Security

Infrastructure

CompliGUARD is built on enterprise-grade cloud infrastructure with data residency in Australia. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Database backups are automated daily and retained for 30 days.

Authentication & Access

User authentication is handled via industry-standard protocols. Passwords are hashed using bcrypt. Session tokens are short-lived and refreshed automatically. All API endpoints enforce authentication and row-level security policies to ensure users can only access their own data.

Payment Security

All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. CompliGUARD never stores, processes, or has access to your full credit card details. Stripe's security documentation is available at stripe.com/docs/security.

the Audit Vault retained for the duration of the subscription

Compliance review records stored in the Audit Vault are retained for the duration of the subscription. Records are immutable once created — they cannot be edited or deleted by any user, ensuring the integrity of your compliance audit trail. Access is restricted to the authenticated account holder.

Data Handling

• Your submitted marketing content is processed only for the purpose of delivering compliance reviews.
• Product context data (ingredients, claims, ARTG listing) is stored solely to contextualise your reviews.
• We do not use your content or product data to train AI models without explicit consent.
• Audit Vault records are retained for the duration of the subscription. Account data is deleted 90 days after account cancellation.

Responsible Disclosure

If you discover a security vulnerability in CompliGUARD, please report it to support@compliguard.com.au. We take all reports seriously and will respond within one business day.