Image

Security at Safer

Security at Safer

Your data deserves serious protection. At Safer, security is not an afterthought - it is foundational to everything we build. This document outlines the technical and operational security controls we have in place to protect your data, ensure platform availability, and meet the expectations of enterprise procurement and compliance teams.

Image

  1. Data Sovereignty - Stored in Australia

  1. Data Sovereignty - Stored in Australia

  1. Data Sovereignty - Stored in Australia

Your data stays in Australia. Safer is an Australian company, built on Australian infrastructure, for Australian businesses. All customer claim, case and health data is stored and processed in Australia. We do not transfer it outside Australia unless explicitly requested and agreed in writing. The only data held offshore is the user name and sign-in details our identity provider needs to authenticate users (see Subprocessors).


Cloud Infrastructure - Amazon Web Services (AWS)

Safer’s core platform runs on AWS in the Asia Pacific (Sydney) ap-southeast-2 region. Our application backend, file storage and backups all run in AWS Sydney. AWS holds certifications including:

  • ISO/IEC 27001

  • ISO/IEC 27017

  • ISO/IEC 27018

  • SOC 1 / 2 / 3

  • IRAP (Protected)

Database - Supabase (Australia)
Customer records are stored in a Supabase Postgres database hosted in Sydney. Data at rest is encrypted and remains under Australian jurisdiction.

AI Processing - Amazon Bedrock (Australia)

Elara’s document processing and workflow automation run on Amazon Bedrock in the AWS Sydney region. AI requests are processed in Australia, and prompts and responses are not retained. Inference is configured for in-region processing, so prompt and response content does not leave Australia at any point.

Bedrock runs foundation models inside the AWS security boundary. Bedrock does not store prompts or responses, share them with model providers, or use them for training. Each model provider is deployed into a dedicated account the provider cannot access, and model traffic stays inside the AWS network. Your data is never used to train AI models - not AWS’s, not the model provider’s, nor any third party’s.

Application, database, file storage, backups and AI processing all run on Australian infrastructure. Customer case and health data has no overseas processing or storage step.

Your data stays in Australia. Safer is an Australian company, built on Australian infrastructure, for Australian businesses. All customer claim, case and health data is stored and processed in Australia. We do not transfer it outside Australia unless explicitly requested and agreed in writing. The only data held offshore is the user name and sign-in details our identity provider needs to authenticate users (see Subprocessors).


Cloud Infrastructure - Amazon Web Services (AWS)

Safer’s core platform runs on AWS in the Asia Pacific (Sydney) ap-southeast-2 region. Our application backend, file storage and backups all run in AWS Sydney. AWS holds certifications including:

  • ISO/IEC 27001

  • ISO/IEC 27017

  • ISO/IEC 27018

  • SOC 1 / 2 / 3

  • IRAP (Protected)

Database - Supabase (Australia)
Customer records are stored in a Supabase Postgres database hosted in Sydney. Data at rest is encrypted and remains under Australian jurisdiction.

AI Processing - Amazon Bedrock (Australia)

Elara’s document processing and workflow automation run on Amazon Bedrock in the AWS Sydney region. AI requests are processed in Australia, and prompts and responses are not retained. Inference is configured for in-region processing, so prompt and response content does not leave Australia at any point.

Bedrock runs foundation models inside the AWS security boundary. Bedrock does not store prompts or responses, share them with model providers, or use them for training. Each model provider is deployed into a dedicated account the provider cannot access, and model traffic stays inside the AWS network. Your data is never used to train AI models - not AWS’s, not the model provider’s, nor any third party’s.

Application, database, file storage, backups and AI processing all run on Australian infrastructure. Customer case and health data has no overseas processing or storage step.

Your data stays in Australia. Safer is an Australian company, built on Australian infrastructure, for Australian businesses. All customer claim, case and health data is stored and processed in Australia. We do not transfer it outside Australia unless explicitly requested and agreed in writing. The only data held offshore is the user name and sign-in details our identity provider needs to authenticate users (see Subprocessors).


Cloud Infrastructure - Amazon Web Services (AWS)

Safer’s core platform runs on AWS in the Asia Pacific (Sydney) ap-southeast-2 region. Our application backend, file storage and backups all run in AWS Sydney. AWS holds certifications including:

  • ISO/IEC 27001

  • ISO/IEC 27017

  • ISO/IEC 27018

  • SOC 1 / 2 / 3

  • IRAP (Protected)

Database - Supabase (Australia)
Customer records are stored in a Supabase Postgres database hosted in Sydney. Data at rest is encrypted and remains under Australian jurisdiction.

AI Processing - Amazon Bedrock (Australia)

Elara’s document processing and workflow automation run on Amazon Bedrock in the AWS Sydney region. AI requests are processed in Australia, and prompts and responses are not retained. Inference is configured for in-region processing, so prompt and response content does not leave Australia at any point.

Bedrock runs foundation models inside the AWS security boundary. Bedrock does not store prompts or responses, share them with model providers, or use them for training. Each model provider is deployed into a dedicated account the provider cannot access, and model traffic stays inside the AWS network. Your data is never used to train AI models - not AWS’s, not the model provider’s, nor any third party’s.

Application, database, file storage, backups and AI processing all run on Australian infrastructure. Customer case and health data has no overseas processing or storage step.

  1. AI Governance - Elara assists, people decide

  1. AI Governance - Elara assists, people decide

  1. AI Governance - Elara assists, people decide

Elara supports your team. It does not replace their judgement.

  • Elara makes no claim, liability or payment decisions

  • Every Elara output is reviewed by an authorised user

  • Elara shows its source material so users can verify it

  • Prompts are version-controlled

  • Customers receive advance notice of material AI changes

  1. Data Protection & Encryption

  1. Data Protection & Encryption

  1. Data Protection & Encryption

Encryption in Transit
All data between your users and Safer is protected using TLS 1.2 or higher. All connections are redirected to HTTPS, and HSTS is enforced across all Safer domains.

Encryption at Rest
All stored data, including database records, uploaded documents and backups, is encrypted using AES-256.

Cryptographic Key Management
Encryption keys are managed through AWS Key Management Service (KMS), rotated on a defined schedule and never stored in application code.

Encryption in Transit
All data between your users and Safer is protected using TLS 1.2 or higher. All connections are redirected to HTTPS, and HSTS is enforced across all Safer domains.

Encryption at Rest
All stored data, including database records, uploaded documents and backups, is encrypted using AES-256.

Cryptographic Key Management
Encryption keys are managed through AWS Key Management Service (KMS), rotated on a defined schedule and never stored in application code.

  1. Identity & Access Management

  1. Identity & Access Management

  1. Identity & Access Management

Safer uses Clerk, a SOC 2 Type II certified identity provider, for authentication. Clerk holds only users’ names, email addresses and sign-in credentials. No case data or health information is sent to Clerk.

Multi-Factor Authentication
MFA is mandatory for all Safer team members with production access, and available to all customer users.

Enterprise SSO
Safer supports SAML 2.0 and OpenID Connect (OIDC), including Microsoft Entra ID, Okta and Google Workspace.

Role-Based Access Control
Users are granted the minimum permissions their role requires. Access is revoked immediately on offboarding.

Account Security

  • 12-character minimum passwords, screened against known breached passwords

  • Account lockout after repeated failed sign-in attempts

  • Single-use password reset links

  • No default passwords

Safer uses Clerk, a SOC 2 Type II certified identity provider, for authentication. Clerk holds only users’ names, email addresses and sign-in credentials. No case data or health information is sent to Clerk.

Multi-Factor Authentication
MFA is mandatory for all Safer team members with production access, and available to all customer users.

Enterprise SSO
Safer supports SAML 2.0 and OpenID Connect (OIDC), including Microsoft Entra ID, Okta and Google Workspace.

Role-Based Access Control
Users are granted the minimum permissions their role requires. Access is revoked immediately on offboarding.

Account Security

  • 12-character minimum passwords, screened against known breached passwords

  • Account lockout after repeated failed sign-in attempts

  • Single-use password reset links

  • No default passwords

Safer uses Clerk, a SOC 2 Type II certified identity provider, for authentication. Clerk holds only users’ names, email addresses and sign-in credentials. No case data or health information is sent to Clerk.

Multi-Factor Authentication
MFA is mandatory for all Safer team members with production access, and available to all customer users.

Enterprise SSO
Safer supports SAML 2.0 and OpenID Connect (OIDC), including Microsoft Entra ID, Okta and Google Workspace.

Role-Based Access Control
Users are granted the minimum permissions their role requires. Access is revoked immediately on offboarding.

Account Security

  • 12-character minimum passwords, screened against known breached passwords

  • Account lockout after repeated failed sign-in attempts

  • Single-use password reset links

  • No default passwords

  1. Multi-Tenancy & Data Isolation

  1. Multi-Tenancy & Data Isolation

  1. Multi-Tenancy & Data Isolation

Every customer has a dedicated database with its own credentials and its own encryption keys. Isolation between customers is enforced at the infrastructure layer, not only by application logic.

  1. Application Security

  1. Application Security

  1. Application Security

Secure Development Practices
Security is embedded throughout our software development lifecycle. All code changes require peer review and automated security scanning - including secrets detection, dependency vulnerability scanning, and static code analysis. We follow OWASP Top 10 guidelines.

Penetration Testing
Safer is independently penetration tested every year. The most recent test was conducted by Cyberlinx in August 2026. All findings were remediated and verified by re-test. The report is available under NDA.

Perimeter Protection
A Web Application Firewall and automated DDoS mitigation are provided through the Vercel Firewall, with additional DDoS protection from AWS.

Secure Development Practices
Security is embedded throughout our software development lifecycle. All code changes require peer review and automated security scanning - including secrets detection, dependency vulnerability scanning, and static code analysis. We follow OWASP Top 10 guidelines.

Penetration Testing
Safer is independently penetration tested every year. The most recent test was conducted by Cyberlinx in August 2026. All findings were remediated and verified by re-test. The report is available under NDA.

Perimeter Protection
A Web Application Firewall and automated DDoS mitigation are provided through the Vercel Firewall, with additional DDoS protection from AWS.

  1. Infrastructure & Operations

  1. Infrastructure & Operations

  1. Infrastructure & Operations

Environment Segregation
Development, Staging and Production are fully isolated. Production customer data is never present in non-production environments.

Backups
Customer data is backed up daily, encrypted with AES-256 and replicated across multiple availability zones in AWS Sydney. Backups are retained for 7 days, with point-in-time recovery across that window. All backups remain in AWS Sydney.

Business Continuity & Disaster Recovery
Safer maintains a Business Continuity Plan with a 24-hour RPO and 24-hour RTO. Disaster recovery is tested annually, and a test summary is available on request.

Logging & Audit Trail
Security events are logged, with alerting on suspicious activity. A full in-app audit trail of user actions on case records is available to customers.

Data Retention & Deletion
Safer retains injured worker records for the periods required under Australian workers’ compensation and record-keeping obligations, including long-term retention where a scheme or jurisdiction requires it. Retention is managed by the platform, not manually. On termination, customer data is exported and deleted in line with the customer agreement and any overriding statutory retention obligation.

Environment Segregation
Development, Staging and Production are fully isolated. Production customer data is never present in non-production environments.

Backups
Customer data is backed up daily, encrypted with AES-256 and replicated across multiple availability zones in AWS Sydney. Backups are retained for 7 days, with point-in-time recovery across that window. All backups remain in AWS Sydney.

Business Continuity & Disaster Recovery
Safer maintains a Business Continuity Plan with a 24-hour RPO and 24-hour RTO. Disaster recovery is tested annually, and a test summary is available on request.

Logging & Audit Trail
Security events are logged, with alerting on suspicious activity. A full in-app audit trail of user actions on case records is available to customers.

Data Retention & Deletion
Safer retains injured worker records for the periods required under Australian workers’ compensation and record-keeping obligations, including long-term retention where a scheme or jurisdiction requires it. Retention is managed by the platform, not manually. On termination, customer data is exported and deleted in line with the customer agreement and any overriding statutory retention obligation.

  1. Governance & People

  1. Governance & People

  1. Governance & People

Security at Safer is managed through a formal governance framework and supported by our people.

  • Information Security Management System (ISMS) aligned to ISO/IEC 27001:2022, with CEO accountability

  • 38 approved security policies, reviewed annually

  • Continuous control monitoring through Vanta

  • Risk register reviewed quarterly

  • Risk assessment of our own suppliers

  • Background checks proportionate to role, mandatory for privileged access

  • Security training at hire and annually

  1. Compliance & Privacy

  1. Compliance & Privacy

  1. Compliance & Privacy

Safer complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. As a handler of health information, Safer is subject to the Notifiable Data Breaches scheme. Affected customers are notified within 72 hours of Safer confirming an eligible data breach.

Safer holds professional indemnity and cyber insurance.

  1. Certifications & Standards

  1. Certifications & Standards

  1. Certifications & Standards

Safer’s security program is built on recognised Australian and international standards.

  • ISO/IEC 27001:2022: ISMS aligned, with 38 approved policies. Formal external certification audit targeted for early 2027.

  • SOC 2: program underway.

  • Essential Eight: maturity program underway.

  • Our infrastructure provider, AWS, holds ISO/IEC 27001, SOC 2 Type II and IRAP (Protected) certifications.

  1. Incident Response

  1. Incident Response

  1. Incident Response

If a security incident occurs, we contain affected systems immediately, investigate the root cause, notify affected customers within 72 hours of confirming an eligible data breach, and complete a post-incident review with actions tracked to closure. Our process aligns with the Notifiable Data Breaches scheme.

  1. What You Control

  1. What You Control

  1. What You Control

Security is shared. Your administrators control:

  • SSO configuration

  • MFA enforcement for your users

  • User roles and permissions

  • Immediate deactivation of user accounts

  1. Subprocessors

  1. Subprocessors

  1. Subprocessors

Provider

Purpose

Location

Data

Amazon Web Services (AWS)

Cloud infrastructure, AI processing (Bedrock), file storage, backups, email

Australia (Sydney)

All customer data

Supabase

Database (Postgres)

Australia (Sydney)

All customer data

Vercel

Web application hosting, firewall

Australia (Sydney)

Transient request data only

Clerk

User authentication

United States

User name, email address and sign-in credentials

GitHub

Source code management

United States

No customer data

Twilio

Sending and receiving SMS

Sent via an Australian mobile number over the Australian carrier network

SMS message content

Request Security Documentation

Our security policies, penetration test report and disaster recovery test summary are available under NDA.
Email: hello@safer.app


Security information on this page is accurate as of October 2026.

Our security policies, penetration test report and disaster recovery test summary are available under NDA.
Email: hello@safer.app


Security information on this page is accurate as of October 2026.

Back to Home