Australian data, Australian region, no borrowed certifications.
Everything below is written for the person in your IT security team who has to sign off on a new system. Where a claim belongs to AWS rather than to us, we say so.
All of it, in Sydney.
Storage, processing, background jobs and email delivery all occur in the AWS ap-southeast-2 (Sydney) region — the same region used by the Australian Taxation Office, Services Australia and over a thousand Australian government and local government agencies. Council maintenance data does not leave Australia in the course of normal operation.
- Region
- ap-southeast-2 (Sydney)
- Database
- PostgreSQL with PostGIS on Amazon RDS, encrypted at rest
- Evidence storage
- Amazon S3, private buckets, no public access
- Amazon SES, Sydney region
- In transit
- TLS on every connection, no exceptions
- Secrets
- AWS Secrets Manager — never in application code
What the IRAP assessment covers — and what it does not.
AWS Sydney holds IRAP PROTECTED assessments covering 168 services, assessed by independent ASD-certified assessors against Australia’s Information Security Manual. Verdue runs on that infrastructure.
Verdue has not been independently assessed. The application layer carries no IRAP assessment of its own, and we will not imply otherwise on a tender response. If your procurement requires an assessed application, tell us early and we will tell you plainly where we stand.
We can provide AWS compliance documentation via AWS Artifact for your IT security team’s review as part of the procurement process, along with our own architecture and data-flow description.
One council cannot see another council’s records.
Tenant isolation
Every row in the database carries the council it belongs to, and every query is scoped to the signed-in user’s council. There is no shared view, no cross-council reporting surface, and no administrative screen that aggregates one council’s data alongside another’s.
- Council identifier on every record
- Contractors see only the records they supplied
- No cross-tenant reporting surface exists
Authentication & roles
Access is by named account — no shared logins. Roles separate a council administrator, who manages users and configuration, from a contract manager, who works with sites, completions and reports. Enterprise deployments can map roles to your existing directory via SSO.
- Named accounts, password-hashed, no shared credentials
- Administrator and contract manager roles
- SSO and directory role mapping on Enterprise
Four things we will not do with your data.
These are product commitments, not policy sentences — the software has no feature that would let us do them.
Your data is yours
Council records belong to the council. Export them at any time in full. If you leave, you take them with you — we do not hold compliance evidence hostage against a renewal.
We do not sell or share it
Council data is never sold, never used for advertising, and never shared with another council or contractor. It is used to operate, support and secure the service, and for nothing else.
We do not rank contractors
Verdue reports factual counts and rates with the sample size beside them, and states nothing where the sample is too small to support it. We do not build league tables, grades or productivity scores, and we will not supply them.
We do not collect location ourselves
Verdue does not run on an operator’s device and records no position of its own. Positions reach Verdue only inside a proof-of-service record that a contractor’s software submits for a completed job.
The full detail is in the privacy policy, which is written against the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Records outlive the contract that created them.
Councils retain compliance evidence for far longer than a contractor would — audit, insurance and legal discovery all arrive years later. Retention is configurable per council rather than fixed by us.
- Retention period configured per council
- Records immutable once submitted
- Full export available at any time
- Deletion on written request, subject to legal obligations