Security and data
How we look after your agency's records
Indium holds identity evidence, trust ledgers and client files. This page sets out what protects them today, and what we have not done yet.
What is in place
Each agency walled off at the database
Every table holding agency data carries the agency's organisation and is protected by Postgres row-level security. A query from one agency's account returns none of another agency's rows, whatever the screen asks for.
Data held in Australia
The database and file storage run in the Sydney region (ap-southeast-2). Agency records, documents and identity evidence are stored there.
A tamper-evident audit trail
Audit events cannot be edited or deleted once written. Each event is chained to the one before it with a hash, per organisation, so a gap or a change shows up when the chain is checked.
Two-step sign-in
Every staff account can turn on an authenticator app. Sign-in runs through our own server route, which locks an email for 15 minutes after 10 wrong passwords and gives the same answer whether or not the account exists.
Client links that expire
Buyers, vendors, owners and tenants never get an account. They use single-purpose links scoped to one matter and one person, with random tokens that expire.
Sign out everywhere
An office administrator can end every session for a person in their office from the security page.
Automated checks before every release
A test harness runs before each commit. It fails if a new database policy skips the organisation check, if a cron route is unguarded, or if a server route reads a session without the two-step check. Every push is also scanned for leaked secrets and vulnerable dependencies.
Browser protections
Every page is served with strict transport security, clickjacking protection, a referrer policy and a permissions policy that limits camera use to the identity selfie.
What we have not done yet
- Indium does not hold ISO 27001 or SOC 2 certification, and we do not claim either.
- An independent penetration test has not yet been done. It is being scoped with an outside security adviser.
- Two-step sign-in is available to everyone but not yet required by default. Requiring it for administrators and compliance officers is built and will be switched on with notice.
Last checked against our code on 19 October 2026. To report a security concern, email sam@indiumos.com.
Questions from your IT or compliance lead?
We will walk them through how Indium handles your data.