Security and privacy at Gatheroo

A copy of our ISO/IEC 27001:2022 certificate is available on request, along with extracts from our Statement of Applicability. We don't publish the full Statement of Applicability because it details our internal control implementation, but we'll walk your security team through the parts relevant to your assessment. Email security@gatheroo.io.

On three levels. We run our own internal audit programme across the year, our leadership team formally reviews security performance and risk at management review, and an external certification body audits us annually. Findings from any of these are tracked as corrective actions through to closure.

We don't run penetration tests on a fixed schedule. We run continuous automated security testing using AWS-native tooling, every code change is peer reviewed before release, and our controls are independently audited each year to maintain ISO 27001 certification. Where a client's procurement process requires an independent penetration test, we'll arrange one - talk to us at security@gatheroo.io.

Yes. We regularly complete vendor security questionnaires as part of client procurement. Send yours to security@gatheroo.io and we'll return it completed, with supporting evidence where we can provide it.

Gatheroo gives you a secure, auditable client intake process. Australian data storage, encryption, two-factor access control and a full activity trail, supporting your obligations under Australian privacy and AML/CTF legislation.

If your business is in accounting, conveyancing, legal, mortgage broking or financial services, Tranche 2 of Australia's AML/CTF reforms extends formal obligations to you. A documented, auditable KYC and client intake process isn't an optional extra under that framework, it's a baseline requirement.

Gatheroo doesn't make your business compliant on its own. What it does is give you the structured intake process, the audit trail and the security controls that compliance requires, and that you can demonstrate clearly if you're ever asked.

Contact us directly. We'd rather answer a specific question than have you decide on incomplete information.

For security, compliance or procurement questions (questionnaires, certificate copies, due diligence) email security@gatheroo.io. For general support, email help@gatheroo.io or book a chat.

All Gatheroo customer data is stored in Australia on Amazon Web Services infrastructure. It is not replicated to, or hosted in, any other jurisdiction.

A small number of Kicking Pixels personnel located outside Australia access production systems remotely to build and support the platform. They connect through a dedicated VPN with multi-factor authentication and role-based least-privilege access, every session is logged, and they are bound by the same screening, confidentiality and security obligations as our Australian team. The data itself remains stored in Australia at all times.

For businesses in regulated industries (financial services, accounting, legal, mortgage broking, conveyancing) data sovereignty matters, and Australian storage is a non-negotiable part of how Gatheroo operates.

Yes. Everything moving to and from Gatheroo - files, form submissions and page traffic - is encrypted in transit using TLS 1.2 or higher. Nothing travels in the clear.

Sensitive text fields such as Tax File Numbers are additionally encrypted at rest with field-level AES-128-GCM and are never stored as plain text. They're decrypted only when your team views them, and always delivered back over an encrypted connection.

Uploaded files are encrypted at rest with AES-256 on Australian AWS storage. EC2 volumes and S3 are additionally encrypted at rest using AES-256 via AWS-managed keys.

You do. Your account data and everything your clients submit remain yours. We process it only to operate the service on your instructions, as set out in the Data Processing Agreement within our Terms and Conditions. We don't sell it, share it for marketing, or use it for anything you haven't asked for.

Yes. When you delete a request or a file in Gatheroo it is removed from the live platform immediately. There is no hidden archive and no soft-delete state you can't see.

Deleted data can persist briefly in our encrypted operational backups, which run on a rolling seven-day cycle and are then overwritten. Those backups exist so we can restore your account after a failure, they aren't searchable and aren't used to retrieve individual deleted items.

You control what is retained and when it is deleted. That supports your obligations under the Australian Privacy Act, which requires personal information to be destroyed or de-identified once it is no longer needed.

Your account and its data are deleted 60 days after cancellation, which gives you time to export anything you need. Once deleted, data is purged from live systems and ages out of our seven-day backup cycle shortly afterwards. If you need it removed sooner, ask and we'll action it.

Trial accounts are deleted automatically after 60 days of inactivity. Nothing is kept indefinitely just because a trial was started and abandoned.

No. We don't use your data or your clients' data to train AI models, and we don't provide it to third-party AI tools that would. Where our team uses AI tooling internally, our policy permits only approved tools that contractually exclude inputs from model training.

Yes, and you already have it. Our DPA forms Part B of our Terms and Conditions and applies automatically, there's nothing separate to negotiate or sign. It sets out your role as data controller and ours as processor, our sub-processors, breach notification, retention and deletion, and our commitment that customer data stays in Australia in the ordinary course of operating the service. If procurement needs a signed standalone copy, just ask.

Individuals can ask us to access, correct or delete personal information we hold about them. We respond to access requests within 30 days and correction requests within 14 days, and we assess deletion requests within 14 days and action them within 30. Where the information belongs to one of your clients, you are the controller - we'll refer the request to you and support you in responding. Email privacy@gatheroo.io

Yes, and we're specific about what that means.

All data in transit (files and form submissions alike) is encrypted using TLS 1.2. Sensitive text fields such as Tax File Numbers are additionally encrypted at rest using field-level AES-128-GCM, decrypted only when your team views them.

Uploaded files are encrypted at rest with AES-256 on Australian AWS storage. EC2 volumes and S3 are additionally encrypted at rest using AES-256 via AWS-managed keys.

Strong passwords are mandatory. Two-factor authentication is available on all plans by email passcode, and by SMS on Large plans.

Gatheroo is hosted on Amazon Web Services with all data stored in Australia. Access to production is role-based, least-privilege, multi-factor authenticated and logged.

Every code change is peer reviewed before release, and we run continuous automated security monitoring using AWS-native tooling including Inspector and GuardDuty. All of this operates inside our ISO/IEC 27001:2022 certified management system.

Yes. 2FA is available for both your team and your clients.

For your team, 2FA can be enabled from the My Account > 2FA section in your account settings. Once enabled, a 6-digit code is sent to your verified email address each time you log in.

For your clients, optional 2FA on a request via email is available on all plans. SMS-based 2FA is available on Large plans. This ensures that only the intended recipient can access a sensitive request and that access is recorded.

Each client receives a unique secure link to their portal. There are no shared logins, no shared access, and no version confusion between clients.

You can require clients to verify their identity via two-factor authentication (either by email code or if you are on a large plan you can opt to send this code by SMS) before they can access or submit any information. This means you always have a record of who accessed what and when, which is particularly relevant for businesses with KYC or identity verification obligations.

Passwords are never stored in readable form. They're stored as salted one-way hashes, so they can't be reversed or retrieved by anyone, including us. Strong passwords are enforced at sign-up, and we recommend enabling two-factor authentication on top.

Not currently. Gatheroo uses email and password with mandatory strong passwords, plus two-factor authentication by email on all plans and by SMS on Large plans. If SSO is a requirement for your organisation, tell us, it helps us prioritise.

Everyone who works on Gatheroo is a Kicking Pixels team member, not a subcontracted third party. Anyone granted privileged access to production is screened beforehand, including reference checks and verification of employment history. All personnel sign confidentiality agreements and complete security awareness training, refreshed as the threat landscape changes.

Access is revoked within 24 hours of a person leaving or changing role, and all assets are returned. Access rights across production systems are also reviewed on a scheduled basis, so accounts don't quietly outlive the reason they were created.

Yes. Every request carries a timestamped activity log. It records when a request was sent, when it was opened by the client, what was answered and when, and every comment or update made along the way.

That record builds itself as a natural output of your process. Nobody has to remember to document it. If you’re ever asked to demonstrate your client intake process to an auditor, a regulator, or your own leadership, that record is ready to produce with minimal preparation.

For businesses with AML/CTF obligations, KYC requirements, or simply an expectation that they can account for what was requested and received, that’s not a feature. It’s the point.

All traffic to Gatheroo passes through an Application Load Balancer before it reaches any application server. The servers themselves are not directly accessible from the internet - only the load balancer accepts incoming connections.

SSH administrative access is restricted to a single authorised IP address. No other inbound access to the server is permitted.

The database is not exposed to the network at all. It runs on the same isolated server as the application and is only accessible locally, there is no network port open for database connections.

All of this is enforced through AWS security groups, which act as a strict firewall, only explicitly permitted traffic is allowed, everything else is blocked by default.

Gatheroo maintains automated backups of the application database, the application server and all stored files. Backups are held in Australia, encrypted, and retained on a rolling seven-day cycle, so we can restore to a point in time within that window.

Backups are verified monthly, reviewed quarterly, and put through a full restore test annually as part of our certified management system. Our target recovery time for Gatheroo is one hour.

We remediate on defined timeframes: critical and high severity within 30 days, medium within 90 days, low within 180 days, and emergency patches for actively exploited issues within 7 days. We monitor continuously using AWS-native tooling and review dependencies for known vulnerabilities as part of our release process.

Every change is peer reviewed by our Technical Lead before it can be merged, then moves through separate local, staging and pre-production environments before reaching production. Changes are tracked and releases can be rolled back. Nothing goes to production straight from a developer's machine.

No. Testing uses synthetic or anonymised data only. Real client documents and real personal information are never copied into development, staging or test environments.

If a security incident affects your data, we'll tell you. We acknowledge reported incidents within 4 business hours and aim to contain them within 8 business hours. Our Terms and Conditions commit us to notifying you within 72 hours of becoming aware of a breach affecting your data. Separately, where an incident is an eligible data breach under the Australian Privacy Act, we assess it and notify the OAIC and affected individuals as required, working with you as the controller of your clients' information.

The full list is published in our Trust Centre, including what each provider does and where it's located. In short, Amazon Web Services hosts the platform in Australia and Stripe processes payments. Everything else we rely on is listed there with its role and location.

Yes. We give at least 30 days' notice before adding or replacing a sub-processor that handles customer data, so you have time to review it. The current list is always published in our Trust Centre.

Every supplier that touches customer data is risk assessed before we engage them - security posture, data location, certifications and contractual protections. Assessments are recorded in our vendor risk register and reviewed on an ongoing basis, not just at onboarding.

No. All payments are processed by Stripe. Card numbers never touch Gatheroo's systems and are never stored by us.