Security

Last updated: 1 June 2026

OZFirmIQ is architected with security and data sovereignty at its core. Our platform is designed to meet the security requirements of Australian accounting firms handling sensitive financial and tax information. All data is hosted exclusively in Australia.

AES-256

Encryption at Rest

TLS 1.2+

Encryption in Transit

99.95%

Uptime SLA

🛡️

Australian Data Sovereignty

All platform data is stored and processed exclusively in Sydney, Australia (AWS ap-southeast-2). Subject to Australian Privacy Act 1988 jurisdiction. No data leaves Australia without explicit contractual safeguards.

🔐

Row-Level Security (RLS)

Every firm sees only their own data. RLS policies are enforced at the database level on all 20+ tables, preventing cross-tenant data access even at the infrastructure layer.

📁

Encryption at Rest

All stored data encrypted with AES-256. Database encryption, file storage encryption and backup encryption — three independent layers of cryptographic protection.

🌐

Encryption in Transit

TLS 1.2+ enforced for all API communications, web traffic and database connections. HTTP Strict Transport Security (HSTS) preloaded. No unencrypted endpoints.

🕵️

Access Controls

Multi-factor authentication (MFA) available for all accounts. Role-based access with granular permissions. Session management with configurable expiry and device tracking.

🧰

Authentication

JWT-based authentication via Supabase Auth. Passwords hashed with bcrypt. Account lockout after failed attempts. OAuth-ready architecture for SSO integration (Enterprise).

Infrastructure & Hosting

Cloud Provider: Amazon Web Services (AWS) — Sydney region (ap-southeast-2).
Database: PostgreSQL with automated daily backups, point-in-time recovery and 30-day retention. Backups encrypted at rest.
File Storage: Encrypted object storage for uploaded documents (trust account statements, BAS records, financial statements).
CDN: Vercel Edge Network — global content delivery with DDoS protection and WAF (Web Application Firewall).
Uptime Monitoring: 24/7 infrastructure monitoring with automated incident response. 99.95% uptime SLA for paid subscriptions.

Compliance & Certifications

SOC 2 (Type II)

Our underlying infrastructure provider (Supabase/AWS) maintains SOC 2 Type II certification. We enforce the same security controls at the application layer.

Privacy Act 1988 (Cth)

OZFirmIQ complies with the 13 Australian Privacy Principles. Our RLS architecture inherently enforces APP 11 (security of personal information) by design.

Spam Act 2003 (Cth)

All email and SMS communications sent through the auto-chase feature comply with the Spam Act. An unsubscribe/opt-out mechanism is included in every message.

Data Retention

We retain data in accordance with ATO record-keeping requirements (7 years) and AML/CTF Act obligations (7 years). Upon request, data is securely destroyed after the mandatory retention period.

Incident Response

OZFirmIQ maintains a documented Incident Response Plan covering:

Detection and classification of security events.
Containment and eradication procedures.
Notification protocol — affected firms are notified within 72 hours of confirmed data breach, consistent with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act.
Post-incident review and remediation.

Third-Party Services

OZFirmIQ integrates with the following third-party services. Each has been assessed for security and compliance:

Supabase — PostgreSQL database & Auth (SOC 2 compliant, AWS Sydney)
Stripe — Payment processing (PCI DSS Level 1)
AWS Sydney — Cloud infrastructure (SOC 2, ISO 27001)
Vercel — CDN & hosting (SOC 2 compliant)
Xero / MYOB — Accounting platform integrations (OAuth 2.0, API-scoped permissions)

Responsible Disclosure

If you discover a security vulnerability in OZFirmIQ, please contact us immediately at security@ozfirmiq.com.au. We practice responsible disclosure and will acknowledge, investigate and remediate confirmed vulnerabilities promptly.