Security & privacy
Most vendors assert their security. Below is what we actually do, including the uncomfortable parts and the bits that are not finished.
Your data is held in Australia
Application, database, files and backups all run in Sydney. The fonts on this page are served from our own servers rather than a font network, so even loading a referee's form does not send their browser to a third party.
Email. We send through Postmark, which is operated in the United States, so a name and an invitation link pass through it. There is no way to send email at a professional standard of deliverability without a specialist provider, and no Australian-hosted one we consider good enough.
Call-note drafting, and only if you switch it on. A consultant taking a reference by telephone can have their notes placed into the answer boxes as a draft they then correct and submit themselves. Those notes go to a model provider in the United States. They are not used for training, and the feature does not exist unless you enable it.
That is the complete list. We would rather you read it here than find it in a procurement questionnaire.
One agency cannot see another's candidates
That is two independent mechanisms, not one. The application scopes every query to the signed-in agency. Underneath, PostgreSQL row-level security refuses to return the row at all — so a hand-written query, a background job that forgot its context, or a mistake nobody has made yet still gets nothing. A connection with no agency attached reads nothing, rather than everything.
We removed the database half and ran the tests. Sixty-five failed — every raw-query check across all seventeen tables — while the application-layer checks carried on passing. That is what proves the two layers are genuinely independent rather than one layer wearing two hats. The build also fails if anyone adds a table that carries an agency column without a policy to match.
Consent comes before the answers
A referee is told what is collected — including that the time and IP address of their submission are recorded, and why — before anything is stored. Not in a policy they will not read: on the screen, above the button. Under the Privacy Act and the Australian Privacy Principles that is the difference between collecting and taking.
The link in the email is a key, so it is treated like one
Referee links are stored only as a one-way hash — a copy of our database yields no working links. They expire after fourteen days, they are revoked the moment a referee is removed or a request is cancelled, and an invalid, expired, revoked or already-used link all return exactly the same page, so nobody can learn anything by trying.
Names and answers are encrypted in the database
Not only the disk — the columns. Candidate and referee names, email addresses, phone numbers and free-text answers are encrypted individually, so a stolen backup is not a readable list of nurses and their former managers.
Two-factor, and it cannot be postponed
Mandatory for owners and directors, optional for consultants, and an account that owes it can reach the enrolment screen and nothing else. Passwords are hashed with Argon2id. Changing a password signs out every other device, because the usual reason to change one is thinking somebody else has it.
Everything is written down
Who raised a reference, who sent it, who read it, who downloaded a report and when. The log is append-only at the database level, so it cannot be quietly tidied — including by us. You can read it, and you can export it.
What we have not done yet
We are not ISO 27001 or SOC 2 certified. We are a new product and saying otherwise would be a lie you could check. There is no penetration test report to send you yet either. If your procurement process needs those, tell us — it is a reasonable thing to need, and we would rather know than be strung along.
Getting your data out, or deleting it
Export is a button on every plan. So is deleting your organisation, and when you do it, it goes — references, answers, files and all. Retention is yours to set; the default is seven years because that is what most Australian employers' obligations run to, not because longer suits us.