Security

How to use this page

Procurement teams and IT reviewers usually need three things: where the data lives, who can reach it, and what happens when something goes wrong. Those are the three sections below. If you need the detailed questionnaire, ask and we will send it under NDA.

Certification

We maintain an information security management system certified to ISO/IEC 27001. The certificate is independently verifiable on the JAS-ANZ register — view our certificate.

This matters more than a list of controls: it means the controls are audited by a third party on a surveillance cycle, not just described on a web page.

Hosting and data location

Encryption

• Encryption in transit for all connections to the platform and the mobile applications.
• Encryption at rest for the database, file attachments and backups.
• Key management handled within the AWS platform under our ISMS.

Access control

• Role-based access control, configured by each customer down to module and record level.
• Multi-factor authentication available for user accounts.
• Your nominated administrators control who is provisioned and removed — we act on their instructions.
• Internal access on a least-privilege basis. Production access is restricted and logged.
• Shared logins are not permitted under our Terms, because they defeat the audit trail the platform exists to produce.

Audit logging

The platform records who created, viewed or changed a record and when. This trail cannot be edited by users — it is the same evidence your own auditors and regulators rely on, so its integrity is the point.

Monitoring and testing

• Continuous security monitoring and intrusion detection across the platform and infrastructure.
• Regular independent security assessments.
• Penetration testing and vulnerability assessment carried out on an ongoing cycle.
• Security patching managed under our configuration management process.

Backups and recovery

Routine backups are performed in accordance with our certified ISMS. We use reasonable efforts to restore customer data from the most recent backup in the event of loss or corruption, and you can export your own data at any time during your subscription.

Incident response

1. 1.Detect and triage against a documented severity scale.
2. 2.Contain the incident, then preserve evidence.
3. 3.Notify the affected customer without undue delay, and in any case within 72 hours of confirming an incident involving unauthorised access to, or loss of, customer data — with the information reasonably available about the nature of the incident and the remediation underway.
4. 4.Notify regulators where required, including the Office of the Privacy Commissioner for a notifiable privacy breach.
5. 5.Remediate, then complete a post-incident review with actions tracked to close.

Your data stays yours

You own all data your organisation puts into the platform. We use it only to provide and support the service, to meet legal obligations, and — in aggregated, de-identified form that cannot identify you or any individual — to improve the product.

The platform includes AI features that assist with data-driven actions. Their output is assistive only and must be reviewed before it informs a compliance decision. We do not use customer data to train generalised AI models without your express opt-in consent, and any third-party AI provider is engaged as a sub-processor under the same obligations as the rest.

Sub-processors

We engage sub-processors, including Amazon Web Services for hosting and email delivery, Google Workspace as a backup mail service, and HubSpot for support ticketing. Each is bound by obligations no less protective of customer data than our own Terms. A current list of material sub-processors is available on request, and we give notice of material changes to it. The full picture, including regions, is on the data residency page.

Your responsibilities

Security is shared. We secure the platform; you control who inside your organisation can reach what.

• Configure roles and permissions to match actual need.
• Remove access promptly when people leave or change role.
• Keep credentials unshared, and enable multi-factor authentication.
• Decide what sensitive information belongs in the platform, and own your retention decisions.

Reporting a vulnerability

If you believe you have found a security issue, email support@teammateapp.com with enough detail to reproduce it. Please do not test against production data belonging to other customers — our Terms require prior written consent for penetration testing or vulnerability scanning of the service — and give us a reasonable window to fix an issue before disclosing it.