Calm on the surface. Careful underneath.

1. Where your data lives

In shortAustralian-hosted: your register and documents are stored in Sydney, encrypted in transit and at rest.

• The iComply app runs on Vercel in its Sydney region (syd1).
• The database is Neon Postgres in Sydney. Uploaded documents are kept in private Vercel Blob storage in Sydney and are never publicly accessible.
• Everything is encrypted in transit (TLS) and at rest. Victorian WWC Connect clearance numbers are also encrypted field by field, with only the last three characters shown.
• A few supporting services process data overseas. They are listed in full below and in our privacy policy.

2. Services we use

In shortSix providers help us run iComply. Three of them process data outside Australia.

Insurance read assist never approves anything: a person always checks the result. Providers can untick “Read the details for me” when uploading, and schools can switch it off.

3. Signing in

In shortTwo-step sign-in for everyone who wants it, required for iComply staff.

• Two-step sign-in: a 6-digit code by email, or an authenticator app. Both come with single-use backup codes.
• A school’s admins can require two-step sign-in for everyone at the school.
• iComply staff, and network viewers who can see many schools’ summaries, must use an authenticator app. The email method isn’t available to them.
• Passwords and session tokens are stored only as hashes. Accounts lock after repeated failed sign-ins.
• A sign-in on a club’s or charity’s own address works only there, and only for that organisation’s people.
• Sign-up never reveals whether an email address already has an account.

4. Roles and the audit log

In shortPeople see what their role allows, and every decision is recorded with who and when.

• Admin and staff roles decide who can approve, invite, export or change settings. Admins see a clear list of who has access and can reset someone’s two-step sign-in.
• An append-only audit log records sign-ins, approvals, rejections, invitations, uploads, exports and changes. It is append-only: the database refuses edits and deletions.
• If our support team needs to act inside your account, they must give a reason, the session ends by itself within an hour, a banner shows it, and it is recorded in your activity log.
• For clubs and charities, police check certificates aren’t stored unless an admin turns that on; by default we record the date seen and the result category.

5. Organisations kept apart

In shortYour register is walled off. No other organisation can see it.

• In the app, every request is checked against your organisation. Asking for another organisation’s records gets “not found”.
• Club, charity and peak-body records are separated again in the database, with row-level security that returns nothing unless the request belongs to that organisation.
• Automated tests sign in as one organisation and try every page and action with another’s records; each attempt must be refused.
• A peak body sees its member clubs as counts only, unless a club chooses to share more, and every view is written to the club’s log.

6. Rate limits

In shortRepeated attempts are slowed or stopped.

• Accounts lock after repeated failed sign-ins.
• Sign-up emails, two-step codes, the contact form and our public APIs (the provider directory and the WWC Connect tools) have per-person or per-connection limits.

7. Uploads and malware scanning

In shortEvery upload is scanned before it’s stored.

• Uploads are limited to PDF, PNG and JPG, up to 10 MB.
• Every file is scanned for malware by Cloudmersive before it’s stored. An infected file is rejected and not kept, and our team is told. If the scanner can’t be reached, the upload is refused and the person is asked to try again.

8. Export and exit

In shortYour data is yours. Take it with you whenever you like.

• Export your register as CSV at any time, and download evidence packs as PDF.
• If you leave, we keep your data for 90 days so you can export it, then delete it, as our terms say. Records the law requires us to keep longer, such as audit logs, invoices and Victorian WWC Connect records, are kept for those periods (see our privacy policy).

9. This website

In shortNo cookies, no analytics, no trackers.

This marketing site sets no cookies and loads nothing from third parties: fonts and icons are served from our own domain, and a strict content security policy blocks anything else. The contact form sends your message straight to our app in Sydney.

10. What we haven’t done yet

In shortWe’d rather tell you than have you find out.

• iComply has not yet been independently penetration-tested. We’ll update this page when it has.
• Found a security problem? Email hello@icomplyaustralia.com.au. We reply within one business day.