Security
Clear information about how your business data is protected.
Understand where primary records are stored, how access is controlled and what is recorded when important actions happen.
Where is my data stored and processed?
| What | Where |
|---|---|
| The SpringFire applications | Microsoft Azure, Australia |
| Your records (the database) | Microsoft Azure SQL, Australia |
| Documents, photos and files | Amazon S3, Sydney |
| In-app AI (drafting, form tools, receipt reading, Client Insights) | Amazon Bedrock on Australian infrastructure. What you submit isn't used to train AI models. Pictures generated for your website are the one exception: they are created on Bedrock in the United States from your description only. |
| Optional AI receptionist (calls and website chat) | Our voice provider in the United States. Off until your business turns it on. |
Some services we use for email, SMS, card payments, maps and usage analytics operate from the United States and receive only what they need for that task. Our Privacy Policy lists each one and the information it receives.
Who can get in, and what can they see?
- Two-step sign-in. Turn it on for your whole organisation and each sign-in needs a code emailed to the user. Trusted devices are remembered for 30 days, and an admin can clear them at any time.
- Lockout. An account locks for 15 minutes after five failed sign-in attempts.
- Sessions and links. Sessions use secure, HttpOnly cookies that expire after seven days without use. Sign-in links work once and expire.
- Access levels. Build access levels that grant each area of the system, and limit a user to their home branch.
- Separation between organisations. Each organisation's records are filtered by its organisation ID, and automated tests check this.
What is recorded?
- Audit trail. Key changes are recorded with who made them, when, from where, and the values before and after.
- Consent records. Consent is stored with the wording agreed, its version, the time, the method and any withdrawal.
- Completed forms and signatures. A completed form or note can't be edited. Signed documents carry a signing record with a fingerprint of the original and signed files.
- Audit packs. Administrators can download an audit pack for a client or a worker.
How is information protected?
- In transit. All traffic uses HTTPS, and browsers are told to use HTTPS only.
- Extra encryption for sensitive fields. Bank account numbers, NDIS participant numbers and the keys that connect your Xero, Google and other accounts are encrypted with AES-256-GCM before they are stored.
- Passwords. Stored only as one-way hashes.
What about backups and recovery?
Your records are held in Azure SQL, which keeps automated backups managed by Microsoft. If you need our current retention and recovery details for a review, ask us.
How do you work with other services?
- Signed webhooks. Messages from our payment, messaging, accounting and voice providers are checked for a valid signature before they're accepted.
- Connections you control. Xero, Stripe and Google connections are made by your admin and can be disconnected. See integrations.
Can I get my data out, or have it removed?
- Export. Export key lists to spreadsheets and documents, forms and invoices to PDF.
- Requests about personal information. Access, correction and deletion requests are handled under the Australian Privacy Principles. Email support@springfire.com.au.
- Closing your account. Handled by our support team; see our Terms and account deletion page.
Assurance and review
SpringFire doesn't currently hold SOC 2 or ISO 27001 certification. The statements on this page describe how the platform is built and run today. We're happy to walk your IT or compliance team through the controls in more detail.
Requests to access or correct personal information are handled by our team within the 30-day period the Australian Privacy Principles set.
Found a security issue?
Report it privately to support@springfire.com.au. We'll acknowledge it and keep you informed.
Walk your IT or compliance lead through it.
Bring the part of your business you would most like to simplify. In a 30-minute walkthrough we'll show how SpringFire could help and what getting started would involve.