--- type: Static title: Information Security and Privacy Statement description: How National Digital protects client and personal information — our controls, our data sovereignty position, and our breach response under the Privacy Act 1988. resource: https://nationaldigital.com.au/governance/information-security-and-privacy/ tags: [] timestamp: '2026-09-15T00:00:00.000Z' language: en-AU publisher: National Digital author: Cameron Young authorRole: CEO datePublished: '2026-08-17' dateModified: '2026-09-15' pillar: static canonical: https://nationaldigital.com.au/governance/information-security-and-privacy/ verifiedBy: Cameron Young --- _Home — Governance and Credentials — Information Security and Privacy Statement_ *Legal document* # Information Security and Privacy Statement | Document control | | | --- | --- | | Issued by | The Trustee for Australian Business Trust · ABN 13 744 838 758 · Trustee ACN 658 447 280 | | Version | 1.0 | | Status | Approved | | Next review | 17 August 2027 | | Approved on | 17 August 2026 | | Approved by | Cameron Young, Chief Executive Officer | ## 1. Purpose and scope This statement describes how National Digital protects information — our own, our clients', and the personal information of the people who use the systems we build. It covers our internal operations, our software development practice, and the infrastructure we operate on behalf of clients. We build software rather than manage corporate IT, so most of what follows is about **the production systems we build and run for clients and the credentials that reach them**. That is where our real risk sits. We are not certified to ISO/IEC 27001 and do not claim to be. The controls below are set out in enough detail for a purchaser to assess them directly. Most of them are enforced by tooling rather than left to someone remembering the policy. ## 2. Privacy and personal information **Legislative basis.** We handle personal information in accordance with the *Privacy Act 1988* (Cth) and the Australian Privacy Principles. Where we process information on behalf of a Queensland local government, we work to the obligations that apply to that council under the *Information Privacy Act 2009* (Qld), including the Information Privacy Principles, and we accept that the council remains the accountable entity for information it collects. **Collection minimisation.** We collect and store only the personal information a system genuinely requires to function. Where a client asks for a field whose purpose is not clear, we ask what it is for before building it. **Retention and deletion.** Retention periods and deletion mechanisms are designed into systems at build time rather than added afterwards. Where a purchaser has a records-retention obligation, we implement it in the system rather than relying on manual housekeeping. **Access to personal information.** Systems we build support the purchaser's obligation to give individuals access to, and correction of, their own information. **Production data in development.** Personal information is not copied into development environments as a matter of routine. Where reproducing a defect genuinely requires production data, it is accessed in place under the same controls as production, or de-identified before copying. **Data sovereignty.** We host in Australian regions by default and can evidence the hosting region for every component of a system on request. Where a purchaser requires all data to remain onshore, we will confirm that in writing for the specific architecture proposed. **Breach response.** We recognise the Notifiable Data Breaches scheme. Any suspected breach of a client system is escalated immediately to the Chief Executive Officer and reported to the client without delay, so the client — as the entity holding the notification obligation — can assess and notify. We do not make an assessment of notifiability on a client's behalf, and we do not delay telling a client while we investigate. ## 3. Access control and identity - **Named accounts only.** Every person who can reach a client system does so under an individual account attributable to them. We do not use shared logins. - **Multi-factor authentication** is required on our identity provider and on the platforms that hold or reach client data, including source control, cloud infrastructure and email. - **Least privilege.** Access is granted for the engagement and the role, not by default. Elevated and administrative access is granted deliberately and separately. - **Revocation on departure.** Access is removed when a person leaves an engagement or the business. This applies identically to contractors. - **Single sign-on gating of internal surfaces.** Administrative interfaces, internal tooling, staging environments and preview deployments are placed behind authenticated single sign-on rather than being exposed to the public internet. An unauthenticated visitor cannot reach an internal surface to attempt credentials against it. ## 4. Infrastructure security - **No unsolicited inbound connections.** Our primary application hosting accepts no inbound connections from the internet. Traffic reaches applications through an authenticated outbound tunnel, which means there is no exposed management surface to scan or brute-force. - **Administrative access is brokered and authenticated,** not open to the internet, and is granted per person against our identity provider. - **Edge protection.** Public endpoints sit behind a content delivery and security layer providing TLS termination, a web application firewall, rate limiting and bot management. - **Transport security.** All public traffic is served over TLS. Domains we control are configured with HSTS, DNSSEC, and email authentication (SPF, DKIM and DMARC) to prevent spoofing of our clients' domains. - **Segregation.** Client applications are isolated from one another at the process, filesystem and credential level. A compromise of one application does not yield access to another. ## 5. Secure development - **Version control with attribution.** All source code is held in organisationally controlled Git repositories. Every change is attributable to an authenticated author and a tracked issue, giving a complete audit trail of every change that has ever reached a live system. - **Mandatory peer review.** No change reaches production without review by someone other than its author. This is enforced by branch protection rules. - **Automated verification.** Every proposed change runs an automated build and test pipeline; a change that fails cannot be merged. - **No credentials in source code.** Secrets are held in platform secret stores and injected at deployment. Repositories are scanned for accidentally committed credentials, and any credential that has been exposed is rotated rather than merely removed from the code. - **Dependency management.** Third-party dependencies are tracked, and security advisories against them are surfaced automatically and remediated on a risk-assessed basis — promptly for anything reachable from an untrusted input. - **No direct production editing.** Production systems are changed only through the reviewed, tested, version-controlled path. There is no manual editing of live systems. ## 6. Backup, recovery and continuity - Client systems are backed up on a schedule appropriate to the data, with backups held separately from the systems they protect. - **Backups are verified.** We monitor that backups are being produced and we test that they restore, because a backup process can stop producing usable output without raising an error. - Releases are reproducible and identified by the exact revision deployed, so any environment can be returned to a known-good state. - Our own business operations run on cloud services rather than on physical premises or hardware we own, so the loss of any single device or location does not interrupt delivery. ## 7. Monitoring and incident response Production systems are monitored for availability and error conditions, with alerting to the delivery team. Security-relevant events — authentication failures, access changes, unexpected administrative activity — are logged and retained. Incidents are triaged by severity. Anything affecting availability, data integrity or the confidentiality of personal information is treated as immediate and escalates to the Chief Executive Officer. We record root cause for significant incidents, and the corrective action is a change to whatever in the system or the process allowed the incident. ## 8. People - Contractors work inside the same controls as employees, using the same repositories, review gates and access model. - Every worker and contractor engages under a written agreement containing confidentiality obligations, and receives our policies at engagement. - Offshore contractors, where engaged, work through the same controlled access paths and are subject to the same restrictions on handling personal information. ## 9. Alignment with the ACSC Essential Eight The Essential Eight is designed for a corporate network with managed end-user devices. We describe our position against each mitigation, including where it applies differently to a remote-first software consultancy. | Mitigation | Our position | | --- | --- | | **Application control** | Not implemented as endpoint allow-listing. In our server environments the equivalent control works differently: applications run from reproducible, version-controlled deployments, and nothing executes on a production host that did not arrive through the reviewed release pipeline. | | **Patch applications** | Dependency advisories are surfaced automatically against every repository and remediated on a risk basis. Operating-system and runtime packages on hosts we manage are updated under configuration management rather than by hand. | | **Configure macro settings** | Not applicable in substance. We do not operate a Microsoft Office document workflow and do not exchange macro-enabled documents. | | **User application hardening** | Workstations run current, auto-updating browsers and operating systems. We do not run Flash, Java applets or unnecessary browser plugins. | | **Restrict administrative privileges** | Administrative access to client systems is granted per person, separately from ordinary access, and revoked on departure. Administrative interfaces are not reachable without prior authentication at the network edge. | | **Patch operating systems** | Hosts we operate are maintained under configuration management, so patching is applied consistently across the fleet rather than per-machine. End-user devices are kept on vendor-supported, automatically updating releases. | | **Multi-factor authentication** | Required on our identity provider, source control, cloud infrastructure and email. We treat this as our most important control, because credential compromise is the realistic attack on a business of our size. | | **Regular backups** | Backups are scheduled, held separately from the systems they protect, and monitored for both production and recoverability. | **Limits.** We are not certified to ISO/IEC 27001 or SOC 2, and we do not operate a managed corporate network with centrally controlled end-user devices. A purchaser requiring certified controls or a fully managed device fleet should know that before appointment rather than after. What we do offer is a small, named team and an auditable trail of every change ever made to a live system. ## 10. Cooperation with purchasers We will complete a purchaser's own security questionnaire, comply with their information security policies for the duration of an engagement, support security testing of systems we have built, and transfer source code, data and documentation to the purchaser on request or at the end of an engagement. ## 11. Review This statement is reviewed annually, and additionally after any security incident, any material change to our infrastructure or development practice, or any relevant change in legislation. **Cameron Young** Chief Executive Officer, National Digital 17 August 2026 ## Legal documents **This site** - [Privacy Policy](/privacy/) - [Website Terms of Service](/terms/) - [Accessibility Statement](/accessibility/) **Governance** - [Governance and Credentials](/governance/) - Information Security and Privacy Statement — Current document - [Quality Policy](/governance/quality-policy/) - [Work Health and Safety Policy](/governance/work-health-and-safety-policy/) - [Environmental Policy](/governance/environmental-policy/) - [Modern Slavery and Ethical Sourcing Statement](/governance/modern-slavery-and-ethical-sourcing/) ## This document - Print this document - [Markdown version](/okf/governance/information-security-and-privacy.md) Questions about this document: legal@nationaldigital.com.au ## Related **Parent:** - [Governance and Credentials](/okf/governance.md) **Related:** - [National Digital - Custom Software, AI & Platforms](/okf/home.md) - [Talk to an engineer.](/okf/contact.md) - [Careers at National Digital](/okf/careers.md) - [Graduate Full-Stack Web Developer](/okf/australia-remote-graduate-full-stack-developer.md) - [Senior Software Engineer (Frontend)](/okf/australia-remote-senior-software-engineer-frontend.md) - [Senior Software Engineer (Backend)](/okf/australia-remote-senior-software-engineer-backend.md) - [Privacy Policy](/okf/privacy.md) - [Website Terms of Service](/okf/terms.md) - [Accessibility Statement](/okf/accessibility.md) - [Small team. Serious platforms.](/okf/about.md) - [Real platforms, in production.](/okf/case-studies.md) - [Senior engineering, end to end.](/okf/services.md) - [Knowledge library.](/okf/expertise.md) - [QA & Test Automation Engineer](/okf/australia-remote-qa-automation-engineer.md) - [Booking systems built around your operation.](/okf/booking-systems.md) - [Custom software, built by senior engineers.](/okf/custom-software.md) - [AI that survives contact with production.](/okf/ai-automation-services.md) - [NewBook Integration & Custom Development](/okf/newbook-integration.md) - [cruisePAL (Resco) Integration & Custom Development](/okf/cruisepal-integration.md) - [Customer portal development, built around your access rules.](/okf/customer-portals.md) - [An Australian software development company you can talk to directly.](/okf/software-development-company.md) - [Custom appointment scheduling, built for how your service actually books.](/okf/appointment-scheduling-systems.md) - [Venue booking systems built around your capacity, not a vendor's template.](/okf/venue-booking-systems.md) - [Web application development for products that have to hold up.](/okf/web-application-development.md) - [AI agent development that answers, escalates and knows its limits.](/okf/ai-agent-development.md) - [Document and workflow automation, wired into the systems you already run.](/okf/document-workflow-automation.md) - [AI consulting from the engineers who would have to build it.](/okf/ai-consulting.md) - [Governance and Credentials](/okf/governance.md) - [Quality Policy](/okf/governance/quality-policy.md) - [Work Health and Safety Policy](/okf/governance/work-health-and-safety-policy.md) - [Modern Slavery and Ethical Sourcing Statement](/okf/governance/modern-slavery-and-ethical-sourcing.md) - [Environmental Policy](/okf/governance/environmental-policy.md) - [What will it cost to build?](/okf/estimate.md) - [Product Development Plan](/okf/services/product-development-plan.md) - [Replacing a legacy booking system — without losing a booking.](/okf/legacy-booking-system-replacement.md) - [Product Support](/okf/services/product-support.md) - [Civic software we build and run](/okf/projects.md) - [Platform Health Check](/okf/services/platform-health-check.md) - [AI Automation Assessment](/okf/services/ai-automation-assessment.md) - [Technology Roadmap](/okf/services/technology-roadmap.md) - [An AI automation assessment that ranks the work and trains your team](/okf/ai-automation-assessment.md) - [Connect an AI assistant](/okf/agents.md) - [AI Visibility Management](/okf/services/ai-visibility-management.md) - [Standard rate card](/okf/services/rate-card.md)