This page is written for the person who has to sign off on us. It states what is in place today, and it states plainly what is not. If a control matters to you and it is not here, ask, and you will get a straight answer rather than a roadmap.
The application and its database run in Sydney, Australia. Backups and stored media (documents, photographs, scans) are held in Amazon S3 in ap-southeast-2, also Sydney. Nothing is replicated outside Australia.
For New Zealand customers this means your information is held offshore in Australia, which engages information privacy principle 12 of the Privacy Act 2020 on cross border disclosure. We tell you this rather than leave you to discover it: Australia is a prescribed comparable jurisdiction under the Act, and the arrangement is disclosed in full in the documentation we provide for your assessment.
TLS in transit for every connection to the API and both dashboards. Encrypted at rest: database volumes by the host, and stored objects with AES 256 server side encryption.
Every tenant owned table carries an organisation identifier and enforces row level security in Postgres, applied to every query including our own administrative ones. Isolation is not a filter in application code that a future page can forget to apply.
Writes to core records generate audit entries by database trigger, carrying the actor, the organisation, the entity, the action, the before and after values and the timestamp. Where a member of our staff is acting inside a customer account, both identities are recorded. Nothing deletes from it.
Role based access across owner, manager, contractor and certifier roles, with contractors reaching only the work assigned to them. Passwords are hashed with bcrypt. Sessions are bearer tokens with a fixed expiry.
The database is dumped nightly, encrypted before it leaves the host, and written to versioned object storage in Sydney with a 35 day daily and 730 day monthly retention. A restore drill runs on a schedule and restores the most recent backup into a clean database. A backup that has never been restored is not a backup, so ours is exercised rather than assumed.
Submitted inspections and issued certificates are immutable. A correction is a new record that supersedes the old one, and both remain visible with their timestamps. Field captures carry the capturing device's GPS position where the device supplies it.
A vendor who answers every question with a yes is a vendor who has not read the question.
New Zealand Privacy Act 2020, including principle 12 on cross border disclosure, and the Australian Privacy Principles, including APP 8. Your compliance record is yours. Full export in open formats is available on every plan, including Free, and export is not something you have to negotiate on the way out.
We would rather answer it properly now than discover a blocker in week six.