Skip to main content

Legal

Security Policy

Version: 2.0 Published: 6 September 2026 Effective Date: 6 October 2026 Supersedes: Version 1.0 (18 February 2026)

RTO MATE PTY LTD (ABN 41 684 275 401) trading as Qualticks ("Qualticks", "we", "us", "our").

1. Purpose and Honesty Statement

1.1 What This Policy Is

This policy describes the security measures we actually implement to protect Customer Data on the Qualticks Platform.

1.2 Our Commitment to Accurate Disclosure

We describe only controls we genuinely operate. Where we rely on a third-party provider's certification rather than holding it ourselves, we say so and name the provider. Where we do not perform a control that larger vendors commonly perform, we say that too — see Section 9 (What We Do Not Do).

We consider an accurate security policy more valuable to you than an impressive one. If you require controls we do not currently operate, please contact us before subscribing so you can make an informed decision.

1.3 Scale of Our Operation

Qualticks is a small Australian software business. We do not operate a security operations centre, employ dedicated security personnel, or maintain 24-hour staffed monitoring. Our security model is built on strong technical controls, a deliberately small attack surface, and reliance on the certified infrastructure of established providers.

2. Data Encryption

2.1 Encryption at Rest

Sensitive fields in the Qualticks database are encrypted at the application layer before they are written to storage, using:

  • AES-256-GCM authenticated encryption

  • Envelope encryption — a unique data encryption key (DEK) is generated for each encrypted value and is itself encrypted with a master key held in the application environment

  • Authentication tags on every ciphertext, so tampering is detected on decryption

This means that sensitive values remain encrypted even to anyone with direct read access to the underlying database.

In addition, our database platform encrypts storage volumes at rest. That control is provided and managed by our infrastructure providers (Section 8).

2.2 Encryption in Transit

All connections to the Platform use TLS (HTTPS). Plain HTTP requests are redirected to HTTPS. Connections between the application and the database are also encrypted in transit.

2.3 Password Storage

Passwords are never stored in plain text. Authentication is handled by our identity provider (Supabase Auth), which stores passwords as bcrypt hashes. Qualticks staff cannot view your password.

3. Access Control and Authentication

3.1 Multi-Factor Authentication

  • MFA is available to all users using TOTP (time-based one-time passwords) compatible with standard authenticator applications.

  • MFA is enforced for accounts after a grace period from account creation. Users who have not enrolled by the end of the grace period are required to do so before continuing to use the Platform.

  • Single-use backup codes are issued at enrolment for recovery, and can be regenerated by the account holder.

3.2 Role-Based Access Control

Access to data within a workspace is governed by roles assigned per organisation. A user's roles determine which records they may view and modify.

3.3 Database-Level Access Control

Row Level Security is enabled on the application's database tables. Data access is constrained at the database layer, not only in application code, so a flaw in a single application query cannot by itself expose another organisation's records.

3.4 Rate Limiting and Brute-Force Protection

Authentication endpoints are rate limited. Current thresholds:

ActionLimitWindowBlock on breachSign in10 attempts15 minutes15 minutesSign up5 attempts60 minutes30 minutesPassword reset request3 attempts60 minutes60 minutesFile upload120 uploads60 minutes30 minutes

These thresholds may be adjusted as we tune the Platform. Rate limiting temporarily blocks further attempts; it does not permanently lock an account.

3.5 Session Management

  • Sessions are tracked and can be listed by the account holder.

  • Users can revoke individual sessions or all sessions on their account.

  • Sign-in from an unrecognised device generates a security event and, where configured, an email notification to the account holder.

  • Cross-site request forgery (CSRF) protection is applied to state-changing requests.

3.6 Administrative Access

Administrative functions are restricted to authorised Qualticks personnel. Because Qualticks is operated by a very small team, administrative access is held by a minimal number of individuals. Where a Qualticks administrator accesses a customer workspace in a support capacity, that access is logged and the account holder is notified.

4. Audit Logging

The Platform records security-relevant events, including:

  • Successful and failed sign-in attempts, and sign-out

  • MFA enrolment, verification, failure, disablement and authenticator replacement

  • Backup code use and regeneration

  • Password changes and password reset requests and completions

  • Session revocation, individually and in bulk

  • Device trust changes and sign-in from unknown devices

  • Account recovery activity

  • Administrative access to customer workspaces

Audit records are retained in accordance with the retention schedule in our Privacy Policy.

5. Backups and Recovery

5.1 What We Do

Our database platform performs automated backups of the production database. These are managed by the database provider and are used for disaster recovery.

5.2 What We Do Not Commit To

We do not offer a Recovery Point Objective (RPO) or Recovery Time Objective (RTO), and we do not guarantee that any particular backup will be available, complete, or restorable. We will use reasonable efforts to restore service and data following an incident, but we make no commitment as to timeframe or completeness.

5.3 Your Responsibility — Important

You must not rely on Qualticks as the sole repository of compliance-critical records. The Platform provides export functions. You should:

  • Export critical compliance documentation regularly

  • Retain independent offline or third-party copies of evidence you would need in a regulatory audit

  • Maintain contingency arrangements for periods of Platform unavailability

This obligation is also set out in Section 10.7 of our Terms of Service. Loss of data is a real risk with any software service, and your own backups are the only control that fully protects you against it.

6. Vulnerability and Patch Management

6.1 What We Do

  • We monitor security advisories for the frameworks, libraries and services the Platform depends on.

  • We apply security updates to dependencies and infrastructure on a best-efforts basis, prioritising issues by severity and exploitability.

  • Our infrastructure providers patch the operating systems, database engines and network layers they manage.

6.2 What We Do Not Commit To

We do not commit to fixed remediation timeframes for vulnerabilities. We prioritise by risk and available capacity.

7. Security Incident Response

7.1 Our Process

On becoming aware of a security incident affecting Customer Data, we will:

  1. Take reasonable steps to contain the incident

  2. Assess what data and which customers are affected

  3. Assess whether the incident is an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth)

  4. Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals where the Notifiable Data Breaches scheme requires it

  5. Notify affected customers by email

  6. Take reasonable steps to prevent recurrence

7.2 Notification Timing

Where the NDB scheme applies, we will comply with its statutory timeframes. Outside that scheme, we will notify affected customers without undue delay after we have assessed the incident. We do not commit to a fixed notification period, because a premature or inaccurate notification can cause more harm than a slightly later, accurate one.

7.3 Reporting a Vulnerability to Us

If you believe you have found a security vulnerability in the Platform, please email support@qualticks.com.au with the subject line "Security Vulnerability Report". Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We do not currently operate a paid bug bounty programme, but we are grateful for responsible disclosure and will acknowledge your report.

8. Infrastructure and Providers

8.1 Data Residency

Customer Data in the Qualticks production database is hosted in Australia.

Note the distinction between where data is stored and who operates the service: several of our providers are companies incorporated outside Australia even where the data itself resides in an Australian region. Personal information disclosed to those providers is treated as a cross-border disclosure and is addressed in Section 10 of our Privacy Policy.

8.2 Our Providers

ProviderPurposeEntity locationSupabaseDatabase, authentication, file storageUnited StatesDigitalOceanApplication hostingUnited StatesStripePayment processingUnited StatesResendTransactional email deliveryUnited StatesHubSpotCustomer relationship managementUnited States

We do not store full payment card numbers. Card details are collected and processed directly by Stripe.

8.3 Reliance on Provider Certifications

Our infrastructure providers hold their own independent security certifications and attestations for the services they operate. Those certifications belong to those providers. Qualticks does not hold them and does not claim them.

8.4 Changes to Providers

We may add, remove or change providers. Where a change materially affects how personal information is handled, we will update this policy and our Privacy Policy, and notify subscribers by email.

9. What We Do Not Do

We set this out plainly so you can assess the Platform accurately. Qualticks does not currently:

  • Hold ISO 27001 certification or a SOC 2 attestation

  • Engage third-party penetration testers

  • Run automated vulnerability scanning on a fixed schedule

  • Operate a Security Information and Event Management (SIEM) platform

  • Provide 24-hour staffed security monitoring

  • Perform formal periodic user access reviews on a fixed cycle

  • Employ dedicated security personnel or run a formal staff security training programme (we are a very small team)

  • Offer a contractual uptime guarantee, service credits, or a Service Level Agreement — see Section 10.6 of our Terms of Service

  • Commit to a Recovery Point Objective or Recovery Time Objective

If any of these are procurement requirements for your organisation, please raise them with us before subscribing.

10. Your Security Responsibilities

You are responsible for:

  • Keeping your account credentials confidential and not sharing logins

  • Enrolling in multi-factor authentication

  • Promptly removing access for people who leave your organisation

  • Assigning the minimum roles each user needs

  • Ensuring devices used to access the Platform are secure and up to date

  • Notifying us promptly at support@qualticks.com.au if you suspect unauthorised access to your account

  • Maintaining independent backups of compliance-critical records (Section 5.3)

11. Changes to This Policy

We may update this policy. Where a change materially reduces the protections described, we will notify subscribers by email at least 30 days before it takes effect. The current version is always published at https://www.qualticks.com.au/security-policy.

12. Contact

RTO MATE PTY LTD (ABN 41 684 275 401) trading as Qualticks PO Box 101, Craigieburn VIC 3064, Australia Email: support@qualticks.com.au

Support response times are set out in Section 6 of our Terms of Service.