Book a demo See the demo
Security & hosting

Built here. Hosted here. Answered here.

Security questions deserve specifics, not adjectives. This page sets out where your data lives, who can reach it, what happens to it when you leave — and the assurance detail a reviewer asks for, so nothing here has to be walked back later.

ASD business partnerRegistered under ASD’s Cyber Security Partnership Program, 2026.
Australian data residencyHosted in Australia; records do not leave the country for hosting.
MFA and SSO enforcedEvery account, administrators included.
ITIL-aligned processIncidents, requests, problems and changes follow ITIL practice — self-assessed.
Privacy Act alignedHandled in line with the Australian Privacy Principles.
24×7 coverAustralian engineers on the desk; escalation path in the agreement.
Open exportYour records in an open format, on request, including when you leave.
Australian owned and operatedMelbourne based; support and engineering onshore.
01 · Where your data lives

Australian data centres, and we will name them.

The platform is hosted in Australia. Your tickets, assets, knowledge articles and attachments are stored there. Encryption is applied in transit and at rest, and access to the infrastructure is limited to the accounts that need it to operate the service.

  • Hosting: Australia
  • Encryption in transit and at rest
  • Backups taken as part of running the service
  • Service keys and credentials held server-side — never in a page, a link or a browser

Region

AWS Asia Pacific (Sydney)

Customer data is stored and processed in Australia, in the Sydney region (ap-southeast-2). Data residency is a setting, not a promise — it is where the service is deployed.

The underlying AWS infrastructure holds Strategic certification under the Australian Government’s Hosting Certification Framework. That certification covers the infrastructure, not this service: The Managed Desk has not itself been assessed under the Framework.

02 · Who can see it

Multi-factor authentication, enforced for everyone.

Every account — staff, administrator, ours — authenticates with multi-factor authentication. Where your organisation already has an identity provider, single sign-on connects to it. Permissions are granted by role, on a least-privilege basis, and the session that signs you in is what decides what you can see.

  • MFA enforced for every account, including administrators
  • Single sign-on with your existing directory, if you have one
  • Role-based permissions, reviewed rather than assumed
  • Administrative actions recorded, so “who changed that?” has an answer
Keeping organisations apart

The browser never decides who you are.

This is the load-bearing design decision in the whole platform, so it is worth stating plainly. Anything the browser sends — a tenant name, an organisation ID, a user ID in a link — is treated as untrusted input. It is used to look things up and nothing more.

Your session is the authority

What you may see is decided by the authenticated session on the server — not by a parameter someone could edit in a URL.

Tenants are isolated by design

Each organisation works inside its own space. Entering a work email finds the right desk; it never grants access to another organisation's records.

Actions are authorised server-side

Creating a ticket, attaching an asset or reading an article is permission-checked on the server, and repeat submissions are handled so a refresh cannot raise the same request twice.

04 · AI & your data

ELLA answers from your records — and a person can always overrule her.

When ELLA suggests a priority, a category or a reply, she is working from your knowledge base, your ticket history and your asset register at the moment of asking. Every suggestion shows what it was based on, is written into the ticket history, and can be edited or rejected by the engineer handling it.

  • Your tickets and documents are not used to train public or shared AI models
  • AI model calls are made server-side; no model credentials are exposed to the browser
  • Suggestions cite the knowledge article and asset they came from
  • A human decision always wins — nothing is sent to a customer without a person approving it

Every AI suggestion carries a receipt

  • Which articles it matched, and how closely
  • Which asset and which person the request belongs to
  • Which engineer can override it, and the record that they did

AI is used where it removes work, never where it merely impresses.

Getting it back

Your data leaves with you.

There are no lock-in contracts, and leaving is not designed to be painful. You can export what you own while you are a customer, and we delete our copies on request in line with Australian privacy expectations.

Everything, in the open

Tickets, assets, licences, knowledge articles, attachments and audit history — exported in an open format you can read without us.

Whenever you ask

Exports are available at any time during your term, not dangled at the end of a contract.

Deleted on request

On exit we remove our copies and confirm it in writing, subject to the record-keeping we are required to keep.

Where it runs

Hosted in Australia, with one boundary and one documented backup path.

Production is hosted in Australia. Tenant data is separated by scope on the server, credentials are held server-side, and the backup path is a documented job rather than an assumption.

The request path, and where your data sits

Nothing in this picture is a claim about a certification. It is the architecture, drawn so you can ask a specific question about a specific box.

PathBackup & AI context
Your peopleportal · email · chatTLS · CDN · WAFno tenant id or secretin a public URLService managementidentity · scoping · AI contextone record per requestkeys server-side onlyHosted in AustraliaTENANT A DATAencrypted at restTENANT B DATAseparate scope, same boxBackupstaken
Credentials

Where the secrets are, and where they are not.

This is the part of a security review that actually gets tested, so it is written as rules rather than intentions.

Never

  • A credential in a web page, a JavaScript file, a URL, a download or a public repository.
  • A tenant identifier or a shared secret carried in a public link.
  • A browser-supplied value trusted to decide whose records are returned.
  • Your tickets or documents used to train public or shared AI models.

Always

  • Identity decided from the signed-in session, on the server, on every request.
  • Credentials issued per integration, held server-side, revocable without disturbing anything else.
  • Sensitive changes and sign-ins recorded, so a question months later has an answer.
  • AI answers grounded in your own records at the moment of asking, with a person able to override, and the override recorded.
Every connection, labelled honestly
Operations

What happens when something goes wrong.

The most useful question in a security review is not “are you secure”, it is “what do you do on a bad day”. This is our answer, in plain language.

1

Contain

Access is the first thing addressed: sessions are ended, credentials rotated, and the affected scope is isolated from the rest. Tenant separation means the blast radius is one tenant, not every tenant.

2

Notify

You are told directly, by a named person, with what is known and what is not. Not a status-page post, and not silence while a fix is written.

3

Restore

Backups are taken, and a restore is a rehearsed job rather than a hope. Records are designed to be exportable, so a full copy of your data is always something you can hold.

4

Explain in writing

What happened, what changed, and what would prevent it. Written down, because an incident your supplier cannot describe clearly is an incident that will happen twice.

Every control above is documented and available for review. Ask for the security pack — the model, the data-flow, the subprocessors and the incident process — and it is in your inbox the same day.
Assurance and audit

Everything a security reviewer asks for, in writing.

The platform is documented to the level a procurement team needs, and the documents arrive with the demo rather than after a sales cycle. Bring your questionnaire — the answers are specific, and the isolation test is demonstrated rather than described.

In the security pack

  • The access and tenancy model, in plain English
  • Data-flow diagram and subprocessor list
  • Incident response, escalation path and contacts
  • Backup, retention and deletion behaviour
  • Hosting location and residency statement
  • Current attestation status, scope and dates are provided with the security pack — ask for the list and it is sent the same day.

What we will do instead

  • Complete your security questionnaire directly and in writing
  • Support your audit with configuration evidence rather than a badge
  • Sign a data processing agreement and a security schedule
  • Give you a named person who is accountable for the answer

Certifications, in the open

Evaluations ask which certifications you hold. This is ours, including the ones we do not hold yet — a claim a panel cannot verify is worse than an honest gap.

ASD Cyber Security Partnership
Registered

Registered as an ASD business partner in October 2026. Engagement with ASD — it is not a certification or an assessment of this platform.

Essential Eight alignment
Assessed

Server-side controls assessed at ML1 against the ACSC model in October 2026, with backups at ML2 after a verified restore. The assessment and its evidence are available on request.

G2 listing
Independently listed

Listed on G2, with a public product page and buyer reviews collected independently of us. See the listing

Australian data residency
Hosted in Australia

Records are stored and processed in Sydney. Data residency is where the service is deployed, not a setting we could quietly change.

WCAG 2.2 AA
Self-assessed

Our own testing: 96 renders per release, both themes, desktop and mobile. No independent audit — the conformance report says so. Read the report

If one of these is a mandatory gate in your procurement, tell us before you spend an evaluation window. We will say plainly whether we can meet it.

Ask the hard questions early.

Send us your security questionnaire, or bring it to a twenty-minute call. You will get answers, not a marketing page.

Talk to us
Continue exploring
IntegrationsWhat connects, and what is preview.The questionsEleven things to ask any vendor.The security packModel, data-flow, subprocessors.