Security
Your data is
our responsibility.
Australian-hosted, encrypted at rest and in transit, and fenced off per business inside the database. Below is what we do, what we do not do yet, and who can see your books.
Current security notice
Qantas scam emails sent through OneBookPlus, 9 August 2026
A fraudulent trial account used our campaign feature to send scam emails impersonating Qantas. No customer data was accessed. If you received an email from us warning you about this, it is genuine. Read the full security notice.
Security built into every layer.
From the database to the edge, every layer of OneBookPlus is designed to keep your business data safe.
Australian data residency
Your business records, files and sign-in data are stored in Australia, in AWS ap-southeast-2 (Sydney). Some specialist suppliers process a defined slice of data overseas, and every one of them is listed row by row in the OneBookPlus subprocessor table. The application itself runs on AWS ECS Fargate in the same Sydney region, and the public marketing website is served from Vercel's edge network with Australian points of presence.
Encryption everywhere
AES-256 encryption at rest for all database storage. TLS 1.3 encryption in transit for every request. Passwords hashed with bcrypt, we never store or see your plaintext password.
Secure authentication
Multi-factor sign-in with TOTP authenticator apps, brute-force lockout, and configurable session and idle timeouts.
Per-business data isolation
Records are fenced off per business inside the database itself, so isolation does not depend on the application code getting every query right. Administrative access we hold ourselves for support is separately logged, and the support-access line below says exactly what that access is.
Role-based access control
Four-tier permission model, Owner, Admin, Staff, and Viewer, enforced server-side on every request. Roles control access to sensitive operations like billing, team management, data export, and destructive actions.
Payment security, PCI DSS Level 1
All payment processing is handled by Stripe Connect, a PCI DSS Level 1 Service Provider, the highest level of payment security certification. Credit card numbers, CVVs, and sensitive payment data never touch OneBookPlus servers. Stripe handles tokenisation, fraud detection, and secure storage so your customers' payment information is always protected.
Infrastructure you can trust.
We build on industry-leading providers so you get enterprise-grade security without enterprise complexity.
AWS ECS Fargate
Application hosting
The OneBookPlus application (the dashboard you log in to) runs on AWS ECS Fargate in ap-southeast-2 (Sydney).
Vercel
Public website hosting
Serves the marketing website from a global CDN with Australian points of presence. Automatic HTTPS, DDoS protection, and edge caching.
Supabase
Database, sign-in and file storage
Managed Postgres, authentication and file storage, hosted on AWS Sydney (ap-southeast-2). Each business's records are fenced off inside the database itself.
Stripe
Payment processing
PCI DSS Level 1 compliant. All card data handled by Stripe: never touches our servers.
Resend
Transactional email
DKIM-signed, SPF-authenticated email delivery for invoices, reminders, and notifications.
Twilio
SMS delivery
SMS marketing and notifications via Twilio's secure API with Australian sender IDs.
Compliance & certifications.
The protections above are live today. Here is exactly where we stand on formal certifications, what we already meet, and what we are working toward, with no badge we have not earned.
Australian Privacy Principles (APPs)
Bound by lawWe are bound by the Privacy Act 1988 (Cth) and we operate to the 13 Australian Privacy Principles: data is hosted in Australia, collection is limited to what the product needs, access requests and corrections are handled by contacting us, and eligible breaches are notified to the OAIC. We have not been independently audited against the APPs. Our Privacy Policy sets out how each principle applies.
PCI DSS Level 1
Via StripeAll payment card data is processed by Stripe, a PCI DSS Level 1 Service Provider. Card numbers never touch OneBookPlus servers.
Essential Eight (ACSC)
ImplementingWe're working toward Maturity Level 2 against the Australian Cyber Security Centre's Essential Eight: application control, patching, MS Office macro hardening, user application hardening, restricted admin privileges, OS patching, MFA, and regular backups. A self-attestation will publish here when ML2 is verified.
ISO 27001: Information Security Management
Targeting 2027We've scoped an ISO 27001 program targeting first certification in 2027. The framework gives an externally-audited Information Security Management System (ISMS), what most AU enterprise and regulated-industry buyers (legal, healthcare, accounting practices) ask for before signing.
GDPR
AlignedWe follow GDPR principles for users in the European Economic Area, lawful basis, data subject rights, breach notification. Formal Data Processing Agreements are available on request for EU customers.
Infrastructure inheritance
Via providersAWS (Sydney), Vercel, Supabase, and Stripe are all independently SOC 2 / ISO 27001 attested. Their controls are part of our shared-responsibility security posture.
Ongoing security practices.
Security isn't a one-time checkbox, it's how we build and operate every day.
Dependency review
Runtime dependencies are reviewed and updated as part of each release. We do not yet run automated CVE scanning on every commit, and we will say so here the day we do.
Regular security updates
Runtime dependencies, database extensions, and infrastructure components are kept up to date on a continuous release cycle.
Least privilege access
Internal access to production systems follows the principle of least privilege. Database credentials are rotated regularly.
Support access, stated plainly
One person runs OneBookPlus, and to answer a support question that person can open your business from the admin side. Every switch into a business writes an audit record naming who did it, which business, and when, and those records are collected into a security digest. We do not go looking through your books outside a support request or a legal obligation, and if we ever have to, we will tell you.
Audit logging
Security-sensitive operations, logins, permission changes, data exports, and billing actions, are logged with timestamps and actor IDs.
Secure development lifecycle
Type-safe database queries, server-side validation on every endpoint, and nine build-time guards that fail the deploy on schema drift, timezone-unsafe date handling, unguarded write actions, and reads that silently discard an error and return a confident wrong number.
Incident response
Documented response plan with clear severity levels and notification timeframes, users within 24 hours, the ATO Digital Partnership Office the same business day, and the OAIC within 72 hours for eligible data breaches. Read the plan.
Security & compliance FAQ
Common questions about data residency, encryption, and the compliance frameworks OneBookPlus follows.
- Where is my OneBookPlus data hosted?
- Your business records, files and sign-in data are stored in Australia, in AWS ap-southeast-2 (Sydney). Some specialist suppliers process a defined slice of data overseas, and every one of them is listed row by row in the OneBookPlus subprocessor table. The application runs on AWS ECS Fargate in the same Sydney region, and the public marketing website is served from Vercel's edge network with Australian points of presence.
- How is OneBookPlus data encrypted?
- OneBookPlus encrypts all database storage with AES-256 at rest and every request with TLS 1.3 in transit. Passwords are hashed with bcrypt, so OneBookPlus never stores or sees your plaintext password.
- Is OneBookPlus GDPR and Australian Privacy Act compliant?
- OneBookPlus is bound by the Privacy Act 1988 (Cth) and operates to the 13 Australian Privacy Principles: data is hosted in Australia, collection is limited to what the product needs, access and correction requests are handled by contacting us, and eligible breaches are notified to the OAIC. We have not been independently audited against the APPs. For users in the European Economic Area we follow GDPR principles, lawful basis, data subject rights, and breach notification, and Data Processing Agreements are available on request for EU customers.
- Is OneBookPlus PCI DSS compliant for payments?
- Yes. All payment card data is processed by Stripe, a PCI DSS Level 1 Service Provider. Card numbers, CVVs, and sensitive payment data never touch OneBookPlus servers.
- How does OneBookPlus keep one business's data separate from another's?
- OneBookPlus fences each business's records off inside the database itself, as well as in the application and middleware layers, so a mistake in the application code is not on its own enough to expose another business's data.
For the full vendor list and where each subprocessor stores data, see the OneBookPlus trust and subprocessor page, or report an issue via the vulnerability disclosure policy, which is the single place we publish acknowledgement and resolution targets for security reports. Support response targets by severity live in the OneBookPlus service level agreement.
Ask us about
security
We're happy to discuss our security practices in more detail. We reply to security questions within one business day.
Reviewed by Bishal Shrestha