Security and Data Handling
For providers, boards and NDIS auditors · Version: 1.0 · Current as at: 29 July 2026
This document answers the questions a provider’s board, privacy officer or NDIS auditor asks before putting participant data into a new system. It is written to be accurate, not impressive. Where we do not have something, we say so.
The binding commitments are in the Data Processing Agreement. This is the plain-English version.
The short version
| Question | Answer |
|---|---|
| Where is our data stored? | Australia. AWS Sydney (ap-southeast-2) |
| Are call recordings stored in Australia? | Yes. Twilio’s Australian region (Sydney) |
| Does anything leave Australia? | Yes — SMS content, outbound email, billing data, and error diagnostics. Details below |
| Can another provider see our data? | No. Every record is scoped to your organisation and enforced at the database layer |
| Do you sell our data? | No |
| Do you train AI on our data? | No |
| Can we get our data out? | Yes, at any time, at no charge |
| Are you ISO 27001 or SOC 2 certified? | No. We are an early-stage Australian business and we do not claim certifications we do not hold |
| Who can see our participant records? | Your staff, per the permissions you set — plus our support personnel only where needed to fix a problem, logged every time |
1. Where your data lives
| What | Where |
|---|---|
| Database (participants, referrals, workers, compliance, tasks) | AWS Sydney, Australia |
| Uploaded documents and files | AWS Sydney, Australia |
| Backups | AWS Sydney, Australia |
| Voice calls and call recordings | Twilio AU1 — Sydney, Australia |
| Signed documents (e-signature) | Annature — Australia |
⚠️ What does leave Australia
We would rather tell you plainly than have you find it in an audit.
| What | Where | Can we avoid it? |
|---|---|---|
| SMS message content | Twilio infrastructure outside Australia. Twilio’s Australian region supports voice, not messaging | Yes — leave SMS disabled |
| Outbound email content | Resend, United States | Partly — you can connect your own Microsoft 365 or Google mailbox so mail goes through your own tenant instead |
| Billing details | Stripe, offshore. No participant data | No, but no participant data is involved |
| Web request metadata (IP, browser, URL) | Vercel global edge | No |
| Error diagnostics | Sentry, offshore. Payloads scrubbed before sending; optional and can be turned off | Yes — can be disabled |
| Push notifications to the mobile app | Apple/Google, offshore. Content-free — the notification contains no personal information, only a trigger to fetch data from Australia | Not applicable — nothing personal is sent |
We are accountable under APP 8 and s 16C of the Privacy Act 1988 (Cth) for how overseas recipients handle information we disclose to them.
2. Keeping providers separate
The single most important control in a multi-tenant system is that one organisation cannot see another’s data.
- Every record carries the owning provider’s identity.
- Access is enforced by row-level security in the database itself, not just in the application. Even a flaw in the user interface will not return another provider’s rows.
- Privileged operations are authorised server-side. The browser is never trusted to decide what a user may do.
- Automated tests cover permission and isolation behaviour.
Honest limitation: this has not yet been reviewed by an independent third party. That review is planned before onboarding beyond a small number of providers.
3. Access control
| Control | Status |
|---|---|
| Individual logins per person | ✅ Required |
| Role-based permissions you configure | ✅ |
| Multi-factor authentication | ✅ Available |
| Passwords stored hashed, never visible to us | ✅ |
| Scoped, time-limited links for external support workers (no login, access limited to their own tasks) | ✅ |
| Session management and revocation | ✅ |
| Audit log of significant actions | ✅ Server-side |
| Immutable attestation ledger for critical records | ✅ Available |
4. Our access to your data
Our personnel can access your data only to provide, support, secure or maintain the platform, or when you ask.
- Access is restricted to personnel who need it.
- Access is logged, and we will give you the log on request.
- All personnel are bound by written confidentiality obligations.
- Your data is never used in demonstrations, screenshots or marketing. Demos use synthetic data.
- Your data is never used to train AI models.
5. Encryption
- In transit: TLS on all connections, including to sub-processors.
- At rest: database, file storage and backups encrypted (AWS-managed keys).
6. Backups and continuity
| Database backups | Automated daily, retained 7 days |
| Point-in-time recovery | Not enabled (available as a paid upgrade) |
| Backup location | Australia |
| Rebuild-from-source procedure | ✅ Documented and tested — the entire production environment can be rebuilt from version control |
| Restore testing frequency | At least annually |
| RPO / RTO | Up to 24 hours (daily backup cadence) / Best effort, same business day |
7. Monitoring
- Application error monitoring with alerting
- Scheduled job monitoring — we are alerted if a background job stops running
- Automated sweeps that detect stuck or anomalous records
- Server-side audit logging
8. Data breach handling
- Documented Data Breach Response Plan, reviewed annually
- We will notify you within 48 hours of becoming aware of a breach affecting your data
- We will give you what you need to meet your own Notifiable Data Breach obligations
- Assessment completed within 30 days at the outside, as the Privacy Act requires — we aim for 5 days
9. Your data on exit
- Export at any time and at no charge — through the export features in the platform, or by asking us, in which case we provide a complete export (including your documents and call recordings) within 10 business days
- On termination, data available for export for 90 days
- Then deleted from active systems within 30 days, and purged from backups as they rotate
- Written confirmation of deletion on request
⚠️ NDIS retention: you must generally keep participant records for at least 7 years, and records about a child until they turn 25. Closing your account does not satisfy that. Export first.
10. What we do not have
Stated so that nobody is surprised in an audit.
| ISO 27001 certification | ❌ Not held |
| SOC 2 report | ❌ Not held |
| Independent penetration test | ❌ Not yet completed |
| Independent tenant-isolation review | ❌ Not yet completed |
| Cyber liability insurance | ❌ Not held |
| Professional indemnity insurance | ❌ Not held |
| 24/7 support | ❌ Business hours only |
| Contractual uptime SLA with service credits | ❌ Target of 99.5%, reasonable endeavours |
We are working towards these in order of what actually reduces risk for you, not what looks best on a website.
11. How this maps to your NDIS obligations
The NDIS Practice Standards require registered providers to have an information management system, proportionate to their size, that records information accurately and protects it from loss and unauthorised access, in accordance with the Australian Privacy Principles.
| Practice Standards expectation | How OpsFlow supports it |
|---|---|
| Records stored securely | Encrypted, access-controlled, Australian-hosted |
| Records cannot be altered without an audit trail | Server-side audit logging; immutable attestation ledger available |
| Backups maintained | Automated daily, tested rebuild procedure |
| Records retrievable when required | Search and filtering across all record types; complete export on request within 10 business days |
| Consent captured | Consent and notice fields configurable; e-signature integrated |
| Controlled access, transfer, retention and disposal | Role-based permissions, retention settings, documented deletion process |
⚠️ The platform supports your obligations. It does not discharge them. You remain responsible for your policies, your consent practices, your retention decisions and your audit evidence.
12. Questions
security@opsflow.net.au — we will answer a security questionnaire in writing, and we will tell you when the answer is “we don’t have that yet.”