LAYER 01INFRASTRUCTURE
Infrastructure
Hosted in AWS Sydney (ap-southeast-2) on Amazon Linux 2023 with Alpine-based Docker containers. Weekly OS patching is applied to the underlying platform.
AWSEC2Dockerap-southeast-2
Security · Data Handling · Assurance
Security & data-handling dossier
How the CERTE governance platform protects customer data: our security architecture, encryption and data-handling practices, compliance approach, and the controls behind the product. Prepared for procurement, risk, and audit teams.
CERTE is a governance, risk, and continuity platform hosted entirely within Australia. We hold platform data to a least-privilege, encrypted-by-default standard. Detailed assessment findings and our remediation roadmap are available to verified stakeholders.
Security Architecture
Defence in depth — how CERTE is built
CERTE applies layered controls across infrastructure, data, identity, and application. The description below reflects the platform as actually deployed.
LAYER 02ENCRYPTED
Data Protection
AES-256-GCM at rest via AWS KMS across database storage, backups, and S3 report files. TLS in transit with TLS 1.0/1.1 disabled at the load balancer.
AES-256-GCMAWS KMSTLS 1.2+S3
LAYER 03ENFORCED
Identity & Access
Administrative and staff access uses IAM least-privilege with enforced MFA (passkey/TOTP/FIDO; SMS disabled). Database access is brokered through a bastion/proxy rather than exposed directly.
IAMMFABastion brokerRBAC
LAYER 04SECURE SDLC
Application
NestJS + Apollo GraphQL backend and a Next.js frontend. Passwords are hashed with bcrypt, ORM queries are parameterised, and dependencies are scanned with Snyk during development.
NestJSNext.jsbcryptSnyk
LAYER 05MONITORED
Logging & Privacy
Activity is logged to AWS CloudWatch with sensitive fields redacted. Critical user actions are recorded against unique IDs to maintain an auditable timeline.
CloudWatchField redactionAudit trail
LAYER 06RESILIENT
Backup & Retention
Encrypted daily database backups are retained in AWS. Generated report files (PDFs) are automatically purged after 7 days to limit data exposure.
Encrypted backupsKMS7-day report TTL
Identity & Access
Built for enterprise identity
Certe protects access with phishing-resistant multi-factor authentication on privileged accounts, role-based access control over every document, and encrypted credential storage.
Available today
- Phishing-resistant MFA on privileged accessAdmin and infrastructure access enforces passkey / TOTP MFA via IAM. SMS and email codes are disabled.
- Role-based access controlIn-platform roles — owner, collaborator, viewer — scope access to every document.
- Encrypted credential storagePasswords are hashed with bcrypt; no credentials are stored in plaintext.
Data Handling & Residency
What we hold, and where it lives
CERTE is a self-reporting governance and risk tool. We design to minimise the personal information held and to keep customer data within Australia.
Primary dataBusiness-confidential governance & risk content
Personal informationMinimal — stakeholder names & email addresses
Not collected by designNo health records · no payment-card data stored on platform
ResidencyAWS Sydney — no overseas transfer without consent
At restAES-256-GCM (AWS KMS)
Report retentionGenerated PDFs purged after 7 days
Free-text fields may contain organisationally sensitive material; access is restricted to invited document owners, collaborators, and viewers.
Data resides in Australia — AWS SydneyCompliance & Assurance Approach
Standards, frameworks & status
The frameworks below reflect CERTE’s control posture as it stands today — what is enforced, aligned, and independently reviewed. We reference recognised standards and describe our practices accurately, without overstating certification.
Australian Privacy Act 1988 (APPs)
Data handling aligned to the 13 Australian Privacy Principles, including the Notifiable Data Breach scheme. The platform is designed to minimise personal information.
Data Residency — Australia
All platform data is hosted in the AWS Sydney region. Personal information is not transferred overseas without explicit consent.
Independent Security Review
An external review of the platform was completed in 2025. Findings are tracked on a remediation roadmap; the detailed register is available to verified stakeholders.
OWASP ASVS / Top 10
Application security controls are reviewed against the OWASP Application Security Verification Standard and Top 10 risk categories.
ASD Essential Eight
The ASD Essential Eight mitigation strategies are used as a hardening reference for patching, application control, and access management.
NIST CSF 2.0
Controls are mapped against the NIST Cybersecurity Framework core functions to structure our security programme.
Independent & Internal Assessment
Security assessment register
A transparent, evidence-based record of findings and remediation. The summary and lower-severity findings are published openly; the remediation roadmap and high/critical findings are released to verified stakeholders under NDA.
Loading assessment…
Technical Documentation
Reference material for your teams
Reference material for engineering, procurement, and risk teams. Items marked “on request” are shared with verified stakeholders under NDA where appropriate.
Platform Technical Information · White paperPublicAuthentication & Access Model · v2.4PublicData Handling & Residency Statement · v1.2PublicEncryption Standard (at rest / in transit) · v1.1PublicBackup & Retention Policy · v1.0On requestVulnerability Disclosure Policy · v1.0PublicSub-Processor Register · 2026On requestIncident Response Approach · v1.0On request