessed only through time-limited signed URLs that expire automatically and log generation in the audit trail.

When automatic filing to Google Drive or Microsoft OneDrive/SharePoint is connected, transfers occur via encrypted OAuth APIs directly into practice-owned folders.

Append-Only Audit Logging

Every document fetched, email approved, client match, and agent action is recorded with cryptographic timestamps and user attribution.

Audit records are strictly append-only: they cannot be modified, edited, or deleted. Retained for 5 years and exportable to CSV to satisfy ATO OSF audit requirements.