Where your data lives, and how it is kept safe.
Straight answers for your IT, privacy and procurement teams: where MiSAFE QHSE keeps your records, how they are protected, who can see them and how MiSAFE AI is used. Every commitment on this page is written into your agreement with us.
Our commitments to you
Your data stays in Australia.
MiSAFE QHSE runs in Australian data centres. Your records, files and backups are kept in Australia and are not moved offshore.
Australian hosting
Your account, everything uploaded to it and its backups are hosted in Australia, and that is written into your agreement.
Backups and recovery
Your account is backed up at least daily, and our recovery plan is tested every year, so a bad day is measured in hours, not weeks.
Your records, your choice
Export your records at any time in standard formats such as CSV, so you are never locked in. Records are archived rather than deleted.
Protected at every step.
The same protections apply to every account, from a single campus to a group of schools.
Encrypted
Your data is encrypted in transit (TLS) and at rest (AES-256).
Sign-in
Each person signs in with their own email address and two-step verification, or through single sign-on with Microsoft Entra ID, so your own sign-in rules apply.
Your account, kept separate
Each organisation’s data, users and settings are isolated from every other account.
Access set for each person
Permissions come from role templates and are set for each person. Every change to access is recorded, and access is reviewed each term.
A full audit trail
Every record, edit and approval is logged with who did it and when, and the log can be exported for your auditors.
Support only with your approval
MiSAFE support staff can enter your account only when you approve it, and every visit is logged.
AI that stays inside your account.
MiSAFE AI carries the administrative load. It does not run the system, and it is held to rules it cannot change.
- Never trained on your data. Your records are never used to train AI models, and the AI service keeps nothing after it answers.
- A person approves everything. Every draft MiSAFE AI prepares needs a person with the right role to approve it before it counts.
- Contained within your account. It works only on your account’s records, and nothing is shared outside your account without authorised approval.
- Optional. Your administrators decide where MiSAFE AI is used in your account.
Your records belong to you.
We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The records in your account belong to your organisation.
If something goes wrong
If a data breach affects your information, we tell you within 24 hours and work with you on what the Notifiable Data Breaches scheme requires.
In your agreement
A data processing agreement and the list of services we use to run MiSAFE QHSE come with your proposal.
Questionnaires answered
We complete vendor security and privacy questionnaires, and will walk your IT team through how the platform is built and run.
Aligned with recognised standards.
Aligned means our controls are built to these standards. We have not been independently certified yet, and we will say so here when we are.
SOC 2
Security controls aligned with the SOC 2 trust services criteria.
ACSC Essential Eight
Aligned with the Australian Cyber Security Centre Essential Eight mitigation strategies.
ISO/IEC 27001
Information security managed in line with ISO/IEC 27001.
Questions from your IT or procurement team?
Send them through and we will answer them in writing, or walk your team through the platform on a call.