Security and your data

Where things are kept

• Your ledger (invoices, claims, payments, providers) is in a database in Sydney, Australia (Amazon RDS), encrypted at rest, with daily backups kept seven days.
• Invoice files (PDFs, photos, the emails they arrived in) are in Sydney, Australia (Amazon S3), private, encrypted at rest.
• Email we send goes out from Sydney (Amazon SES).
• The app itself runs on Cloudflare's network, which serves you from the nearest location — usually Australia, not guaranteed. Nothing is stored there.

What leaves Australia

To read an invoice, we send that document to Anthropic's API, whose servers are in the United States. Under their API terms, what we send is not used to train models and is kept only briefly for abuse monitoring. If that is not acceptable for you, don't use the forwarding address — you can add invoices by hand and nothing is sent anywhere.

Bank details

• A provider's BSB and account number are encrypted field by field (AES-256-GCM) with a key that is not in the database, and bound to that provider's record so a value cannot be moved to another.
• They are never written to logs or error reports.
• Every time a decrypted value is shown, it is recorded in your account's history.
• A change to a provider's bank details on an invoice is never applied automatically: the provider confirms from their own sign-in, and you confirm by a second channel, before a cent goes to the new account.

Email

• Your forwarding address is a secret. Mail from a sender you haven't approved is held, not read, until you say so. You can change the address at any time.
• Attachments are stored as-is, never run, and served in a way that cannot execute anything. We don't scan for malware; we don't open files, and neither should you unless you know the sender.
• When an email links to an invoice instead of attaching it, we fetch the file from that link over HTTPS only, never from private addresses, and keep only a PDF.

Sign-in

No passwords. A six-digit code goes to your email; five wrong guesses burns it. A support worker's identity is the email on their invoices — their sign-in shows only their own invoices, never your plan or other providers' details.

Keeping and deleting

• Invoice files are deleted 90 days after the provider is paid; raw emails after 30.
• The ledger itself is kept while your account exists.
• You can export everything, free, from Account — and delete the account, which removes the ledger, every file and every provider's bank details immediately.

What Sortaroo never does

• Hold, move or touch money.
• Log in to, submit to, or read from the NDIS portal or myGov.
• Sell or share your data, or use it for advertising.