Security at SILReady
SILReady holds some of the most sensitive data an Australian business can hold — NDIS participants’ daily support records. This page lists only what we can prove in the codebase and account configuration today, and it changes when the facts change.
Tenancy isolation — enforced by CI, probed live
Every organisation’s data is isolated by organisation id on every query
Every database read and write is scoped to the signed-in organisation. A static analysis guard runs in CI over the entire codebase and fails the build if any query on an org-scoped table is missing its isolation filter — a new table cannot ship until it is classified and guarded.
Row-level security enabled on every table, policies rolling out as defence-in-depth
All application tables have Postgres row-level security enabled. Database-level org policies (a second, independent enforcement layer under the application scoping, keyed to a signed org claim in the user’s token) are rolling out table-by-table, highest-sensitivity tables first.
Live multi-user probes, not just theory
Real worker, manager and second-tenant accounts probe the boundaries: worker/manager role checks, house-level scoping, and cross-tenant access all passed live verification (first full pass July 2026, re-run periodically). Three adversarial simulation campaigns preceded it.
Data integrity — invariants live in the database
Compliance-bearing values are database-enforced
Allowed values are CHECK constraints, uniqueness is a unique index, and retried writes are deduplicated by server-side idempotency keys — a double-tap or an offline retry cannot double-count a restrictive practice or a medication record.
Deterministic engines for anything the Commission sees
Regulatory outputs (incident notification clocks, the monthly restrictive-practice report dataset, timesheet exports) are computed by pure, unit-tested code. No AI touches them.
Typed AI boundary, advisory only
All AI calls go through one guarded client. AI-drafted records resolve to typed values at the boundary, carry provenance (model + timestamp + human sign-off), and are always advisory — the app never auto-submits anything to the NDIS Commission and never marks something compliant on its own.
Your rights over your data
One-click full export
The organisation owner can export every record we hold for the organisation at any time — machine-readable, no support ticket, no lock-in. If you leave, your data leaves with you.
Erasure on request
Account deletion erases application data (payment records are retained as required by Australian tax law, and participant-record retention duties under NDIS rules are flagged before anything is destroyed). Every table is classified for export and erasure, and a CI test fails if a new table escapes classification.
Data Processing Agreement
A DPA, privacy compliance plan and data-breach response plan are maintained — request copies at tessadewhirst2@gmail.com.
Where and how it runs
Australian hosting
The database (Supabase/Postgres) runs in Sydney (ap-southeast-2) and the application (Vercel) is served from the Sydney region. Data is encrypted in transit (TLS) and at rest by the platform, with point-in-time-recovery backups.
Hardened HTTP surface
Strict transport security (HSTS with preload), clickjacking protection (frame-ancestors restricted to same-origin — no third-party site can embed the app), MIME sniffing disabled, a restrictive referrer policy, and a content-security policy in staged enforcement ship on every response.
Multi-factor authentication
An organisation owner can require MFA for every member of their team — members without a verified second factor are held at an enrolment gate, fail-closed.
Secrets and access
No secrets in the repository; all credentials are environment-scoped. Service-role database access exists only server-side and is never exposed to browsers.
Continuity — the questions small vendors get asked
Your data is never hostage
Compliance data access is never used as leverage: hitting a plan limit soft-warns and gates new capacity, it never locks you out of existing records. The full export works on every plan, every day.
Independent monitoring
An external uptime monitor checks the app and its health endpoint continuously — see the public status page linked below.
Roadmap honesty
We publish what is true today. Independent penetration testing is budgeted next; ISO 27001 certification is deliberately deferred until the team is bigger than one — in the meantime our controls are documented against the ACSC Essential Eight and available on request.
Security questions, disclosure reports, or a procurement questionnaire to fill? tessadewhirst2@gmail.com — a human reads it the same day.
Live status: status page
See also: Privacy policy · Terms of service