Security, privacy and hosting — stated plainly.
SRP Deck holds maintenance records, contractor payment details and building data. This page sets out how that information is protected, where it lives, and what we have not finished yet.
Everything below describes what is true today. Work that is underway is marked In progress and says what is outstanding. We hold no security certification or accreditation, and we do not claim one anywhere on this page.
What we claim, and what we don't
In place means the control is implemented and running in production today. In progress means it is genuinely unfinished — the entry says what is still outstanding rather than leaving it out.
We are a small Australian team and we would rather be verifiable than impressive. We hold no independent certification or accreditation against any security standard, no external audit has been completed, and no customer is named here as having approved or endorsed our posture.
A security reviewer who wants more detail than this page carries — the subprocessor list, architecture notes, or answers to a specific questionnaire — can request it under NDA at pm@srpglobalconsultancy.com.au.
Where we stand, control by control
Authentication & access
- Role-based access for operators, contractors, residents and stakeholders, enforced server-side.
- Operator TOTP multi-factor authentication available, with per-organisation enforcement.
- Passwords are hashed.
- Login and reset are rate-limited, with anti-enumeration responses and lockout.
Tenant isolation
- Each customer is a separate tenant.
- PostgreSQL Row-Level Security, with a non-privileged runtime role that cannot bypass it.
- Automated cross-tenant tests run on every release.
Data protection
- TLS in transit, with HSTS.
- Provider disk-level encryption at rest, plus application-level AES-256-GCM on bank details (account name, BSB and account number) wherever they are stored, and on operator two-factor secrets.
- Secrets are held in provider environment stores — never in code, and never in the browser.
Hosting & data location
- Primary database hosted in Australia (AWS Sydney).
- Application compute in Singapore.
- Media storage and transactional email are currently hosted offshore, and are relocatable on request.
- Full subprocessor list available under NDA.
Secure development
- Every change is submitted as a pull request and runs an automated pipeline: tests, build, a cross-tenant isolation battery, lint, a migration guard, secret scanning and a dependency-vulnerability audit.
- Changes are reviewed by the engineering lead before they are merged.
- Automated dependency updates.
- Controlled deployment with fast rollback.
AI-assisted engineering governance
- AI tooling may assist engineering. Every change still goes through the same process as any other: a pull request, the automated pipeline above, and review by the engineering lead before merge.
- Customer production data is never supplied to AI development tools.
Monitoring & resilience
- Key actions are logged with actor, time and organisation.
- Security-event and error monitoring.
- Managed database backups, with a restore test being scheduled before recovery targets are stated.
Privacy & data retention
- Handled in line with Australian Privacy Principle security expectations.
- A proposed retention and deletion schedule is undergoing independent privacy review.
Vulnerability management
- Dependencies are scanned continuously, and the codebase is scanned for secrets on every change.
- An independent penetration test is being arranged, with an executive summary shared under NDA once complete.
Compliance roadmap
- Assembling a full vendor-assurance pack.
- Arranging independent validation.
- Certifications are pursued only if a customer requires them.
Found something? Tell us.
We invite responsible disclosure. If you believe you have found a security vulnerability in SRP Deck, please report it to us directly and give us a reasonable opportunity to fix it before disclosing it publicly. We will acknowledge your report and keep you updated on the outcome.
Security contact: pm@srpglobalconsultancy.com.au
Reviewing us as a vendor?
We are happy to work through your security questionnaire, share the subprocessor list under NDA, and answer anything this page leaves open.