We move your money. Here is how we protect it.

Data is encrypted in transit with TLS and at rest in the database and in backups. Keys are managed by the cloud provider's key service, not by us.

Application and database run in Australian cloud regions. Backups stay in Australia.

Every user has their own account with multi factor authentication. Shared logins are not supported by design.

Practice managers, owners, accountants and practitioners each see only what their role needs. A group administrator sees across sites, a practice manager does not.

The connection to your practice management system can read billing data and nothing else. It cannot write, edit or delete.

Approvals, agreement changes and payment events are recorded with user and timestamp and cannot be edited or removed.

Funds move against PayTo mandates authorised by the practitioner in their own bank. A pending or revoked mandate holds the payment.

An external test of the platform is scheduled, with the summary report made available to customers under NDA.

We do not hold ISO 27001 or SOC 2 today and will not claim otherwise. The control set is being documented against those frameworks.