Your clients trust you with sensitive data. We help make sure you don’t let them down.

A copy of our ISO/IEC 27001:2022 certificate is available on request, along with extracts from our Statement of Applicability. We don’t publish the full Statement of Applicability because it details our internal control implementation, but we’ll walk your security team through the parts relevant to your assessment. Email security@gatheroo.io.

On three levels. We run our own internal audit programme across the year, our leadership team formally reviews security performance and risk at management review, and an external certification body audits us annually. Findings from any of these are tracked as corrective actions through to closure.

We don’t run penetration tests on a fixed schedule. We run continuous automated security testing using AWS-native tooling, every code change is peer reviewed before release, and our controls are independently audited each year to maintain ISO 27001 certification. Where a client’s procurement process requires an independent penetration test, we’ll arrange one – talk to us at security@gatheroo.io.

Yes. We regularly complete vendor security questionnaires as part of client procurement. Send yours to security@gatheroo.io and we’ll return it completed, with supporting evidence where we can provide it.

Gatheroo gives you a secure, auditable client intake process. Australian data storage, encryption, two-factor access control and a full activity trail, supporting your obligations under Australian privacy and AML/CTF legislation.

If your business is in accounting, conveyancing, legal, mortgage broking or financial services, Tranche 2 of Australia’s AML/CTF reforms extends formal obligations to you. A documented, auditable KYC and client intake process isn’t an optional extra under that framework, it’s a baseline requirement.

Gatheroo doesn’t make your business compliant on its own. What it does is give you the structured intake process, the audit trail and the security controls that compliance requires, and that you can demonstrate clearly if you’re ever asked.

Contact us directly. We’d rather answer a specific question than have you decide on incomplete information.

For security, compliance or procurement questions (questionnaires, certificate copies, due diligence) email security@gatheroo.io. For general support, email help@gatheroo.io or book a chat.

Yes, and we’re specific about what that means.

All data in transit (files and form submissions alike) is encrypted using TLS 1.2. Sensitive text fields such as Tax File Numbers are additionally encrypted at rest using field-level AES-128-GCM, decrypted only when your team views them.

Uploaded files are encrypted at rest with AES-256 on Australian AWS storage. EC2 volumes and S3 are additionally encrypted at rest using AES-256 via AWS-managed keys.

Strong passwords are mandatory. Two-factor authentication is available on all plans by email passcode, and by SMS on Large plans.

Gatheroo is hosted on Amazon Web Services with all data stored in Australia. Access to production is role-based, least-privilege, multi-factor authenticated and logged.

Every code change is peer reviewed before release, and we run continuous automated security monitoring using AWS-native tooling including Inspector and GuardDuty. All of this operates inside our ISO/IEC 27001:2022 certified management system.

Yes. 2FA is available for both your team and your clients.

For your team, 2FA can be enabled from the My Account > 2FA section in your account settings. Once enabled, a 6-digit code is sent to your verified email address each time you log in.

For your clients, optional 2FA on a request via email is available on all plans. SMS-based 2FA is available on Large plans. This ensures that only the intended recipient can access a sensitive request and that access is recorded.

Each client receives a unique secure link to their portal. There are no shared logins, no shared access, and no version confusion between clients.

You can require clients to verify their identity via two-factor authentication (either by email code or if you are on a large plan you can opt to send this code by SMS) before they can access or submit any information. This means you always have a record of who accessed what and when, which is particularly relevant for businesses with KYC or identity verification obligations.

Passwords are never stored in readable form. They’re stored as salted one-way hashes, so they can’t be reversed or retrieved by anyone, including us. Strong passwords are enforced at sign-up, and we recommend enabling two-factor authentication on top.

Not currently. Gatheroo uses email and password with mandatory strong passwords, plus two-factor authentication by email on all plans and by SMS on Large plans. If SSO is a requirement for your organisation, tell us, it helps us prioritise.

Everyone who works on Gatheroo is a Kicking Pixels team member, not a subcontracted third party. Anyone granted privileged access to production is screened beforehand, including reference checks and verification of employment history. All personnel sign confidentiality agreements and complete security awareness training, refreshed as the threat landscape changes.

Access is revoked within 24 hours of a person leaving or changing role, and all assets are returned. Access rights across production systems are also reviewed on a scheduled basis, so accounts don’t quietly outlive the reason they were created.

Yes. Every request carries a timestamped activity log. It records when a request was sent, when it was opened by the client, what was answered and when, and every comment or update made along the way.

That record builds itself as a natural output of your process. Nobody has to remember to document it. If you’re ever asked to demonstrate your client intake process to an auditor, a regulator, or your own leadership, that record is ready to produce with minimal preparation.

For businesses with AML/CTF obligations, KYC requirements, or simply an expectation that they can account for what was requested and received, that’s not a feature. It’s the point.