Trust & security
Your data stays in Australia, and stays yours.
Security is not a section of the proposal. It decides how we hire, how our engineers reach your systems, where your data lives and what an AI model is allowed to see.
The Essential Eight, applied to how we work
The Australian Cyber Security Centre's baseline mitigation strategies, across our own environment and the platforms we build.
- 01
Patch applications
Dependencies updated automatically and reviewed weekly; critical fixes within 48 hours.
- 02
Patch operating systems
Immutable images rebuilt on a schedule rather than servers patched by hand.
- 03
Multi-factor authentication
Phishing-resistant MFA for every person with access to client systems.
- 04
Restrict admin privileges
Just-in-time, time-boxed admin roles, approved and logged.
- 05
Application control
Signed artefacts and admission policies decide what may run.
- 06
Restrict Office macros
Macros blocked on staff devices by default.
- 07
User application hardening
Managed browsers and devices with hardened baselines.
- 08
Regular backups
Automated, tested restores for every environment we operate.
ISO 27001 and Australian data residency
Our security management system is built to ISO/IEC 27001, with controls covering both the Melbourne team and our delivery partner. Client data is hosted in Australian regions unless you decide otherwise.
- Default hosting
- AWS Sydney and Melbourne; Azure Australia East and Southeast
- AI model endpoints
- In-region processing where offered; anything else agreed in writing first
- Backups
- Stored in a second Australian region
- Offshore access
- IndiaNIC engineers work through managed, logged access; no client data is copied offshore
- Training on your data
- Never. Contractually excluded with every provider we use
AI guardrails
Every agent we ship states what it may read, what it may write and what it will never do. See the permissions for each entry in the MCP & agent registry.
Security questions
Are you ISO 27001 certified?
Our information security management system is built to ISO/IEC 27001. Ask us for the current certificate and statement of applicability; we share them under NDA.
How does offshore delivery work with sensitive data?
IndiaNIC engineers work in client environments through managed virtual desktops with session logging, data-loss controls and no local copies. Production data access is the exception, approved per task and time-boxed.
Where a client requires onshore-only access, the work is staffed from Melbourne.
Will you sign our security schedule?
Usually, yes. Send it early; our security lead reviews it before the commercial terms so there are no surprises late in the process.
How do you report incidents?
We notify affected clients without delay and support their obligations under the Notifiable Data Breaches scheme, with a written timeline and remediation plan.
Need our security pack?
Policies, certificates and a completed security questionnaire, shared under NDA.