Security

How ShiftNote is secured, and what it is not

Written for the person running your security review. Every capability below carries a status, and the controls we do not have are listed in the same detail as the ones we do.

Last reviewed 4 September 2026. The full data-handling picture, including every subprocessor and where each one processes data, is on the trust centre.

Access controls

Row-level security on every table

Available

Access is enforced in the database itself, not only in application code. A worker can read only their own notes; a provider admin can read only their own organisation’s data.

Organisation roles: admin and member

Available

Claim import, claim-to-note matching and outcome capture are restricted to organisation admins. The exposure dashboard is open to any member. That is two roles, not a permission matrix — if you need finer separation between finance, quality and service delivery, it is not there yet.

Granular role-based access control

Planned

Separate finance, quality and service-delivery roles with per-area permissions. Not built.

Authentication

Email and Google sign-in with leaked-password protection

Available

Authentication is handled by Supabase Auth over the PKCE flow. Passwords are checked against known-breached password lists at sign-up and change.

Multi-factor authentication

Planned

Not available. Our auth provider supports it and we have not turned it on or built the enrolment flow. If MFA is a procurement requirement for you, say so — it moves up the list.

Encryption

Encrypted in transit and at rest

Available

All traffic is HTTPS. Data at rest is encrypted by our database and storage provider. We do not operate our own key management, and we do not offer customer-managed keys.

Logging and incident response

Structured request logging without note content

Available

API requests are logged with a request id, route and outcome. Note text and participant details are not written to logs.

A security contact that reaches a person

Available

Report a vulnerability to info@shiftnote.com.au and it reaches the person who can fix it. We are a small team; we will acknowledge within two business days.

Documented incident response and breach notification plan

In progress

We monitor errors and can revoke access and rotate credentials quickly. A written incident response plan with notification timeframes under the Notifiable Data Breaches scheme is being drafted and is not finished.

Organisation-visible audit log

Planned

Providers cannot yet see a log of who in their organisation did what. Note-level history is being recorded now (see record provenance); surfacing it as an organisation audit log is separate work.

Backups and resilience

Backups and a tested restore

In progress

Backups are taken by our database provider under the plan we hold. We have not published a tested restore procedure with a stated recovery objective, so we are not going to imply one exists.

Fleet-wide rate limiting

In progress

Rate limits are enforced per running instance rather than across the fleet, because the distributed rate-limit store is not configured. The public health endpoint reports this state rather than hiding it.

Reporting a vulnerability

We would rather hear it from you than from an incident.

  • Where: info@shiftnote.com.au, with “security” in the subject line.
  • Response: we acknowledge within two business days. We are a small team and will tell you honestly how long a fix will take rather than giving you a target we will miss.
  • What we ask: do not access, modify or exfiltrate data belonging to anyone else, and give us a reasonable window before disclosing publicly.
  • What we do not offer: a bug bounty. There is no payment, and we would rather say so than let you assume one.

What we do not have

If one of these is a hard requirement for your organisation, we are not the right vendor today. That is a better answer than finding out at contract stage.

ISO 27001 certification

We are not certified. There is no audit in progress.

SOC 2 Type I or II report

We do not have one and cannot provide one under NDA.

Penetration test report

No third-party penetration test has been commissioned.

Customer-managed encryption keys

Encryption keys are managed by our infrastructure providers. There is no BYOK option.

Single sign-on (SAML/SCIM)

Sign-in is email or Google. There is no enterprise SSO or directory provisioning.

Questions this page does not answer? Email info@shiftnote.com.au. We answer security questionnaires directly rather than routing them through a sales process.