Security & Compliance
At RespectX, trust is everything
Our platform is designed for handling sensitive conversations about workplace issues, and that demands best-in-class security, privacy, and governance from day one. From global certifications to thoughtful product design, we have built a company and culture that puts you, and the protection of your data, first.
Certifications
Committed to Best Practices
We are proud to be ISO 27001 certified, a globally recognized standard for information security management. Certification confirms that our systems, policies, and processes meet rigorous international benchmarks for data protection and risk management.
We are also progressing toward ISO 27701 certified certification by December 2025, which will extend our compliance framework to cover data privacy and governance, and align closely with GDPR requirements. In parallel, we are working toward achieving Level 2 maturity across the ASD Essential Eight framework as part of our 2025–2026 cyber security strategy, further strengthening our resilience against evolving cyber threats.
RespectX is hosted on AWS and Vercel, with all production and backup data stored in Australian data centres (Sydney, ap-southeast-2). All underlying hosting infrastructure is SOC 2 certified.
Governance
Security Principles That Guide Us
Security at RespectX is led by our dedicated privacy and security team, guided by four core principles:
- Least Privilege
Access is only ever granted when absolutely necessary.
- Defence-in-Depth
Multiple layered security measures ensure no single point of failure.
- Consistency
Security controls consistently apply across all environments, not just production.
- Continuous Improvement
Our systems and processes continually evolve with emerging risks.
- Incident Response and Recovery
Documented incident response and recovery plan, tested annually to ensure resilience.
Data Protection
Safeguarding Your Information
We take a layered approach to safeguarding customer information, ensuring privacy, security, and resilience at every step.
- Encryption
- All sensitive data is encrypted using AES-256 at rest, and TLS 1.2+ in transit. Field-level encryption is applied to the most sensitive data, with HSTS and other hardening in place for extra protection.
- Monitoring and Incident Response
- Our platform is continuously monitored with 24/7 logging and anomaly detection. Our incident response plan is tested annually to ensure we can respond quickly, contain risks, and keep our customers informed.
- Data Isolation
- Each organisation’s data is logically separated within the platform. Strict controls prevent cross-customer access, and our architecture enforces privacy by design at every layer.
- Resilience and Continuity
- Backups are distributed across multiple availability zones within AWS Sydney. Business continuity planning is aligned with ISO 27001 standards and tested regularly to ensure rapid recovery in the event of disruption.
Platform Security
Building a Secure Foundation
Real-time data and analytics to focus your prevention efforts.
- Penetration Testing
- External penetration testing is conducted annually and after major updates. Findings are remediated quickly and can be shared with customers under NDA.
- Secure Development Lifecycle
- Our engineering process includes static code analysis, dependency scanning, and vulnerability checks at every stage. APIs undergo regular testing and security reviews.
- Device and Endpoint Security
- All company devices are managed with enforced encryption, endpoint protection, and strict security policies to prevent unauthorized access.
- Identity and Access Management
- • Multi-factor authentication (MFA) is mandatory
- • Role-based access controls ensure least-privilege access
- • Accounts are time-limited and automatically revoked when no longer needed
Culture & Vendors
A Security-First Ecosystem
- Team Awareness
- Every employee receives training in security and privacy from day one, with annual refreshers and ongoing updates. Engineers receive additional training on secure coding practices.
- Vendors and Partners
- All vendors undergo a strict security assessment covering data access, integration, and compliance certifications. Only approved vendors are integrated into our platform.
- Local Operations
- All RespectX staff are based in Australia. No customer data is accessed from offshore.
Meet The Team
Our Security Expert
Craig Ford
CISO
Craig is an award winning cyber security professional, the co-founder and director of Cyber Unicorns, the Deputy Chair of the Australian Information Security Association, a freelance cyber security journalist, and an international, multi award winning best selling author of cyberpunk/hacker fantasy fiction and cyber education.
Frequently Asked Questions
Cyber Security & Data Governance
If you would like clarification on any of the above information in this FAQ document please get in touch.
System Security Features & Capabilities
Where is the RespectX platform hosted?
What Data Centres are used to host the RespectX platform?
Is the data encrypted and secure?
Do the Multifactor authentication requirements apply to all users on the platform?
Is there built-in data redundancy and recovery in place for the platform?
Can you provide an overview of your security architecture?
How is customer data segregated from other customers in multi-tenant environments?
How are your APIs secured and authenticated? Do you conduct regular API security assessments?
Can our data be exported if we decide to leave the RespectX platform?
Is all data purged from the RespectX systems upon termination of a contract?
Can we configure retention periods?
Are any subcontractors or support personnel offshore?
What are your Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)?
How is the mobile used after an anonymous submission has been made?
Is any access required to our identity provider (IdP)?
Compliance & Data Governance
Is RespectX ISO27001 compliant or certified?
How do you ensure compliance with Australian privacy laws and data protection standards?
Does RespectX have an Incident Response and Recovery Plan?
Is RespectX SOC2 Certified?
Is RespectX GDPR compliant?
How do you handle international data transfer requirements?
What specific user data do you collect and store?
What does RespectX do with the aggregate data it collects?
Do you use data masking or tokenization?
Do you provide audit logs?
How is data secured on mobile?
Can we monitor our own security posture?
What user privacy controls are available to end users?
Do you have AI/ML capabilities?
Is RespectX aligning with the ASD Essential Eight?
Can I see proof of certification?
What controls are in place around privileged access?
Does RespectX do external pentests?
Can customers conduct their own audit?
How quickly will we be notified of a breach?
What are the liability terms for data breaches?
How do you handle government or law enforcement requests?
Ready to lead with Care?
Security is not a feature, it is a promise. When you choose RespectX, you are choosing a partner committed to safeguarding your data, your people, and your reputation.