Rigorous underneath. Here's the proof.

The platform, its database and document storage all run in Sydney, close to the schools that use it.

Authenticator-app MFA, required for our staff and available to every school user.

Admins, bookers, finance, providers and our staff each see only what their role needs.

Approvals, overrides, payments and settings: who, when, before and after. Never edited.

Uploaded documents are scanned for viruses, and infected files are quarantined.

Documents are never public. They open only through signed links that expire after five minutes.

Records kept for defined periods, then removed. Legal holds stop early deletion.

Encrypted in transit. Secrets like referee links and accounting tokens encrypted at rest.

Sign-in, forms and public links are rate limited against guessing and abuse.