Is your building's data safe with us? Yes, and here's exactly why.

PSA s.86 enforcement at the database level. A disbursement is rejected unless the approving user matches the building's designated Licensee. Three audit logs record every attempt, approval and completion.

Service accounts cannot bypass the approval gate: write operations are tied to the authenticated identity of the approving user and cannot be forged or delegated at any layer.

All financial records are stored in an immutable append-only ledger: modifications and deletions are rejected at the database level. Correcting an error follows the same convention as production accounting: a reversing entry, not a deletion.

Arithmetic is Decimal.js with ROUND_HALF_EVEN (banker's rounding) at 20-digit precision. No floating-point drift across thousands of levy amounts.

Supabase region pinned to ap-southeast-2; AWS KMS at-rest encryption; TLS 1.2+ in transit. Australian Privacy Act APP 8 (cross-border disclosure) is addressed by Sydney hosting for stored data and by data processing agreements with each overseas subprocessor named in the privacy policy.

The application layer (Vercel) is stateless: it processes requests but does not store data. Transactional emails are delivered via Resend; metadata for those crosses borders (US storage); the email body is encrypted in transit. AI features (CoMo, minutes drafting, document extraction) are processed by Anthropic, and knowledge-base search embeddings by OpenAI; both process requests in the United States under data processing agreements, and the results are stored in Sydney.

Data is strictly isolated between buildings at the database level: no user can access another building's records, and no application-layer bug can override this. Access is derived from the caller's authenticated session, not from any header or parameter the client controls.

Within a building, access follows least-privilege: SM (full portfolio), Committee Member (governance + minutes), Lot Owner (own lot + AGM docs), Building Manager (observer + ticket submission), Auditor (read-only financials).

AES-256-GCM encryption with a unique 256-bit session key per ballot and a random IV per vote. HMAC-SHA256 receipt over choice + voter + ticket + time + building.

The receipt token can be verified at /votes/verify to verify; the platform recomputes the HMAC and confirms the vote was recorded exactly as cast. A mismatch is logged as a tamper attempt.

Daily database backups with 7-day retention. Point-in-Time Recovery enabled for sub-hour granularity. Our recovery targets: under 1 hour of data loss, under 2 hours to full restore.

The application layer is stateless: if Vercel had an outage, a redeploy from git restores the app in 2–3 minutes. All your data lives in Supabase, separate from the app. Real-time error monitoring via Sentry.

Australian Privacy Act (APPs 1–13): privacy policy at /legal/privacy. Cross-border disclosure (APP 8) addressed by Sydney hosting.

NSW SSMA & SSMR: meeting notice periods, quorum, by-law management, AGM procedures (s.18A, s.146, s.174/s.184) and record-keeping built to spec. VIC and QLD equivalents covered.

NSW Property Stock and Business Agents Act: trust accounting meets the PSA: immutable ledger, double-entry, LIC approval (s.86), bank reconciliation, ABA payment files, 7-year retention. Trust audit packs exportable in-app.

WCAG 2.1 AA: colour contrast, keyboard navigation, skip-to-content, ARIA roles, focus-visible rings, screen reader compatibility.