What IooI does to protect records, and what we have not done yet.

Every provider’s rows carry its organisation’s ID, and the database itself refuses to return or change a row belonging to another organisation (PostgreSQL row-level security). If a developer forgets a filter, the database still blocks it. Each backend service connects with its own database role, which has no way around these rules.

We test this on every change. Automated tests run against a real PostgreSQL database, using each service’s own role, and a deployment cannot go ahead unless they pass.

Sign-in runs on Amazon Cognito in Sydney. IooI’s own systems never hold a password.

• Staff use a password of at least 12 characters plus an authenticator app, or a passkey.
• A new account gets a short period to set up its second factor. After that, the person cannot continue until they do.
• Recovery codes cover a lost phone. Using one makes the person set up their second factor again.
• Admins can see and end a person’s sessions, and approve or revoke their devices.
• Family members and nominees sign in separately, with a code sent by email, and can only read a client’s published schedule.

Each organisation has its own roles. The defaults are Admin, Coordinator, Support worker and Finance, and you can add your own. Access is granted app by app, so a role in one app opens nothing in another. Permissions are checked on the server for every request.

When someone leaves and you end their employment in IooI, they lose their access to your organisation, including its files, and they come off upcoming shifts.

The audit log records who did what and when, including sign-ins, invitations, password and second-factor resets, device approvals, the end of a person’s employment, changes to apps and plans, and data exports.

Your organisation chooses one of three settings for IooI support:

Approval required

The default. Each session waits for one of your admins to approve it.

Notify only

A read-only session starts straight away and your admins get an email.

Off

IooI staff cannot open a support session.

Every session has a stated reason and lasts at most 60 minutes. It is read-only unless your admin approved that exact request for writing. Files open only if the request asked for documents and your admin approved it. You can see each session, its reason and every request it made, and end it at any time.

A support session cannot grant access to anyone, change your support settings, export your whole organisation or touch billing.

• Traffic to the apps uses HTTPS.
• The database’s storage is encrypted, and files are encrypted with AWS KMS keys.
• Uploaded files are scanned for malware by Amazon GuardDuty.
• Files sit behind links that are signed and short-lived, usually a few minutes.

Customer records and files

AWS Sydney

Backups

AWS Sydney, with copies in AWS Melbourne

Sign-in and email

Amazon Cognito and Amazon SES, in Sydney

Logs and error reports

AWS Sydney. We do not use an overseas error-tracking service.

Two parts of our infrastructure are recorded exceptions:

• Web firewall logs. They cover blocked or flagged requests only, with no cookies, tokens or query strings. They go to a bucket in Sydney. If AWS will not deliver them there, they stay in the United States (us-east-1) for 30 days.
• Address lookups. We turn addresses into map positions with Amazon Location in Sydney. Amazon may pass the query, with account details removed, to map data providers outside the region.

Some outside services also receive limited information: Stripe for billing, Google and Apple for phone notifications, and Xero if you connect it. They are listed in our privacy policy.

1. Export at any time. An admin can export the whole organisation as one zip file: data, readable CSV files and documents. It works even when your apps are read-only. The download stays available for 30 days.
2. Your subscription ends. Your apps become read-only for 90 days, so you can still view and export.
3. Deletion is scheduled. Thirty days after that. Your admins get an email when it is scheduled and again 7 days before. Reactivating your subscription cancels it.
4. We delete. Your data and files, along with accounts that belong to no other organisation. You get a deletion certificate that holds counts, not personal information.
5. Backups run out. Backups hold deleted data until they expire: 35 days for daily backups, 12 months for monthly ones. If we ever restore a backup, we repeat the deletion before the service reopens.

You remain responsible for keeping your own records. For NDIS and aged care that is generally 7 years, so take your export before you go, and check what applies to you.

• We do not hold ISO 27001 or SOC 2 certification. ISO 27001 is a goal.
• We have not had an independent penetration test. We plan one before our first customer goes live, and every year after that.
• Our service terms, privacy policy and data processing agreement are still waiting on legal review.

Email solutions@iooi.com.au. Our contact details are also in security.txt.