Security and Compliance

• ✓All NDIS participant data is held in Australia on an Australian-owned host (BinaryLane, Sydney), not a US provider’s Australian region. Data never crosses AU borders.
• ✓Restrictive Practices data is handled at the highest sensitivity classification. It is never used in product analytics and is never processed outside Australia.
• ✓Database row-level security enforces per-provider tenant isolation. Cross-provider queries return empty, never another provider’s data.
• ⚠Note (pre-production): production runs on an Australian-owned host (BinaryLane, Sydney) with full-disk AES-256 encryption. The live environment holds synthetic data only until the real-participant-data cutover is signed off. The development and verification environment (Railway) is clearly separated and never holds real participant data.

• ✓TLS 1.3 minimum is the committed hosting configuration. TLS is terminated on the Australian production host by an on-box reverse proxy with automatic certificate management, not a third-party edge provider.
• ✓AES-256 encryption at rest is enforced on the production host via full-disk encryption (LUKS) on the Australian-owned infrastructure.
• ✓Secrets held in environment variables only, never in source code.

So a support worker can read shift-critical information during a power or internet outage, TRAK can save a copy of the current shift’s care data on the device.

• ✓Encrypted on the device with AES-GCM (Web Crypto). The cached data is ciphertext at rest.
• ✓Unlocked by you: the encryption key is derived from your device biometric (Face ID or fingerprint) or a passphrase you set, and is never stored. Once unlocked at the start of a shift it stays available for that session, so an emergency mid-shift needs no re-entry. A generic house card (assembly point and emergency phone only, no participant health) stays readable without unlocking, so evacuation information is never locked away.
• ✓Scope-minimised: only the worker’s current shift’s assigned participants are saved, never the whole organisation.
• ✓Short retention: the copy expires at the end of the shift plus a short grace window, then auto-purges from the device.
• ✓Cleared on sign-out: signing out destroys the saved data, its encryption key, and any cached pages from the device. If the device blocks immediate deletion, the data is flagged and destroyed automatically on the next launch, before anyone can sign in again.
• ✓Read-only and fail-closed: offline shows saved information only. Any check that needs a live connection is unavailable until reconnected, never silently authorised.
• ✓AU-sovereign and first-party: the snapshot is served by TRAK’s own AU-region API, with no third-party sync service.
• ⚠Note: in production the cache only accepts a biometric or passphrase key and fails closed otherwise (a device-bound key is used only in development, on synthetic data). Real participant data is cached on a device only after the AU production cutover. An auditable supervisor break-glass for a cover worker, a privacy impact assessment, and a per-device access log are tracked as the next enhancements.

• ✓Every data change is logged: who, what, when, before and after values. INSERT-only table with UPDATE/DELETE privileges revoked at the database level.
• ✓Hash-chained integrity: each row carries a SHA-256 hash covering the prior row, enabling tamper detection. Verifiable via GET /api/audit?verify=1.
• ✓7-year retention per NDIS Commission audit requirements. Providers can query their own scoped audit log via the API.
• ✓Audit log records are tenant-scoped: your data is visible only to your organisation.

• ✓Role-based access control: owner, admin, coordinator, and worker roles. Permissions are scoped by role at the database query level, not just in application code.
• ✓MFA (two-factor authentication) is on the roadmap as a planned follow-up. It is not yet enforced.
• ✓NDIS Worker Screening clearance tracked per worker. Quarterly verification for all contractors with participant-data access, per NDIS Worker Screening Rules 2018.
• ✓Rate limiting on all public endpoints.

• ✓Platform design follows the NDIS Practice Standards 5-module mapping (Core Module plus SIL supplementary modules). Evidence generated by normal operations maps directly to Practice Standards quality indicators.
• ✓Incident recording enforces NDIS Act s.73Z deadlines: 24-hour initial notification and 5-business-day detailed report. Deadline fields are computed and immutable post-insert.
• ✓Restrictive Practices data category is classified at the highest sensitivity tier. Never used in product analytics, never processed outside Australia.
• ✓Participant and plan-manager dual-consent default for data sharing.

• ✓Notifiable Data Breach (NDB) assessment within 24 hours of detection. Affected providers notified within 24 hours.
• ✓GDPR 72-hour breach notification SLA (applies where EU-linked data subjects are involved).
• ✓Incident response follows NIST SP 800-61 Rev. 3 lifecycle: Detect, Contain, Eradicate, Recover, Post-Incident Review.

• ✓NDIS participant PII is never transmitted to AI sub-processors without explicit consent. All AI-facing prompts pass a fail-closed PII egress guard before leaving AU.
• ✓Customer data does not train any AI model. Confirmed via the Anthropic Trust Tier zero-retention commitment.
• ✓All AI-assisted decisions that may affect a participant (compliance scoring, roster gating) will carry an Automated Decision Making (ADM) disclosure and appeal path before production, per the Privacy and Other Legislation Amendment Act 2024 (ADM provisions live 10 December 2026).
• ✓AI output schema validation and input sanitisation are enforced in CI. No free-form regulatory advice is generated without a cited primary source.

Full detail, including training-data provenance, the AI sub-processor list, and the opt-out path, is on the AI governance page. For connecting your own agents, see MCP for agents.

TRAK follows responsible disclosure. If you find a security issue, please report it to:

security@ironbarktech.com.au

We aim to acknowledge all reports within 2 business days and provide an initial assessment within 5 business days. Our full security policy is at: