SECURITY

Client information is the most valuable thing you hand us.

Our products hold tax file numbers, financial records and legal documents. We design them around the Australian Privacy Principles and the ATO's Operational Security Framework for digital service providers.

IN PLACE TODAY

Separation

Every request is checked against the firm and client it belongs to, and the database itself rejects records that cross between organisations.

Least privilege

Distinct roles for each client. Removing a member or disabling a user takes effect on their next request.

Credentials

Passwords are hashed with Argon2, and sign-in responses do not reveal whether an account exists.

Integrity

Lock dates protect finalised periods; posted entries are voided, never silently edited.

Local processing

Redaction can run inside your own network with a locally hosted AI model.

BEFORE ATO SERVICES GO LIVE

Commitments we will meet before connecting to any ATO service.

Multi-factor authentication for every user, which cannot be switched off.
All client data hosted in Australia ([provider], Sydney region).
Encryption in transit and at rest; tax file numbers additionally encrypted and masked on screen.
An append-only audit log of sign-ins, changes and lodgments.
Sign-in rate limiting and monitoring for suspicious activity.
ATO machine credentials held in a managed key service, never on user devices.

REPORT AN ISSUE

If you believe you have found a vulnerability, please tell us. We acknowledge reports within [2] business days. Eligible data breaches are handled under the Notifiable Data Breaches scheme.

[security@legalpresent.ai]