| Item | Status |
|---|---|
| ISO/IEC 27001:2022 | Pre-readiness phase. Target Stage 1 audit in Q4 2026. |
| Australian Privacy Act 1988 (Cth) / APPs | We operate as a low-risk APP entity. Our Privacy Policy and Information Collection Statement are being prepared and will be published here before general release. |
| APES 320 & APES 325 | These are the standards our customers meet using ProActive QMS; ProActive QMS itself is the platform that hosts their compliance evidence. |
| Item | Detail |
|---|---|
| Hosting provider | Amazon Web Services — App Runner (application), RDS (database), S3 (uploaded files) |
| Region | AWS Sydney ap-southeast-2 — three availability zones, all in Australia |
| Data residency | All production customer data (database and uploaded files) is stored in Australia, region-pinned to ap-southeast-2 |
| Cross-border disclosure | Two things leave Australia. Email you send us is stored in the United States, because our mailbox provider (AWS WorkMail) has no Australian region — so please don't email us anything sensitive; use the platform instead. We also use US-hosted GitHub for our source code (no customer data) and Anthropic for the optional AI drafting features (currently switched off). This will be set out in our Privacy Policy, in line with APP 8, which is being prepared and will be published before general release. |
| Layer | Detail |
|---|---|
| In transit | Everything sent between your browser and ProActive QMS travels over an encrypted connection — Transport Layer Security (TLS) 1.2 or newer — so it cannot be read if intercepted. We also use HTTP Strict Transport Security (HSTS), which tells browsers to only ever connect to us securely, even if someone types or links to an insecure address. |
| At rest | Your stored data — the database and any files you upload — is encrypted on disk using AES-256, a widely used encryption standard, so it is unreadable to anyone who obtains the underlying storage. The keys are held in the Amazon Web Services Key Management Service (KMS) as a customer-managed key (CMK) that only we control, rotated annually. |
| Secrets management | Application secrets stored in AWS Secrets Manager with identity-based (IAM) access controls. Automated secret rotation is being implemented before general release. |
| Passwords | We never store your actual password. Each one is put through bcrypt, a deliberately slow one-way scrambling function, and only the scrambled result is kept — so even we cannot read your password, and it stays protected if our database were ever exposed. Plain-text passwords are never logged or stored. |
| Sessions | The cookie that keeps you signed in is digitally signed, so it cannot be altered or forged. It is withheld from other websites, only sent over an encrypted connection, and unreadable to scripts in the browser. Separately, every form submission carries a one-time token, which stops another site from performing actions in your name (known as cross-site request forgery, or CSRF). |
| Feature | Detail |
|---|---|
| Multi-factor authentication | Time-based one-time password (TOTP) enrolment — the six-digit codes from an app like Google Authenticator — is available on all user accounts. Enforcing the code at every login is being rolled out before general release. |
| Permission levels | ProActive QMS uses a tiered permissions framework designed around least-privilege principles, ensuring users only access what they genuinely need. Beyond the three core permission levels (Account Owner, Executive Assistant, Team Member), we include an additional System Administrator role as a safeguard. System Administrators cannot remove themselves — they can only be added or removed by another System Administrator — providing an extra layer of protection against accidental loss of critical access. As platform operators, we also maintain a Super Admin role with top-level oversight, acting as a controlled failsafe to preserve system integrity and support firms when needed. |
| Separation between firms (tenant isolation) | Each firm's records carry an account identifier (account_id), and requests are scoped to the account of the signed-in user — so one firm cannot see another firm's data. An automated check runs on every build to guard this, and we are working through a reviewed backlog of older queries to bring fully under that check before general release. |
| Audit log | Authentication events and policy/procedure state changes retained ≥ 90 days. |
Vendors that may process customer data on our behalf:
| Vendor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Application hosting (App Runner), database (RDS), file storage (S3), encryption (KMS), secrets (Secrets Manager) | Australia ap-southeast-2 |
| GitHub | Source control + CI/CD (no customer data) | USA |
| Anthropic | LLM inference for AI drafting features (user prompts + drafted content only) | USA |
| Amazon Web Services (email) | Sending our transactional email (Simple Email Service) happens in Australia. Our own mailboxes — what you reach at support@ — run on AWS WorkMail, which AWS does not offer in an Australian region, so mail you send us is stored in the United States. Anything you submit through the platform itself stays in Australia. | Sending: Australia Mailboxes: USA |
| Domain registrar & DNS | Domain control | Global |
| Item | Detail |
|---|---|
| Backups | The database is backed up automatically every day and kept for 14 days, so your firm's records can be restored if something goes wrong. Backups stay in Australia (Sydney, ap-southeast-2), the same as your live data. |
| Recovery objectives | If we had to restore from backup, our targets are to lose no more than 24 hours of data (the recovery point objective, or RPO) and to be back up within 24 hours (the recovery time objective, or RTO). The restore procedure is being formalised and rehearsed before general release — targets are not proven until that is done. |
Yes, each User of ProActive QMS remains responsible and ultimately accountable for meeting their compliance requirements.
ProActive QMS provides a centralised, auditable, and secure platform to manage compliance, allowing Users to make key customisations to suit their needs.
Each User of ProActive QMS is responsible for —
- (a) preparing, maintaining, and implementing any additional policies and procedures; and
- (b) taking all steps —
as necessary to meet their own specific compliance requirements.
Compliance requirements and obligations vary among Users. ProActive QMS does not guarantee that it contains all relevant content, guidance, alerts, or frameworks necessary for a User to meet any, or all, of their particular compliance requirements as applicable to them from time to time.
Note:
'Compliance requirements' in this context includes, as applicable to the User: Professional Body registration, regulations, APESB professional and ethical standards (such as: APES 320 Quality Management for Firms that provide Non-Assurance Services, APES 325 Risk Management for Firms), and other professional compliance requirements and obligations; as well as federal and state legislative requirements and obligations, such as the Tax Agents Service Act 2009 and the Code of Professional Conduct, the Corporations Act 2001, Anti-Money Laundering and Counter-Terrorism Financing Act 2006, and related regulations.
'User'/'Users' in this context means the customer of ProActive QMS (i.e. the Practice or Firm) as well as each User within the ProActive QMS system (e.g. executive, manager, and team members).