Everything your security
questionnaire asks.

Hosting and data residency

Where the platform runs and where your data sits.

Shared platform hosting

The multi-tenant service runs on managed container infrastructure with a managed MongoDB database, hosted in the United States. Every workspace is logically isolated and bound to your email domain.

Dedicated Australian instance

The Sovereign option runs a dedicated instance of the whole platform in Azure Australia East (australiaeast) with its own database, its own secrets and its own domain. Nothing is shared with another customer, and no data leaves Australia.

On-premises and air-gapped

The same platform can be deployed into your own environment with Docker Compose, including fully air-gapped, where hosting, database, email and backups are entirely inside your infrastructure.

Your own Windows estate

For organisations standardised on Windows, the platform also installs onto a Windows Server 2022 virtual machine with IIS, two native Windows services and MongoDB on the machine itself — no Docker and no Linux. Your team patches, monitors and backs it up with the tools you already use.

Transport security

Everything is served over HTTPS with TLS 1.2 or 1.3, HSTS, and strict content-type, frame and referrer headers.

Data at rest

Database storage is encrypted by the platform provider. Credentials we hold on your behalf — AI provider keys, SMTP passwords, SIEM collector keys — are encrypted with a separate application key before they are stored and are never returned to the browser.

Access control

Who can see your workspace, and how that is enforced.

Roles

Owner, admin, contributor, assessor and viewer, applied per workspace. Every request is re-checked against the account's role in the database rather than trusting the browser.

Multi-factor authentication

TOTP multi-factor authentication for every account, and an admin can require it across the whole workspace.

Single sign-on and provisioning

Google single sign-on, plus SCIM 2.0 provisioning for Okta and Entra ID so leavers lose access with your directory rather than by hand.

Sign-in hardening

Failed sign-ins are throttled per device, new devices trigger an email alert, and password reset links are single-use and time-limited.

Approval for new networks

A workspace can require that any sign-in from an IP range it has not seen before is refused until an administrator approves it by email. Approving trusts that range; office ranges can be allow-listed so staff are never challenged, and every block and decision is written to the audit log.

Sign-in history

The last five sign-ins for every account are kept with the time, method, device, approximate location and IP address, visible to the account holder and to workspace administrators.

Our access to your data

Our staff cannot read your assessment data. A platform administrator sees workspace metadata and licensing only; looking at your data requires you to grant a time-limited access session, which is read-only by default and recorded in your audit log.

Domain-bound tenancy

Accounts are bound to your email domain, so a colleague joining lands in your workspace and nobody outside it can.

Audit trail and SIEM forwarding

What is recorded, and how to get it into your own monitoring.

Append-only audit trail

Sign-ins, assessment changes, exports, administrative actions and access sessions are recorded with the account, the time, the result and the source address. Entries are never edited, and the trail can be locked so that it can never be purged either.

Forwarding to your SIEM

Audit events can be pushed to your own collector as they happen: Microsoft Sentinel (Log Analytics), Splunk HTTP Event Collector, CEF over HTTPS or plain JSON. You choose which categories to send — sign-ins, administrative actions, exports, assessment changes, or everything.

Failure handling

Forwarding happens after the entry is written, so an outage at your collector never blocks anyone's work. Failures are counted and shown in the interface with the reason.

Reporting

Board snapshots, executive summaries, certification readiness, internal audit checklists and Word documentation packs are produced from the same data, so what you report is what is recorded.

Backups and continuity

Getting your data out, and getting it back.

Your own backups

A workspace can export a complete JSON backup of its data at any time, and restore from one. Nothing holds your data hostage.

Platform backups

The managed database is backed up by the platform provider. A sovereign deployment uses Azure Cosmos DB's built-in backup, or your own dump schedule where you host it yourself.

Leaving

On termination we delete or return your data as set out in the Data Processing Addendum. Export it first — the JSON backup and the document pack together are everything you have put in.

Where the framework content comes from

Whose words you are assessing against, and how they are kept current.

ASD Essentials from the official catalogue

The ASD Essentials for Enterprise IT chapter is imported from ASD's published OSCAL catalogue: the principle categories, each principle and its statement, every action, its domain assignments and ASD's Indicators of Good Practice. Nothing in that chapter is our paraphrase of ASD.

Importing a new release

When ASD publishes a revision, a platform administrator uploads the new catalogue and sees exactly what it contains before anything is used — principles, actions, domains and any record that could not be read, with the reason. Records match on the action identifier, so your answers, notes, evidence and scores are updated around, never replaced.

Essential Eight kept current

The Essential Eight mapping is refreshed from ASD's own catalogue. You are shown what ASD has added, changed or withdrawn and nothing changes until you apply it; a withdrawn control stops counting but keeps its answer.

Your own answers stay yours

A framework refresh or import never deletes an assessment response, a note, an evidence file or a score, and every import is written to the audit log with the catalogue version and the counts.

Documents

Everything we have written down, in full, including the drafts.