dossioSECURITY READINESS

Security at Dossio

Your R&D evidence is sensitive. Below is an honest account of what is in place today and what is still on the roadmap — we do not claim controls we have not yet delivered.

IN PLACE TODAY

Australian data residency (Sydney)

All data is hosted in the Sydney region (AWS ap-southeast-2). Your R&D records and evidence stay in Australia.

Encrypted in transit and at rest

All connections are TLS-encrypted, and data is encrypted at rest on managed PostgreSQL. Secrets are held in environment-scoped configuration, never in the codebase.

Row-Level Security on every table (defense-in-depth)

RLS is enabled on all application tables as an additional layer beneath the application's own Company → Practice → User permission model.

Append-only AI audit logging

Every AI inference is recorded append-only with a prompt fingerprint, token usage, and guardrail outcome. AI output is flagged DRAFT until a qualified advisor approves it — the platform never determines eligibility.

Compliance guardrails on AI output

71 guardrail patterns block non-compliant or outcome-promising AI output before it can be shown, aligned to ATO Division 290 promoter rules.

Privacy by design

Built around the Australian Privacy Principles: data is minimised, exportable, and deletable on request. Tenants are isolated by design.

ON THE ROADMAP

Independent penetration test + security attestation

Funded and scheduled· Next 1–2 quarters

A third-party penetration test and written attestation. This is the milestone most conditional orders are gated on.

Cryptographically tamper-evident audit trail

Planned

Upgrading append-only logging to a cryptographically verifiable, write-protected audit chain.

SOC 2 Type I

In preparation — not yet certified

Independent SOC 2 examination of our security controls. In preparation; no certification yet.

ISO 27001

In preparation — not yet certified

Information-security management certification. Control framework drafted; certification not yet held.

Accurate as of June 2026. This page is the single source for Dossio's security claims and is updated as roadmap items are delivered. Dossio (Dossio Pty Ltd, pending incorporation).