Information Security Policy

Version 1.0 · Last reviewed: June 2026

Owner: Calum Batey

Version: 1.0

Review cadence: Annually, or after any material change or significant incident.

1. Purpose and scope

This policy describes how PathIQ protects the confidentiality, integrity, and availability of customer and personal data within the PathIQ application. It applies to all PathIQ staff, contractors, systems, and sub-processors involved in delivering the service.

2. Data hosting and residency

  • Customer and personal data at rest is stored in MongoDB Atlas on AWS, Sydney (ap-southeast-2), within Australia.
  • Application processing runs on Google Cloud Run, Melbourne (australia-southeast2), within Australia.
  • Uploaded files (documents) are stored in Google Cloud Storage, Melbourne (australia-southeast2), within Australia.
  • The frontend is served as static assets via Netlify (a global CDN); no personal data is stored or processed there.
  • Logs are retained in an Australian region.

3. Encryption

  • In transit: TLS 1.2 or higher for all client-to-server and server-to-database connections.
  • At rest: AES-256 encryption. Customer and personal data in MongoDB Atlas is encrypted at rest by default; uploaded files stored in Google Cloud Storage are encrypted at rest with Google-managed keys (AES-256).

4. Tenancy and data isolation

PathIQ uses a single-tenant data model: each customer organisation's data is stored in a dedicated, isolated database, providing strong logical and physical separation between customers.

5. Access control and authentication

  • Access to systems and data is granted on a least-privilege basis and reviewed periodically.
  • Multi-factor authentication (TOTP, with optional email one-time codes and backup codes) is available to all accounts and required by default. Customer organisations control whether MFA is mandatory for their users; where it is required, enrolment is enforced at login, and any user who has enrolled MFA is always challenged for a second factor.
  • Password complexity requirements are enforced; passwords are stored only as salted hashes.
  • Standards-based SSO (SAML/OIDC, including AAF federation) is on the roadmap.

6. Audit logging and monitoring

Security-relevant events, including authentication (success/failure), authorisation and permission changes, user provisioning/de-provisioning, and privileged data access, are recorded in an append-only audit log with timestamp, actor, action, target, source IP, and tenant scope. Logs are retained for 90 days and can be exported to a customer's SIEM on request. Provider-level monitoring and alerting operate continuously.

7. Secure development

  • Changes are version-controlled (Git) with pull-request code review before release.
  • Deployments are staged before production.
  • Dependencies are version-pinned and monitored for known vulnerabilities (automated dependency alerts).
  • Security is considered as part of design and development.

8. Vulnerability and patch management

Platform and dependency patches are applied promptly, with critical vulnerabilities prioritised. A third-party penetration test is planned prior to broader rollout.

9. Backups and recovery

MongoDB Atlas performs automated, encrypted backups with point-in-time recovery, stored within the Sydney region. Recovery procedures rely on these managed backups and the redundancy provided by our cloud providers.

10. Supply chain / sub-processors

PathIQ uses the following sub-processors: MongoDB Atlas, Google Cloud (Cloud Run and Cloud Storage), Netlify, Stripe (card data only), and Anthropic (AI processing). We select providers that hold recognised certifications (SOC 2 Type II and/or ISO 27001) and maintain appropriate data-processing agreements.

11. Incident response

Security incidents are managed under PathIQ's Incident Response Plan, including containment, investigation, customer notification (target: within 72 hours of confirmation), and post-incident review, consistent with the Notifiable Data Breaches scheme.

12. Roles and responsibilities

Security is owned by PathIQ's technical leadership. All staff are responsible for following this policy, protecting credentials, using encrypted devices, and reporting suspected incidents immediately.