Security Statement

Effective date: 14 October 2026

Customers trust TrustShyft with records they may need to show a regulator, so we treat security as part of the product. This statement describes our practices at a general level.

How we protect platform data

• Platform data is currently hosted with Railway in Singapore. We plan to move hosting to Australia
• Data is encrypted in transit and at rest
• Access is based on each user’s role, and our own staff access customer data only when needed to provide support
• Decision records are append-only, so entries cannot be edited or deleted through the platform
• Every change to the platform is tracked in version control, so changes are recorded and can be rolled back
• We do not use real customer data in development or testing environments

Our service providers

We choose providers with recognised security practices and limit what each one can access. Our Privacy Policy lists the main providers and where they process data.

Incidents

If we become aware of a security incident affecting customer data, we will tell affected customers promptly, as our agreement with them sets out, and notify the OAIC and affected individuals where the Notifiable Data Breaches scheme requires it.

Information for regulated customers

Customers in APRA- or ASIC-regulated sectors can request our security questionnaire responses and further detail under a confidentiality agreement, to support their own third-party assessments.

Reporting a vulnerability

If you think you have found a security issue in this website or the platform, email privacy@trustshyft.com.au with the details. Please do not access or change data that isn’t yours, or disclose the issue publicly before we have had a chance to fix it. We will acknowledge your report within 5 business days.