Built to withstand examination.
Every security claim we make maps to a test, a database invariant or a recorded browser proof, not to marketing copy.
Compliance software holds some of a practice’s most sensitive records. These are the controls that protect them, each backed by our engineering evidence base.
Controls
Enforced practice isolation
Practice records are separated with database-enforced row-level security. Tenant-isolation tests cover access across practices, alongside application-level permission checks.
Protected sign-in and sessions
Every user signs in with a personal password protected by progressive lockout. Sessions expire on inactivity and are individually revocable, and each practice keeps its own staff and session records.
Tamper-evident audit trail
Every material action is recorded in a hash-chained audit log, so the history of a client file can be verified rather than asserted.
Restricted suspicious-matter workspaces
Suspicious-matter records are isolated from staff without an explicit grant. They do not appear in searches, work queues or audit views for unauthorised users.
Retention aligned to obligations
Evidence records carry seven-year retention aligned to AML/CTF record-keeping obligations, with deletion denied at the database privilege level.
Controlled external-service evidence
External-service results retain their evidence source and verification tier. A controlled test result can never satisfy a real compliance requirement; the database enforces it.
Australian production data plane
Practice compliance records and uploaded evidence files are stored in PostgreSQL, which runs with the application on a Linode server in Australia.
Infrastructure
The production PostgreSQL database, including uploaded evidence bytes, and the application both run on a Linode server in Australia. Connections are encrypted in transit and managed storage is encrypted at rest. Workspace changes require authenticated, authorised requests. Public account and enquiry forms validate submitted data and apply rate limits and origin checks. Internal service endpoints fail closed when credentials are absent.
Data locations and subprocessors
- Linode: the application and its PostgreSQL database, including evidence files, run on a server in Australia.
- Postmark: transactional-email recipient, message and delivery metadata is processed in the United States. Cassandra AML disables tracking pixels and tracked links and does not retain plaintext live email bodies in its database.
- Didit, NameScan, ABR and Stripe: identity verification, PEP and sanctions screening, ABN lookup and billing receive only the data required for a transaction an authorised user starts. Controlled test data does not make a live-provider claim.
Responsible disclosure
If you believe you have found a security vulnerability, email support@cassandraresearch.com. Please include enough detail to reproduce the issue and allow us reasonable time to remediate before public disclosure. We do not take legal action against good-faith research conducted within these guidelines.