Information Security and Privacy Statement

1. Purpose and scope

This statement describes how National Digital protects information — our own, our clients', and the personal information of the people who use the systems we build. It covers our internal operations, our software development practice, and the infrastructure we operate on behalf of clients.

We build software rather than manage corporate IT, so most of what follows is about the production systems we build and run for clients and the credentials that reach them. That is where our real risk sits.

We are not certified to ISO/IEC 27001 and do not claim to be. The controls below are set out in enough detail for a purchaser to assess them directly. Most of them are enforced by tooling rather than left to someone remembering the policy.

2. Privacy and personal information

Legislative basis. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where we process information on behalf of a Queensland local government, we work to the obligations that apply to that council under the Information Privacy Act 2009 (Qld), including the Information Privacy Principles, and we accept that the council remains the accountable entity for information it collects.

Collection minimisation. We collect and store only the personal information a system genuinely requires to function. Where a client asks for a field whose purpose is not clear, we ask what it is for before building it.

Retention and deletion. Retention periods and deletion mechanisms are designed into systems at build time rather than added afterwards. Where a purchaser has a records-retention obligation, we implement it in the system rather than relying on manual housekeeping.

Access to personal information. Systems we build support the purchaser's obligation to give individuals access to, and correction of, their own information.

Production data in development. Personal information is not copied into development environments as a matter of routine. Where reproducing a defect genuinely requires production data, it is accessed in place under the same controls as production, or de-identified before copying.

Data sovereignty. We host in Australian regions by default and can evidence the hosting region for every component of a system on request. Where a purchaser requires all data to remain onshore, we will confirm that in writing for the specific architecture proposed.

Breach response. We recognise the Notifiable Data Breaches scheme. Any suspected breach of a client system is escalated immediately to the Chief Executive Officer and reported to the client without delay, so the client — as the entity holding the notification obligation — can assess and notify. We do not make an assessment of notifiability on a client's behalf, and we do not delay telling a client while we investigate.

3. Access control and identity

• Named accounts only. Every person who can reach a client system does so under an individual account attributable to them. We do not use shared logins.
• Multi-factor authentication is required on our identity provider and on the platforms that hold or reach client data, including source control, cloud infrastructure and email.
• Least privilege. Access is granted for the engagement and the role, not by default. Elevated and administrative access is granted deliberately and separately.
• Revocation on departure. Access is removed when a person leaves an engagement or the business. This applies identically to contractors.
• Single sign-on gating of internal surfaces. Administrative interfaces, internal tooling, staging environments and preview deployments are placed behind authenticated single sign-on rather than being exposed to the public internet. An unauthenticated visitor cannot reach an internal surface to attempt credentials against it.

4. Infrastructure security

• No unsolicited inbound connections. Our primary application hosting accepts no inbound connections from the internet. Traffic reaches applications through an authenticated outbound tunnel, which means there is no exposed management surface to scan or brute-force.
• Administrative access is brokered and authenticated, not open to the internet, and is granted per person against our identity provider.
• Edge protection. Public endpoints sit behind a content delivery and security layer providing TLS termination, a web application firewall, rate limiting and bot management.
• Transport security. All public traffic is served over TLS. Domains we control are configured with HSTS, DNSSEC, and email authentication (SPF, DKIM and DMARC) to prevent spoofing of our clients' domains.
• Segregation. Client applications are isolated from one another at the process, filesystem and credential level. A compromise of one application does not yield access to another.

5. Secure development

• Version control with attribution. All source code is held in organisationally controlled Git repositories. Every change is attributable to an authenticated author and a tracked issue, giving a complete audit trail of every change that has ever reached a live system.
• Mandatory peer review. No change reaches production without review by someone other than its author. This is enforced by branch protection rules.
• Automated verification. Every proposed change runs an automated build and test pipeline; a change that fails cannot be merged.
• No credentials in source code. Secrets are held in platform secret stores and injected at deployment. Repositories are scanned for accidentally committed credentials, and any credential that has been exposed is rotated rather than merely removed from the code.
• Dependency management. Third-party dependencies are tracked, and security advisories against them are surfaced automatically and remediated on a risk-assessed basis — promptly for anything reachable from an untrusted input.
• No direct production editing. Production systems are changed only through the reviewed, tested, version-controlled path. There is no manual editing of live systems.

6. Backup, recovery and continuity

• Client systems are backed up on a schedule appropriate to the data, with backups held separately from the systems they protect.
• Backups are verified. We monitor that backups are being produced and we test that they restore, because a backup process can stop producing usable output without raising an error.
• Releases are reproducible and identified by the exact revision deployed, so any environment can be returned to a known-good state.
• Our own business operations run on cloud services rather than on physical premises or hardware we own, so the loss of any single device or location does not interrupt delivery.

7. Monitoring and incident response

Production systems are monitored for availability and error conditions, with alerting to the delivery team. Security-relevant events — authentication failures, access changes, unexpected administrative activity — are logged and retained.

Incidents are triaged by severity. Anything affecting availability, data integrity or the confidentiality of personal information is treated as immediate and escalates to the Chief Executive Officer. We record root cause for significant incidents, and the corrective action is a change to whatever in the system or the process allowed the incident.

8. People

• Contractors work inside the same controls as employees, using the same repositories, review gates and access model.
• Every worker and contractor engages under a written agreement containing confidentiality obligations, and receives our policies at engagement.
• Offshore contractors, where engaged, work through the same controlled access paths and are subject to the same restrictions on handling personal information.

9. Alignment with the ACSC Essential Eight

The Essential Eight is designed for a corporate network with managed end-user devices. We describe our position against each mitigation, including where it applies differently to a remote-first software consultancy.

Limits. We are not certified to ISO/IEC 27001 or SOC 2, and we do not operate a managed corporate network with centrally controlled end-user devices. A purchaser requiring certified controls or a fully managed device fleet should know that before appointment rather than after. What we do offer is a small, named team and an auditable trail of every change ever made to a live system.

10. Cooperation with purchasers

We will complete a purchaser's own security questionnaire, comply with their information security policies for the duration of an engagement, support security testing of systems we have built, and transfer source code, data and documentation to the purchaser on request or at the end of an engagement.

11. Review

This statement is reviewed annually, and additionally after any security incident, any material change to our infrastructure or development practice, or any relevant change in legislation.

Cameron Young Chief Executive Officer, National Digital 17 August 2026