At rest
Strong AES-256 encryption on your database and every stored document, with keys managed and rotated on a schedule.
Trust & security
Built for an audit, not just a demo.
You hold some of the most sensitive records in the country. We treat them that way — your participants' data lives in Australia, your records survive everything, and every claim of "compliant" is something you can show an auditor.
Australian data
residency
residency
Encrypted in transit
& at rest
& at rest
Tamper-proof
audit trail
audit trail
You control
who sees what
who sees what
Privacy Act
& APP aligned
& APP aligned
ISO 27001
on the roadmap
on the roadmap
Hosted in Sydney, with backups in Melbourne — both inside Australia. Built to the ACSC Essential Eight.
Data residency & hosting
Your data stays in Australia. Full stop.
Every piece of participant and worker data is hosted, processed and backed up inside Australia. No overseas support desk quietly reading records, no participant record ever crossing a border — the only overseas services we use are operational ones (email delivery, error monitoring) that never carry participant records, and every one is listed on our published subprocessor register.
- Everything runs in Sydney. Your participant records, documents and the whole platform are hosted here, on Australian soil.
- Backups stay in Melbourne. If Sydney ever fails over, recovery stays onshore too — your data never leaves Australia.
- A hard cross-border rule (Privacy Act APP 8). Care data never leaves the country — the ban is enforced in the system, not just promised in a policy.
- Australian AI, too. Where any note-assist is used, it runs in Sydney — no overseas services ever see care data.
Where your data lives
Live · Sydney
Australia
The platform, your database, documents and audit trail
Backups · Melbourne
Australia
Backups and document copies, kept ready for recovery
Both regions are inside Australia — residency is preserved even during a full failover.
Encryption
Encrypted the whole way — disk, wire, and the phone in the field.
Encryption isn't one checkbox. It's applied at every layer data rests or travels, including the offline app that carries care records into dead spots.
In transit
TLS 1.2 minimum, 1.3 preferred, HSTS with preload on both domains. No public database endpoints.
The sensitive bits
The highest-risk details — worker screening numbers, bank details, NDIS numbers — get an extra layer of encryption on top, while still being searchable.
On the device
The offline store is an encrypted database with a key held in the phone's secure Keychain / Keystore. Remote-wipe and a 7-day offline lock bound a lost phone.
Audit trail
An audit trail you can't switch off — or tamper with.
A log you can switch off is just analytics. Ours can't be edited, deleted or turned off — every entry is sealed to the one before it, so if anyone tried to alter the history, it would show. When an auditor asks "who did what, and when?", you have a clean answer.
- Even reads are recorded. Who viewed a participant's health record — the piece most systems never capture — is logged too.
- Kept beyond reach. A sealed copy is stored each night in locked storage held for 7 years, and re-checked weekly — so tampering can't go unnoticed.
- Signatures carry evidence. Every e-signature records who signed, when, and on what device; every form keeps its full version history — corrections are new versions, never quiet overwrites.
- Offline truth survives. Field events keep both the time they actually happened and the time they reached the server, so a clock-in dispute always has an answer.
What an auditor sees
Sealed & complete-
Claims exported
Naya S. · Finance · 8 Jul 2026, 2:02pm
-
Participant record viewed
Auditor · 8 Jul 2026, 2:03pm
-
Service agreement signed
Family / Nominee · 8 Jul 2026, 2:07pm
Every view, export and signature is recorded and locked to the moment it happened — so the history can't be quietly changed, and any attempt to would show.
Access & roles
You decide who sees what — down to the field.
Set exactly what each role can see and do, module by module — and "can view" is a separate permission from "can change", enforced by the system, not just hidden on the screen. Every role is editable, including a built-in Auditor (view and export only) and a Family / Nominee role.
The permission matrix — View and Edit are separate, enforced permissions.
Real view-vs-edit split
A role with View but not Edit gets a read-only record, and the save is genuinely blocked — not just a button that's greyed out.
Field & row scoping
Hide individual fields (43•••••12) and limit what each person sees by region, home or the participants they're assigned to.
Two-factor where it counts
Two-factor sign-in is required for any role that can manage settings or export sensitive data, with fingerprint or face unlock on the phone.
Regulatory alignment
Mapped to the rules you're audited against.
We build the software so the standard is unmissable — and so you can show, not just claim, alignment. Here's the regulatory surface and how the product answers it.
| Regime | What it requires | How Tendaroo answers it |
|---|---|---|
| Privacy Act 1988 · APPs 1–13 | Collection notices, use limits, security, access & correction, cross-border limits | Collection notice in intake; per-module purpose binding; onshore-only processing; participant record export (APP 12); corrections as new versions (APP 13) |
| NDIS Practice Standards | Accurate, secure, retrievable records; governance & information management | NDIS vocabulary throughout; one-export audit packs for any date range; records stay read-only if billing lapses — never deleted |
| Incident Management & Reportable Incidents Rules 2018 | 24-hour initial + 5-business-day detailed notification; records kept 7 years | Statutory timer engine: category-driven reportability, live countdowns, escalation, validated Commission reference — not configurable off |
| Notifiable Data Breaches scheme | Assess suspected eligible breaches, notify the regulator and the people affected | A documented breach plan and a written commitment to notify affected providers within 72 hours (see below) |
| Worker Screening Rules · Fair Work s535 | Verify & record clearances; employee records kept 7 years | Screening records with expiry countdowns and roster blocks; 7-year retention on worker and payroll records |
Tendaroo is your data processor; you remain the APP entity and NDIS-regulated party. We build to make your obligations easy to meet and easy to evidence.
Reliability & your data
Your records survive everything — and they're always yours.
Backups are onshore, tested, and long-lived. And there's no lock-in on the data itself: you can export it any time.
≤ 5 min
Recovery point (RPO)
Continuous point-in-time recovery, 35-day window
≤ 4 h
Recovery time (RTO)
Target for a single-region loss, restored onshore
7 years
Record retention
Care, worker and audit records held to statute — soft-delete, never hard-delete in-window
Quarterly
Restore drills
Full restore to staging with checksum verification, logged
Leaving is a feature, not a fight
Full export any time (JSON + a human-readable PDF pack). On offboarding: export delivered, a 90-day hold, then per-tenant keys are crypto-shredded. The 7-year records duty transfers to you with the export — spelled out in the DPA.
If something goes wrong
Continuous monitoring, a rehearsed incident runbook, and an incident-response retainer with an Australian firm signed before launch. We commit contractually to notifying affected providers within 72 hours of a confirmed eligible breach.
Responsible AI
AI that assists. It never decides, and it never invents care.
Where any AI assistance is used, it's suggestion-only, clearly labelled, and always waits for a person to sign off. It works only inside Australia, and it will never add a care action you didn't record. We deliberately do not let software write your care notes for you.
- Draft-only, human sign-off required
- Runs in Sydney — never sent to overseas services
- Your data never trains a model
- Must pass a safety test suite before it ships
Assurance roadmap
Secure by build today, certified tomorrow.
We're honest about where we are. The controls on this page are live from day one; formal certification is a dated commitment, not a vague "coming soon".
-
Now
Secure by build
ACSC Essential Eight (ML1) self-assessed; all controls on this page in code; MFA everywhere; policy pack written.
-
Next
ISMS formalised
Our security management system formally documented and independently reviewed, ahead of certification.
-
Planned
ISO 27001:2022
Stage 1 + Stage 2 certification with a JAS-ANZ-accredited body, scoped to the production platform.
-
Planned
NDIA digital partnership
Cyber clearance off the back of ISO certification, opening the path to lodging claims directly to the NDIA.
We also run independent security testing before launch and every year (with an accredited Australian firm), plus automated security scanning on every change we ship.
Transparency
The documents an evaluator actually asks for.
No email wall, no "contact sales". Our security posture is meant to be read before you ever talk to us.
The links just work. Give us your email only if you'd like us to keep you posted.
Evaluate it with your own eyes.
Start a free trial and see the audit trail, the residency and the role model for yourself — no credit card, no sales call. Or read the whitepaper first; it's right there.