What security and procurement both ask — in one document.

What an auditor asks before they ask the price.

• Complete tenant isolation

  Each organisation’s data is isolated inside the database itself, not in the interface — and the isolation is tested automatically before every release.

• Two-factor authentication on super-admin accounts

  Mandatory, not optional, and a user cannot switch it off for themselves.

• An immutable audit log

  Every sensitive event is written to a log that cannot be edited or deleted — what happened stays as it happened.

• Aligned with the Essential Cybersecurity Controls

  A compliance matrix with an automated guard that blocks any claim of a control that is not actually in force.

• An approval gate on every new account

  Signing up is not signing in: a new account stays pending until an administrator approves it, and can be suspended or rejected later — nobody enters the system just by knowing its address.

Where your data sits: three options, and the status of each.

• Our cloudWhat it is:The system as it runs today, with the isolation and audit log described above.Status:Technically deployed as an operational build since May 2026.
• Your serverWhat it is:The whole system inside your infrastructure — including, on request, procuring the server and installing the system on it.Status:Technically supported — both Next.js and PostgreSQL can be self-hosted — and it has not yet been deployed for any organisation. Scoped as a separate deployment project, with the remote access controls for updates and maintenance set in the contract before the first installation.
• Your databaseWhat it is:The application on our cloud, the data in your database.Status:The same status.

What changes with each option is not only the price. Hosting on your infrastructure moves running the server, maintaining it, backing it up and its uptime to your team; the application and its updates stay mine. If you would like us to procure the server and install the system on it, that is possible and it does not change the split: custody after handover is yours. Remote access for updates and maintenance is defined in the contract, with its controls, rather than on this page; commercial terms are agreed in a written proposal once scope is understood. That split is written down before the first deployment, not after the first outage. And if you have a data-location requirement, or need confidential information to stay inside your premises, that is precisely the case the second and third options exist for — settled when we first talk and before signing, not after.