Security

Infrastructure

CompliGUARD is built on enterprise-grade cloud infrastructure with data residency in Australia. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Database backups are automated daily and retained for 30 days.

Authentication & Access

User authentication is handled via industry-standard protocols. Passwords are hashed using bcrypt. Session tokens are short-lived and refreshed automatically. All API endpoints enforce authentication and row-level security policies to ensure users can only access their own data.

Payment Security

All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. CompliGUARD never stores, processes, or has access to your full credit card details. Stripe's security documentation is available at stripe.com/docs/security.

Audit Retention Vault

Compliance review records stored in your Audit Retention Vault are retained for five years from the date of each review. Records are immutable once created — they cannot be edited or deleted by any user, ensuring the integrity of your compliance audit trail. Access is restricted to the authenticated account holder.

Data Handling

• Your submitted marketing content is processed only for the purpose of delivering compliance reviews.
• Product context data (ingredients, claims, ARTG listing) is stored solely to contextualise your reviews.
• We do not use your content or product data to train AI models without explicit consent.
• Account data is deleted 90 days after account cancellation, except Audit Vault records which are retained for the full 5-year period.

Responsible Disclosure

If you discover a security vulnerability in CompliGUARD, please report it to support@compliguard.com.au. We take all reports seriously and will respond within one business day.