Board papers deserve better than an email attachment.

Customer data, including board papers, annotations, minutes and audit logs, is stored in Australia. Our hosting provider and region are [PLACEHOLDER: hosting provider and region, e.g. AWS ap-southeast-2 (Sydney)].

Backups are stored in Australia too.

Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest with [PLACEHOLDER: encryption standard, e.g. AES-256].

Every user signs in with multi-factor authentication, and administrators can require it for their whole organisation.

On Professional and Enterprise plans, users can sign in with Microsoft Entra ID or Google Workspace. Enterprise adds SCIM provisioning, so access is granted and removed from your identity provider automatically.

Permissions can be set by board, committee, meeting and agenda item, including restricted papers for in-camera sessions.

Ratify records who viewed, downloaded, signed, voted on or changed what, and when. Administrators can export the full log at any time.

We run Ratify’s own systems against the Australian Signals Directorate’s Essential Eight mitigation strategies, targeting Maturity Level [PLACEHOLDER: target maturity level]. This is self-assessed alignment, not a certification.

Ratify does not currently hold ISO 27001, SOC 2 or IRAP certification. If one is on our roadmap we will say so here, with a date, once it is committed.

Revoking a device’s access and removing downloaded packs from it is on our roadmap. Until then, removing a user signs them out of every session immediately.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our privacy policy explains what we collect and why.

Sub-processors

These are the third parties that process customer data on our behalf. We will give customers notice before adding a new one.