Information Security and Privacy Statement

National Digital — The Trustee for Australian Business Trust, ABN 13 744 838 758

1. Purpose and scope

This statement describes how National Digital protects information — our own, our clients', and the
personal information of the people who use the systems we build. It covers our internal operations,
our software development practice, and the infrastructure we operate on behalf of clients.

We are a software consultancy, not a managed IT provider. That distinction matters when reading
what follows: our principal information security risk is not a corporate office network, it is
the production systems we build and run for clients, and the credentials that reach them. This
statement is written around that risk.

We hold no certification to ISO/IEC 27001 and make no claim to one. Our controls are described
here so a purchaser can assess them directly, and the substantive ones are enforced by tooling
rather than by policy adherence — which we regard as the stronger assurance, because an automated
control cannot be skipped under deadline pressure.

2. Privacy and personal information

Legislative basis. We handle personal information in accordance with the Privacy Act 1988
(Cth) and the Australian Privacy Principles. Where we process information on behalf of a Queensland
local government, we work to the obligations that apply to that council under the Information
Privacy Act 2009 (Qld), including the Information Privacy Principles, and we accept that the
council remains the accountable entity for information it collects.

Collection minimisation. We collect and store only the personal information a system genuinely
requires to function. Where a client asks for a field whose purpose is not clear, we ask what it is
for before building it — the cheapest way to protect data is not to hold it.

Retention and deletion. Retention periods and deletion mechanisms are designed into systems at
build time rather than added afterwards. Where a purchaser has a records-retention obligation, we
implement it in the system rather than relying on manual housekeeping.

Access to personal information. Systems we build support the purchaser's obligation to give
individuals access to, and correction of, their own information.

Production data in development. Personal information is not copied into development
environments as a matter of routine. Where reproducing a defect genuinely requires production data,
it is accessed in place under the same controls as production, or de-identified before copying.

Data sovereignty. We host in Australian regions by default and can evidence the hosting region
for every component of a system on request. Where a purchaser requires all data to remain onshore,
we will confirm that in writing for the specific architecture proposed.

Breach response. We recognise the Notifiable Data Breaches scheme. Any suspected breach of a
client system is escalated immediately to the Chief Executive Officer and reported to the client
without delay, so the client — as the entity holding the notification obligation — can assess and
notify. We do not make an assessment of notifiability on a client's behalf, and we do not delay
telling a client while we investigate.

3. Access control and identity

• Named accounts only. Every person who can reach a client system does so under an individual
  account attributable to them. We do not use shared logins.
• Multi-factor authentication is required on our identity provider and on the platforms that
  hold or reach client data, including source control, cloud infrastructure and email.
• Least privilege. Access is granted for the engagement and the role, not by default. Elevated
  and administrative access is granted deliberately and separately.
• Revocation on departure. Access is removed when a person leaves an engagement or the
  business. This applies identically to contractors.
• Single sign-on gating of internal surfaces. Administrative interfaces, internal tooling,
  staging environments and preview deployments are placed behind authenticated single sign-on
  rather than being exposed to the public internet. An unauthenticated visitor cannot reach an
  internal surface to attempt credentials against it.

4. Infrastructure security

• No unsolicited inbound connections. Our primary application hosting accepts no inbound
  connections from the internet. Traffic reaches applications through an authenticated outbound
  tunnel, which means there is no exposed management surface to scan or brute-force.
• Administrative access is brokered and authenticated, not open to the internet, and is granted
  per person against our identity provider.
• Edge protection. Public endpoints sit behind a content delivery and security layer providing
  TLS termination, a web application firewall, rate limiting and bot management.
• Transport security. All public traffic is served over TLS. Domains we control are configured
  with HSTS, DNSSEC, and email authentication (SPF, DKIM and DMARC) to prevent spoofing of our
  clients' domains.
• Segregation. Client applications are isolated from one another at the process, filesystem and
  credential level. A compromise of one application does not yield access to another.

5. Secure development

• Version control with attribution. All source code is held in organisationally controlled Git
  repositories. Every change is attributable to an authenticated author and a tracked issue, giving
  a complete audit trail of every change that has ever reached a live system.
• Mandatory peer review. No change reaches production without review by someone other than its
  author. This is enforced by branch protection rules, not by convention.
• Automated verification. Every proposed change runs an automated build and test pipeline;
  a change that fails cannot be merged.
• No credentials in source code. Secrets are held in platform secret stores and injected at
  deployment. Repositories are scanned for accidentally committed credentials, and any credential
  that has been exposed is rotated rather than merely removed from the code.
• Dependency management. Third-party dependencies are tracked, and security advisories against
  them are surfaced automatically and remediated on a risk-assessed basis — promptly for anything
  reachable from an untrusted input.
• No direct production editing. Production systems are changed only through the reviewed,
  tested, version-controlled path. There is no manual editing of live systems.

6. Backup, recovery and continuity

• Client systems are backed up on a schedule appropriate to the data, with backups held separately
  from the systems they protect.
• Backups are verified, not assumed. We monitor that backups are being produced and are
  recoverable. We regard an unverified backup as no backup at all — a position we hold because
  verifying restores is the only way to discover that a backup process has silently stopped
  producing usable output.
• Releases are reproducible and identified by the exact revision deployed, so any environment can
  be returned to a known-good state.
• Our own business operations run on cloud services rather than on physical premises or hardware we
  own, so the loss of any single device or location does not interrupt delivery.

7. Monitoring and incident response

Production systems are monitored for availability and error conditions, with alerting to the
delivery team. Security-relevant events — authentication failures, access changes, unexpected
administrative activity — are logged and retained.

Incidents are triaged by severity. Anything affecting availability, data integrity or the
confidentiality of personal information is treated as immediate and escalates to the Chief
Executive Officer. We record root cause for significant incidents and the corrective action is a
change to the system or the process, not a reminder to be careful.

8. People

• Contractors work inside the same controls as employees — the same repositories, the same review
  gates, the same access model. There is no separate, lighter path for contracted work.
• Every worker and contractor engages under a written agreement containing confidentiality
  obligations, and receives our policies at engagement.
• Offshore contractors, where engaged, work through the same controlled access paths and are
  subject to the same restrictions on handling personal information.

9. Alignment with the ACSC Essential Eight

The Essential Eight is designed for a corporate network with managed end-user devices. We describe
our position against each mitigation honestly, including where it applies differently to a
remote-first software consultancy, because a purchaser is better served by an accurate map than a
flattering one.

Where we are candid about limits. We are not certified to ISO/IEC 27001 or SOC 2, and we do not
operate a managed corporate network with centrally controlled end-user devices. A purchaser
requiring certified controls or a fully managed device fleet should know that before appointment
rather than after. What we do offer is a small, named team, an auditable trail of every change ever
made to a live system, and controls enforced by tooling that cannot be bypassed by an individual
under pressure.

10. Cooperation with purchasers

We will complete a purchaser's own security questionnaire, comply with their information security
policies for the duration of an engagement, support security testing of systems we have built, and
transfer source code, data and documentation to the purchaser on request or at the end of an
engagement. We do not hold clients hostage to their own systems.

11. Review

This statement is reviewed annually, and additionally after any security incident, any material
change to our infrastructure or development practice, or any relevant change in legislation.

Cameron Young
Chief Executive Officer, National Digital
17 August 2026