Security and privacy you can check
Everything we do to protect your practice and your clients' information, with the evidence to back it up.
ISO/IEC 27001:2022 certified
Certified by Ashburton Assurance Australasia (Ashburton Certified), accredited by JASANZ. Valid 21 September 2026 to 20 September 2029.
Registration 610198/I/1
Our ISO 27001 certification
ISO/IEC 27001 is the international standard for managing information security. An independent, accredited body audits us against it.
Scope of certification
Our information security management system covers the design, development, delivery and operation of the Portal 360 SaaS application by 360 SaaS Pty Ltd, including hosting on Microsoft Azure Australia East, integrations with third-party services, and the people and information involved in running it.
Certified scope, as written on the certificate: The provision of Managed IT Services, Digital Marketing Services, and SaaS solutions to Australian clients.
Certificate details
- Standard:
- ISO/IEC 27001:2022
- Certificate holder:
- Gandhi Holdings Pty Ltd, the parent company of 360 SaaS Pty Ltd, under a group information security management system that includes Portal 360
- Certification body:
- Ashburton Assurance Australasia (Ashburton Certified)
- Accreditation:
- JASANZ
- Registration number:
- 610198/I/1
- Valid from:
- 21 September 2026
- Valid to:
- 20 September 2029
How we protect your data
Australian data hosting
Customer data is stored and processed in Microsoft Azure Australia East by default. Restricted data stays in Australian regions unless the Director approves a change.
Encryption
Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher), using managed keys on Microsoft Azure. Secrets are held in a managed key vault.
Access control
Role-based access, single sign-on through Microsoft, Google and Xero, multi-factor authentication for our team, a quarterly access review procedure and removal of access when people leave.
Backups and recovery
Automated daily backups held in Australia, and documented business continuity and disaster recovery plans, including scenario plans for a platform outage, a data breach and an ATO API compromise.
Monitoring and testing
Logging and alerting, regular vulnerability assessment, patch management and code review before release.
People
Confidentiality commitments and security awareness training for the team, with an independent internal audit of the ISMS.
Suppliers
Suppliers are assessed before onboarding and reviewed on a schedule, with data processing terms in place for suppliers that handle personal information.
Incident response
A documented incident response procedure and a separate Notifiable Data Breach procedure, with named roles and timeframes.
Standards and compliance
ISO/IEC 27001:2022
Certified by Ashburton Assurance Australasia (JASANZ accredited). Our group information security management system includes 360 SaaS and the Portal 360 application.
Privacy Act 1988 (Cth)
We handle personal information in line with the Australian Privacy Principles and the Notifiable Data Breaches scheme.
ATO Digital Service Provider requirements
Our ATO integration is built to the ATO Operational Security Framework.
Tax File Number Rule
TFN information is collected, used and protected in line with the Privacy (Tax File Number) Rule 2015.
PCI DSS through Stripe
Card payments are handled by Stripe, a PCI DSS Level 1 service provider. Card numbers never reach our systems.
Hosting certifications
Microsoft Azure, our hosting provider, holds ISO 27001, ISO 27017, ISO 27018 and SOC reports, and is assessed under the Australian IRAP program.
Sub-processors and data location
These providers may handle data on our behalf. We tell customers before we add or replace one that handles personal information.
| Provider | Purpose | Data handled | Location |
|---|---|---|---|
| Microsoft Azure | Cloud hosting: compute, storage, database, identity, monitoring and backup | All platform data | Australia (Australia East, Sydney) |
| Microsoft Azure OpenAI | AI-assisted features | Content sent to an AI feature by a user, within the request | Australia (Azure Australian region) |
| Cloudflare | DNS, CDN, web application firewall and DDoS protection | Network and traffic metadata | Global network, with a Sydney point of presence (overseas) |
| Stripe | Subscription payments and billing | Payment tokens and billing details (we do not store card numbers) | United States (overseas) |
| Twilio SendGrid | Transactional email delivery | Recipient email addresses and message content | United States (overseas) |
| Twilio | SMS delivery | Mobile numbers and message content | United States (overseas) |
| Verifime | Identity verification | Identity documents and details submitted for verification | Australia |
| Australian Taxation Office | Tax lodgement and ATO client communication, through the ATO Digital Service Provider integration | TFNs, ABNs and lodgement data | Australia |
| GitHub (Microsoft) | Source code and build pipelines | Source code only, no customer data | United States (overseas) |
| Accounting integrations (Xero, MYOB, QuickBooks, XPM and others you connect) | Sync you choose to turn on | Accounting and client data you authorise | Varies by provider (Australia, New Zealand, United States and others) (overseas) |
Policies and documents
ISO/IEC 27001:2022 certificate
Our certificate and scope of certification.
On requestStatement of Applicability summary
Which Annex A controls apply to Portal 360.
On requestData Processing Agreement
The terms under which we process personal information for your practice.
On requestYour own security questionnaire
We complete your vendor security questionnaire or due diligence request.
On requestPrivacy Policy
How we handle personal information.
Read nowNotifiable Data Breaches
How we assess and report data breaches.
Read nowRequest our ISO certificate and documents
Tell us who you are and what you need. We email the documents within one business day.
Report a vulnerability
If you find a security issue, tell us first so we can fix it.
Email security@portal360.ai with what you found, the steps to reproduce it and any proof of concept. We acknowledge reports within one business day and keep you updated until it is fixed.
- Test only against accounts you own, and do not access, change or keep other people's data.
- Do not run denial-of-service, social engineering or physical attacks.
- Give us reasonable time to fix the issue before you share it.
We will not take legal action against good-faith research that follows these guidelines. Our security.txt file lists the same contact.
Privacy and security contacts
Chief Privacy Officer
Privacy questions, access and correction requests, and complaints.
privacy@portal360.ai360 SaaS Pty Ltd, ABN 79 681 731 340, 5 Lavington Avenue, Chipping Norton NSW 2170. You can also read our Notifiable Data Breaches procedure and Terms and Conditions.
Frequently Asked Questions
Customer data is stored and processed in Microsoft Azure Australia East (Sydney) by default. The sub-processor list on this page shows every provider that may handle data and where.
Ready to get started?
Our team is happy to help.
Reach out to us and we’ll get back to you quickly.