Security
AuditPlatform handles sensitive participant and staff records on behalf of NDIS providers. This page describes our current security practices honestly — including what we do well and where the responsibilities lie with our subprocessors.
Questions? Email hello@auditplatform.app
In transit: All connections to AuditPlatform are encrypted using TLS. HTTPS is enforced on all endpoints — plain HTTP connections are automatically redirected.
At rest: Data stored in our database is encrypted at rest by Neon, our database provider. Encryption is managed at the infrastructure level and is not dependent on application-layer configuration.
Authentication is handled by Clerk, a dedicated identity provider. We do not store passwords. Clerk manages credential hashing, session tokens, device tracking, and brute-force protection.
Multi-factor authentication (MFA): Supported for all accounts via authenticator app or SMS. We encourage coordinators and administrators to enable MFA.
Role-based access:AuditPlatform enforces role separation between support staff, coordinators, and administrators. Staff can only access their own assigned shifts and submit notes — they cannot view other participants' records or organisation-wide data.
Organisation isolation:All database queries are scoped to an organisation ID. It is not possible for one organisation's users to access another organisation's data through the application.
Every change to participant records, staff records, rosters, incidents, and shift notes is written to an immutable audit log. Each entry captures:
Audit log entries cannot be modified or deleted through the application interface. This log is the primary evidence source for NDIS auditors.
SQL injection: All database queries are executed via Drizzle ORM with parameterised queries. Raw SQL execution from user input is not used.
CSRF protection: Session validation is managed by Clerk on all authenticated API routes.
Rate limiting:Authentication endpoints are rate-limited by Clerk. API routes operate within Vercel's infrastructure-level protections.
Dependencies: We keep third-party dependencies up to date and monitor for known vulnerabilities.
Optional AuditPlatform Intelligence features — shift-note drafting, note quality scoring, policy narrative polishing, compliance insights, and the in-app assistant — send the text you provide (and, for the assistant, retrieved knowledge snippets) to a language model. Voice sessions also send audio to a speech provider.
Text generation is routed through Vercel AI Gateway. The active model is one of Anthropic Claude, OpenAI GPT, or xAI Grok, configured for the platform rather than per organisation. Knowledge search uses Voyage embeddings. Voice uses Deepgram for speech-to-text and text-to-speech (Cartesia may be used for speech synthesis instead).
That data is processed under the relevant provider's API data processing agreement and is not used to train their models. Original staff observations and any Intelligence-generated draft remain stored in AuditPlatform for audit transparency.
Do not put sensitive personal information in Intelligence inputs beyond what is needed for the note, policy, or question.
We use the following third-party services to operate the platform. Each operates under its own security programme and data processing agreements.
| Provider | Purpose | Region | Security info |
|---|---|---|---|
| Neon | PostgreSQL database hosting | ap-southeast-2 (Sydney) | neon.tech/security |
| Vercel | Application hosting, CDN, Blob, and AI Gateway | Compute may be multi-region; Blob and CDN run at the edge | vercel.com/security |
| Clerk | User authentication and session management | See Clerk DPA; AU and US options. Sessions are globally distributed | clerk.com/security |
| Anthropic | AI text generation (Claude models) | Inference in transit; not stored for training | anthropic.com/security |
| OpenAI | AI text generation (GPT models) | Inference in transit; not stored for training | openai.com/security |
| xAI | AI text generation (Grok models) | Inference in transit; not stored for training | x.ai/security |
| Voyage AI | Knowledge-base embeddings for the in-app assistant | Inference in transit; not stored for training | www.voyageai.com/privacy |
| Deepgram | Speech-to-text and text-to-speech for the voice assistant | Inference in transit; not stored for training | deepgram.com/data-security |
| Stripe | Payment processing and billing — no participant PHI | Stripe's payment regions; card data is not participant records | stripe.com/security |
| Pendo | In-app guidance and product analytics | See Pendo DPA | www.pendo.io/data-privacy-security/ |
| Sentry | Application error monitoring | See Sentry DPA | sentry.io/security/ |
Organisation data is retained for the duration of your active subscription. NDIS providers are generally required to keep participant and service records for seven years under the NDIS Practice Standards — your export includes everything needed to meet this obligation independently of your AuditPlatform subscription.
On account cancellation, data is retained for 30 days to allow export. After that period, data is scheduled for deletion unless retention is required by law.
You can export your complete data at any time from the dashboard — participants, staff, rosters, shift notes, incidents, and audit logs — in CSV and PDF formats.
If you discover a security vulnerability in AuditPlatform, please report it to us privately before any public disclosure. We ask for reasonable time to investigate and remediate before the issue is made public.
Email: security@auditplatform.app
We will acknowledge receipt within two business days and keep you informed of our progress. We do not pursue legal action against researchers who act in good faith.
Participant and provider records in Postgres are stored on Neon in ap-southeast-2 (Sydney). Application compute on Vercel may run in more than one region; Blob storage and the CDN are edge-distributed. Clerk authentication offers AU and US residency options — see the Clerk DPA; sessions are globally distributed. Stripe processes payments only and does not receive participant PHI. Language-model and speech providers (Anthropic, OpenAI, xAI, Voyage, Deepgram) receive inference payloads in transit and do not store them for training under their API terms.
AuditPlatform is not ISO 27001 certified or SOC 2 attested. Both are on the procurement roadmap. We do not claim either today.
Enterprise customers can request a data processing agreement (DPA) and a security questionnaire. Email hello@auditplatform.app.
No internet-based system is completely secure. While we take reasonable steps to protect your data, you are responsible for maintaining appropriate access controls within your organisation — including offboarding departing staff promptly.