Overview

Security Certification

Astalty is ISO27001 certified. To find out more about this you can visit our trust page via this link https://trust.astalty.com.au/.

Data Storage

Where is my data stored?

Your data is stored within Australia with our ISO27001 certified infrastructure provider, Amazon Web Services.

You can view a copy of their certification here.

Which AWS region is my data hosted in?

Our compute and database infrastructure is hosted in the AWS Sydney region (ap-southeast-2), with failover available in the Melbourne region (ap-southeast-4).

Is any of my data ever stored outside of Australia?

No.

All data stored within your Astalty account — including your data, your Participants’ personal and health information, and any documents you upload — is stored in Australia. Astalty has strict procedures in place to ensure it never leaves Australian borders.

If you choose to opt in to a third party integration (such as DocuSign, Google or Microsoft), any data shared with that integration is handled by that provider under their own terms, and may be stored outside Australia.

Where do you store credit card information?

We don’t.

When you enter your credit card information into Astalty, we use a third party payments provider to handle this — Stripe.

The only details we store about your credit card are;

• the type of card (Visa, Mastercard etc)
• the last 4 digits (so you can easily identify the card when listed in Astalty)

Is my credit card data safe with Stripe?

There are strict guidelines and practices that must be followed when storing credit card information. Stripe are a PCI Service Provider Level 1. This is the most stringent level of certification available in the payments industry.

Why do you store my bank account information?

We store your bank account information in Astalty in the form of;

• your BSB number
• your account number
• your account name

This data is shown on invoices that are generated by Astalty so that you can get paid.

Data Backup

How often do you backup my data?

Astalty has implemented continuous backup and point-in-time recovery (PITR) of our database. This means we can restore our database to any point in time should a data loss occur.

Where are my backups stored?

Your backups are stored in both the Sydney and Melbourne AWS regions, so a copy of your data is always kept in a geographically separate location from our primary infrastructure.

Has Astalty ever had a data loss?

No.

Connectivity and Integrations

How do I connect my organisation's systems to Astalty?

You can connect to Astalty via our API — a JSON-based REST API accessed securely over HTTPS. No VPN or dedicated network connection is required.

Data Access

Who has access to my data in Astalty?

We have strict policies in place surrounding data access. Your data is only accessible by;

• you
• any Users added to your account

From time to time, Astalty may access your account and your data for the purposes of providing support or improving the quality of Astalty.

We do not share any of the data stored within your Astalty account with any external party unless otherwise stated or required by law.

Data may be shared with third party integrations such as DocuSign, Google, Microsoft and other integration partners. This only occurs if you opt in and use those integrations.

AI Privacy

Astalty is actively building AI functionality into the platform. For how those features handle your data — including where it is processed and where it is stored — see AI Privacy.

Audit and Logging

Does Astalty have audit logs?

Yes.

Astalty has audit logs for almost all of your data in Astalty. For Tasks, these can be accessed in the Activity tab — other logs are available upon request.

Incidents and Service Status

Where can I see if Astalty is having an outage?

Astalty publishes live service status and a full history of past incidents on our status page — https://status.astalty.com.au/.

You can subscribe on that page to be notified whenever an incident is raised, updated or resolved.

How are security incidents communicated?

As part of our ISO27001 certification, Astalty maintains a formal incident response process. Security incidents affecting your data are communicated directly to affected account owners, and relevant regulators are notified where required by law.

You can find more about our security program on our trust page — https://trust.astalty.com.au/.

Security

What security measures do you have in place?

Account security

• Two-factor authentication (2FA) via an authenticator app, with single-use recovery codes
• Organisation-wide 2FA enforcement — Admins can require 2FA for selected roles, and Users without it are blocked from the app until they enrol
• Admins can prevent Users from disabling their own 2FA
• Minimum password requirements — at least 8 characters, including both uppercase and lowercase
• Passwords are hashed and are never stored or visible in plain text
• Changing your password requires confirming your current password
• Automatic account lockout after repeated failed login attempts, with an email alert to the account owner
• Rate limiting on login and 2FA endpoints
• Email notifications for security events, including password changes and 2FA being disabled

See Two-Factor Authentication for how 2FA works in Astalty and where to set it up or enforce it.

Sessions and access

• 2-hour inactivity limit (Users will be logged out after 2 hours of inactivity)
• View your active sessions, including device, IP address and last activity
• Log out all other devices, protected by password confirmation
• Deactivating or restricting a User immediately ends their sessions and revokes their API tokens
• Role-based permissions with fine-grained control over what each role can see and do
• Auditor accounts are read-only, can only access the Participants and records explicitly assigned to them, and automatically deactivate on expiry

Monitoring and audit

• Login attempt logging (successful and failed), with login history exportable by permitted Users
• Audit logs capture who made the change, what changed (before and after values), IP address, device and time

Data and infrastructure

• Data encryption in transit and at rest using industry-standard AES-256 encryption
• HTTP Strict Transport Security (HSTS) enforced across all Astalty services
• Documents are stored in private storage and are only ever served through short-lived, expiring links
• Uploaded files are validated server-side against their actual file contents, not just the file name
• Outgoing webhooks are cryptographically signed so you can verify they came from Astalty
• API tokens are scoped to read-only or read-write access
• Automated dependency vulnerability monitoring and static analysis in our development pipeline