Security and data handling
What we do to protect your data, in specifics rather than promises.
Built to recognised control practices.
We build to the control practices set out in ISO 27001 and SOC 2. The controls below are implemented in the product and the infrastructure, not written into a policy and left there. Where something is not in place yet, it is not on this page.
Australian hosted, in Sydney.
Your data is hosted in the AWS Sydney region. The application and the database both run there.
Who can reach it, and how that is controlled.
Every staff account requires two factor authentication, and an account cannot be activated without enrolling. Passwords are hashed with bcrypt and are never stored or recoverable in plain text. Two factor secrets are encrypted at rest with AES-256-GCM, and recovery codes are stored only as hashes and shown once. Access is capability based, so staff see only what their role allows, enforced on the server rather than in the browser. Sessions expire after twelve hours, and session cookies are HTTP only, secure, same site and signed. Staff sign in and client sign in are separate systems with separate secrets.
Every action leaves a receipt.
The audit trail records who acted, what they did, what they touched, from which address and when. It is enforced by the database itself: a trigger rejects any attempt to alter or delete an audit record. It is not an application convention that could be bypassed.
What the AI is never given.
The assistant runs on Amazon Bedrock in the Sydney region. Its knowledge comes from an explicit allowlist of public website content. No customer, CRM, portal or proposal content is ever indexed. Input is bounded and screened for prompt injection, and when an attack is detected the model is not called at all. Answers are grounded in cited sources. BlueArc does not use your data to train models.
Hardened in the browser and on the wire.
Strict transport security with preload, a content security policy, framing denied, MIME sniffing disabled, referrer information restricted, and camera, microphone and geolocation denied. Applied to every page.
Nothing reaches production unchecked.
Every change passes automated gates before it can ship: linting, type checking, unit tests, database integration against a real database, and a full browser test suite including accessibility and colour contrast. The main branch is protected against force pushes and deletion. Deployments are atomic and roll back automatically if the new build fails its health check.
We keep only what the job needs.
We do not store card or bank account details. We hold only what we need to do the job, and the privacy policy sets out exactly what that is. If you ask us to delete your personal data, we do it, and the deletion itself is recorded in the audit trail.
Security questions welcome.
If you have a security question, or need to report something, email automateme@bluearctech.com.au and a person will answer.