Security Policy

1. Purpose and scope

This Security Policy describes the safeguards we apply to the systems, applications, and information assets we operate, and to the personal and confidential information we hold in the course of providing our services. It applies to all information processed by us, whether received from clients, generated in the course of an engagement, or relating to our own operations.

This Policy governs our own controls and conduct. It does not impose obligations on any third party, and it does not vary the terms of any engagement, agreement, or non-disclosure undertaking we have entered into. Where a written agreement with a client specifies security obligations that exceed those described here, that agreement prevails to the extent of any inconsistency.

2. Governance and responsibility

Maxwell Vidler is the accountable owner of information security for UniMatter. As a sole operator, Maxwell Vidler holds direct responsibility for the design, implementation, operation, and review of the controls described in this Policy, and for decisions affecting the security of the information we hold.

Security matters, including questions about this Policy and the reporting of a security concern, may be directed to our security contact at security@unimatter.com.au.

3. Our risk-management approach

We take a risk-based approach to security. We identify the information assets we hold and the threats to which they are exposed, assess the likelihood and consequence of those threats materialising, and apply controls that are proportionate to the sensitivity of the information and the risk presented. Given the legal, clinical, and compliance contexts in which we operate, we treat client information, personal information, and health information as warranting heightened protection.

We keep our assessment of risk under review and adjust our controls as our systems, our engagements, and the threat environment change. Where a residual risk cannot be eliminated, we manage it deliberately rather than ignore it.

4. Data protection

We protect information in transit and at rest:

• In transit. Information transmitted to and from our systems is encrypted in transit using Transport Layer Security ('TLS') or an equivalent contemporary protocol.
• At rest. Where applicable, information stored within our systems is encrypted at rest using industry-standard algorithms, subject to the capabilities of the underlying platform and the nature of the storage.

We apply the principle of 'data minimisation': we collect and retain only the information that is necessary for the purpose for which it is processed, and we retain it only for as long as that purpose, or an applicable legal or professional obligation, requires. Information that is no longer required is disposed of securely.

5. Access control

We control access to information on the principle of 'least privilege', granting access only to the extent necessary for a legitimate purpose:

• Access to systems and information is restricted to authorised use and is granted on a need-to-know basis.
• We use strong authentication and enable multi-factor authentication ('MFA') on accounts and services where it is available and appropriate.
• Credentials are managed securely, are not shared, and are stored using a dedicated credential-management tool rather than in plain text. Credentials are rotated, and access is revoked, where circumstances warrant.

6. Infrastructure and hosting

We host our systems and data with reputable cloud and infrastructure providers selected for their security posture and operational maturity:

• The website is a static site hosted by Vercel Inc. and served from Vercel's global edge network; our email is provided by Microsoft 365 (Exchange Online). These providers may process data on infrastructure located in the United States and other jurisdictions.
• We rely on the network controls afforded by our providers and our own configuration, including firewalling and restriction of network access to that which is required.
• We maintain segregation between environments and between data sets where appropriate, so that systems and information are not commingled beyond what their purpose requires.

7. Application security

Where we develop or configure applications, we apply secure-development practices:

• We follow secure-coding and secure-configuration practices and address security as part of the development process rather than as an afterthought.
• We manage dependencies and apply patches and updates to software and libraries in a timely manner, prioritising security-relevant updates.
• We test changes before release, and we do not deploy changes to production without appropriate review and verification.

8. Logging and monitoring

We maintain logging across our systems to record relevant security events and to support the detection of, and response to, anomalous or unauthorised activity. We monitor for indicators of compromise to the extent our tooling and our providers permit, and we retain logs for a period appropriate to their purpose. Logs are themselves treated as sensitive and are protected accordingly.

9. Third-party and sub-processor management

We engage third-party providers and 'sub-processors' to support the delivery of our services, including the infrastructure and hosting providers referred to above. Where we do so:

• We conduct due diligence proportionate to the sensitivity of the information the provider will handle and the criticality of the service.
• We seek contractual safeguards addressing confidentiality, security, and the handling of personal information, including, where applicable, obligations consistent with our own under this Policy and at law.
• We do not engage a provider whose security posture we consider inadequate for the information concerned.

The providers we rely upon are addressed further in our Privacy Policy.

10. Incident response and breach notification

We maintain a process for responding to security incidents. On becoming aware of a suspected or actual incident, we act to contain it, to assess its nature and scope, to remediate the underlying cause, and to record the incident and the steps taken.

Where an incident involves personal information and meets the threshold of an 'eligible data breach', we comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth), including assessment of suspected eligible data breaches and, where required, notification to affected individuals and to the Office of the Australian Information Commissioner. Where we act for a client whose information is affected, we coordinate with that client in accordance with our engagement and our respective obligations.

This clause operates together with our Responsible Disclosure Policy, under which a person may report a vulnerability or a suspected security concern to us. Reports received under that Policy are triaged and, where they indicate an incident, are escalated into the process described in this clause.

11. Business continuity and backups

We maintain backups of critical data so that information can be restored in the event of loss, corruption, or system failure. Backups are protected consistently with the information they contain. We take reasonable measures to enable the continuity and recovery of our services, proportionate to the scale of our operations, and we review our recovery arrangements periodically.

12. Personnel and confidentiality

UniMatter is operated by Maxwell Vidler as a sole operator. Maxwell Vidler is bound by professional, contractual, and legal obligations of confidentiality, and treats all client and personal information as confidential. Where we engage contractors or collaborators in the course of an engagement, we require them to be bound by confidentiality obligations and to handle information consistently with this Policy before they are given access to it.

13. Compliance and frameworks

We align our practices with recognised information-security frameworks, including the Australian Cyber Security Centre's 'Essential Eight' and 'ISO/IEC 27001', and we have regard to the NIST Cybersecurity Framework. We use these frameworks as references against which to structure and measure our controls.

Alignment with a framework is not the same as certification against it. We do not claim certification, accreditation, or independent attestation against any framework. UniMatter does not currently hold third-party certifications; the controls we operate, and their current state, are disclosed through the Trust Centre at /trust.

14. Privacy

This Policy concerns the security of information. The manner in which we collect, use, disclose, and otherwise handle personal information, and our obligations under the Privacy Act 1988 (Cth), are addressed in our Privacy Policy, which should be read together with this Policy.

15. Review and assurance

We review this Policy and the controls it describes annually, as well as following any material change to our systems, our services, or the threat environment, and following any significant security incident. Review is the means by which we keep our security practices current and aligned with the frameworks referred to in clause 13.

16. Reporting a security concern

We welcome reports of security vulnerabilities and concerns. If you believe you have identified a vulnerability in, or a security concern affecting, our systems or services, please report it in accordance with our Responsible Disclosure Policy, which sets out how to make a report, what to include, and what you may expect from us in response.

Reports may be directed to our security contact at security@unimatter.com.au. We ask that vulnerabilities not be publicly disclosed until we have had a reasonable opportunity to investigate and respond.

17. How to contact us

Questions about this Policy, or about the security of information we hold, may be directed to:

• Maxwell Vidler trading as UniMatter
• Level 1, 16 McDougall Street, Milton, Queensland 4064, Australia
• Security contact: security@unimatter.com.au
• General contact: administrator@unimatter.com.au

This Policy is governed by the laws of Queensland, Australia.