# Overview Source: https://docs.astalty.com.au/guide/security > How Astalty keeps your data secure, including ISO 27001 certification. ## Security Certification Astalty is ISO 27001 certified. Visit the [Astalty Trust Centre](https://trust.astalty.com.au/) for security documentation, or contact if you need it for a supplier review. ## Data Storage ### Where is my data stored? Your account information, uploaded documents and backups are stored in Australia. The [Privacy Policy](https://astalty.com.au/privacy-policy) explains how Astalty collects, uses and shares personal information. ### Which AWS region is my data hosted in? Astalty uses Amazon Web Services (AWS). For the current hosting regions and disaster recovery arrangements, request the security documentation from the [Trust Centre](https://trust.astalty.com.au/). ### Is any of my data ever stored outside of Australia? Account storage and AI processing are different. Your account's AI region determines whether built-in AI features can process requests outside Australia. See [AI Privacy](https://docs.astalty.com.au/guide/ai-privacy) for the available regions and how to request Australian processing. If you connect an integration such as DocuSign, Google or Microsoft, the information shared with it is handled under that provider's terms. Review those terms when deciding which integrations to connect. ### Where do you store credit card information? [Stripe](https://stripe.com/au) handles card payments. Astalty uses identifying details, such as the card brand and last four digits, to show which payment method you have selected. #### Is my credit card data safe with Stripe? Stripe is a PCI Level 1 service provider. Read [Stripe's security guidance](https://docs.stripe.com/security) for details of its payment security controls. ### Why do you store my bank account information? The BSB, account number and account name in your invoice settings appear on invoices so customers can pay you. Astalty sends an email notification when those bank details change. ## Data Backup ### How often do you backup my data? For backup frequency, retention and recovery arrangements, request Astalty's current security documentation through the [Trust Centre](https://trust.astalty.com.au/) or [support](mailto:support@astalty.com.au). ### Where are my backups stored? Backups are stored in Australia. The security documentation covers their locations and recovery arrangements. ### Has Astalty ever had a data loss? The [status page](https://status.astalty.com.au/) lists published service incidents. Contact support if you need incident or recovery information for a security assessment. ## Connectivity and Integrations ### How do I connect my organisation's systems to Astalty? Use the [Astalty API](https://docs.astalty.com.au/developers/api/api-overview) to connect your systems over HTTPS. See [Integrations](https://docs.astalty.com.au/guide/integrations/overview) for supported accounting, calendar and other connections. ### Do I need a VPN to use Astalty? Astalty's web app works in a browser over HTTPS. It does not require a VPN or a dedicated network connection. ### Can I access Astalty from outside Australia? You can sign in to the web app from outside Australia. Australian formats still apply to fields such as ABNs, addresses and SMS numbers. For mobile availability, see [Support Worker App Overview](https://docs.astalty.com.au/guide/scheduling/support-worker-app/support-worker-app-overview#app-availability). ## Data Access ### Who has access to my data in Astalty? Users in your organisation see information according to their roles, permissions and record access. Review [Roles and Permissions](https://docs.astalty.com.au/guide/roles-and-permissions) when inviting staff or changing their responsibilities. Astalty staff and service providers may handle information to provide the service and support your account. The [Privacy Policy](https://astalty.com.au/privacy-policy) explains these uses and when information may be shared. ## AI Privacy See [AI Privacy](https://docs.astalty.com.au/guide/ai-privacy) for processing regions, model training and the data shared with AI features. ## Audit and Logging ### Does Astalty have audit logs? Astalty records activity for many types of records. On a task, open **Activity** to see its history. Available history varies by record; contact support if you need help finding a particular change. ### Does Astalty record who downloads a document? Astalty records which user downloaded a document, alongside the existing record of who previewed it. This covers Participant and staff documents, exports, imports, document templates, the mobile app and the public API, including each file in a zipped form submission or incident report download. Contact support if you need this history for a security review. Documents shared through chat, SMS or other links that go straight to the file are not yet recorded. ## Incidents and Service Status ### Where can I see if Astalty is having an outage? Check the [Astalty status page](https://status.astalty.com.au/) for current service status and published incidents. You can subscribe there for updates. ### How are security incidents communicated? Contact for Astalty's incident response and notification arrangements. If you suspect an issue with your account, report it to the team promptly. ## Security ### What security measures do you have in place? You can use these controls to protect access to your organisation: - **Two-factor authentication:** use an authenticator app and save your single-use recovery codes. The Account Owner can [require 2FA for selected roles](https://docs.astalty.com.au/guide/settings/security/enforcing-2fa-on-your-astalty-account) and prevent users from disabling it. - **Passwords and sessions:** [change your password or sign out other sessions](https://docs.astalty.com.au/guide/users/passwords-and-sessions) from your profile. Passwords require at least eight characters, including uppercase and lowercase letters. - **User access:** [deactivate users](https://docs.astalty.com.au/guide/deactivating-and-reactivating-users) who no longer need access. - **Auditor access:** provide an [Auditor account](https://docs.astalty.com.au/guide/users/inviting-ndia-auditors-to-your-account) for access to selected Participants and records. - **Login history:** [export login attempts](https://docs.astalty.com.au/guide/exports/login-history-export) for review. - **Integrations:** use the appropriate [API key access level](https://docs.astalty.com.au/developers/api/authentication) and verify [webhook signatures](https://docs.astalty.com.au/developers/webhooks/receiving-and-verifying-webhooks). For technical security controls, certification evidence or a security questionnaire, use the [Trust Centre](https://trust.astalty.com.au/) or contact support.