Security you can trust

Our Security Management Program takes each of our customers' security requirements into consideration and arrives at a set of requirements and initiatives unique to us and our environment.

We don't look at security as a destination to reach — it's an ongoing journey. We continually strive to improve our software development and internal operational processes with the aim of increasing the security of our software and services. The secure way should be the easy way, and that's why security is built into the fabric of our products and infrastructure.

Security is front of mind when designing our applications, networks, and business processes

The Invarosoft Cloud security architecture is designed with consideration of a broad range of industry standards and frameworks and in tandem with our internal threat modeling process. It's designed to balance the need for flexibility with the need for effective controls to ensure confidentiality, integrity, and availability of our customers' data.

Applications — App development security, data security & information lifecycle management.

Security — Cryptography & encryption, threat and vulnerability management, security incident management.

Infrastructure — Asset management, access control, operations, communications security.

Data centre & offices — Physical and environmental security.

Corporate — Security governance, organisation of security, personnel security, supplier & third-party data management, mobile security, business continuity, audit/compliance, privacy.

We have strict network controls with a focus on the sanctity of the production environment

Traditional network security theory separates the world into "inside" and "outside" and focuses on the control points between the two areas. While we maintain strict control between our internal networks and the internet, we focus primarily on the delineation between our production and non-production environments.

We control access to our sensitive production networks through the use of strict firewall rules and require multi-factor authentication and encrypted connections. We've also implemented intrusion detection and prevention systems in both our office and production networks to identify potential security issues.

Threat modeling is used to ensure we're designing in the right controls for the threats we face

During the product planning and design phase, we use threat modeling to understand the specific security risks associated with a product or feature. Generally speaking, threat modeling is a collaborative session between engineers, security engineers, architects, and product managers. Threats are identified and prioritised, and that information feeds controls into the design process and supports targeted review and testing in later phases of development.

We utilise threat modeling early and often and can ensure that relevant security configuration and controls are designed to mitigate threats specific to each product or feature we develop.

We operate in Tier 1 data centres

We host the Invarosoft platform with industry-leading services such as Amazon Web Services, resulting in optimal performance with redundancy and failover options globally. These data centres have been designed and optimised to host applications, have multiple levels of redundancy built in, and run on separate front-end hardware nodes.

We care about high availability of your data and services and focus on product resiliency through standards and practices that allow us to minimise downtime. Our cloud hosting partners' resiliency practices are based on SOC 2, ISO 27002, and ISO 22301.

Key principles guiding our Disaster Recovery (DR) Program include:

1. Continual improvement. We strive to ensure our improvements to resiliency grow through operational efficiencies, automation, new technologies, and proven practices.

2. Assurance through testing. We only know it works if we test it. With regularly scheduled testing and continual improvements, we keep our DR Program at an optimum.

3. Dedicated resources. Invarosoft has dedicated teams to ensure our customer-facing products get the attention they need to make the Disaster Recovery Program possible.

We have an extensive daily and weekly backup regime

In addition to platform-wide resiliency, we also have a comprehensive backup program for our Software-as-a-Service (SaaS) offerings. We maintain both daily and weekly backups with point-in-time recovery capabilities for all critical data stores.

Backup integrity is verified through regular restore testing. Backups are encrypted at rest and stored in geographically separated locations to protect against regional failures.

All data sent between our customers and our applications is encrypted in transit

All data for our services is encrypted in transit over public networks using Transport Layer Security (TLS) 1.2+ with Perfect Forward Secrecy (PFS) to protect it from unauthorised disclosure or modification. Our implementation of TLS enforces the use of strong cipher suites and key lengths where supported by the browser.

We believe we can rely on the physical controls and management at AWS, as well as transit-level encryption to protect customer data. A minimum of 128-bit Advanced Encryption Standard (AES) is used for attachments and data at rest.

We have both internal and external security testing programs

Internal Testing

This approach spans planning, development, and testing phases, each test building on previous work and progressively getting tougher. In the development phase, we focus on embedding code scanning to remove any functional and readily identifiable, non-functional security issues. In the testing phase, both our development and security engineering team switch to an adversarial approach to attempt to break features using automated and manual testing techniques.

External Testing

Once a release moves to production, external testing takes over through our always-on, always-testing model using a public, crowd-sourced bug bounty. When a vulnerability is identified by one of our users during standard use of a product, we welcome notifications and respond promptly to any vulnerabilities submitted.

Specialist security consultants are used to complete penetration tests on high-risk products and infrastructure, such as new infrastructure architectures, new products, or fundamental re-architectures.

Access to customer data stored within applications is restricted on a need-to-know basis

Within our SaaS platform, we treat all customer data as equally sensitive and have implemented stringent controls governing this data. Awareness training is provided to our internal employees and contractors during the on-boarding/induction process, covering the importance of and best practices for handling customer data.

Within Invarosoft, only authorised Invarosoft employees have access to customer data stored within our applications. Unauthorised or inappropriate access to customer data is treated as a security incident and managed through our incident management process, which includes instructions to notify affected customers if a breach of policy is observed.

Physical access to our data centres, where customer data is hosted, is limited to authorised personnel only, with access verified using biometric measures. Physical security measures include on-premise security guards, closed-circuit video monitoring, man traps, and additional intrusion protection measures.

Our security training and awareness program results in a genuine uplift in knowledge across the company

Our awareness program is built on the premise that security is everyone's responsibility. These responsibilities and the training and awareness program are used as the primary vehicle for communicating these responsibilities to our staff.

All employees complete security awareness training during on-boarding and participate in ongoing training throughout the year. We conduct simulated phishing exercises, and staff who handle customer data receive role-specific security training appropriate to their responsibilities.

We strive to hire the best

During recruiting, we perform employment, visa, background, and financial checks. On acceptance of an offer, we ensure each new hire has a 90-day on-boarding plan and access to ongoing training based on their role.

All staff with access to customer data are subject to our data handling policies, and access is reviewed quarterly and adjusted based on role changes or departures from the company.

Incidents will happen, but our speed and efficiency in response will keep the impact as low as possible

We maintain a documented Security Incident Response process with defined escalation paths, SLAs, and communication protocols. Key elements include:

• Predefined SLAs for patching vulnerabilities based on CVSS severity level

• A dedicated incident response team with 24/7 on-call coverage for critical issues

• Mandatory notification to affected customers in the event of a confirmed data breach

• Post-incident reviews to identify root causes and prevent recurrence

If you discover a security vulnerability, please report it responsibly to ask@invarosoft.com with "Security Disclosure" in the subject line. We will acknowledge receipt within 24 hours and keep you informed of our progress.

Invarosoft's security program is aligned with internationally recognised standards and frameworks:

• ISO/IEC 27001:2022 — Certified Information Security Management System (certified February 2026)

• AWS Well-Architected Framework — Cloud infrastructure security best practices

• SOC 2 — Service organisation controls aligned to Trust Services Criteria (via AWS)

• ISO 22301 — Business Continuity Management (via AWS)

• GDPR — General Data Protection Regulation compliance for EU/UK customers

• Privacy Act 1988 (Cth) — Australian Privacy Principles compliance

The security statements made above are made on the basis that our partners agree to our Terms of Service.