← Back to Trust CentreDownload as PDF
    PlanEase

    Security & Compliance

    Security & Compliance Overview

    How PlanEase keeps Queensland council and applicant data secure, private, and hosted in Australia. Prepared for vendor evaluation.

    PlanEase Pty Ltd · ABN 81 694 215 506 · planease.net · Reviewed 2026-07-20
    Confidential: prepared for evaluation. Indicative self-assessment, not an independent certification.

    Executive summary

    PlanEase is an Australian SaaS platform for managing development-application (DA) conditions in the Queensland planning system. All customer data is hosted in Australia on Amazon Web Services (Sydney), encrypted in transit and at rest, with each tenant's data isolated by server-enforced access control on every request.

    This document summarises our security controls, sub-processors, availability, and the governance posture a council procurement team typically assesses. Detailed documentation (privacy policy, sub-processor register, incident-response plan, and a data processing agreement) is available to prospective councils on request.

    Data residency & encryption

    • Hosted entirely in AWS ap-southeast-2 (Sydney). AWS holds a current ISO/IEC 27001 certification for the infrastructure layer.
    • Encrypted at rest (S3 server-side encryption, DynamoDB encryption) and in transit (TLS 1.2+ with HSTS).
    • The only data received outside Australia is inbound email (an AWS SES regional constraint) and optional Microsoft single sign-on identity.

    Access control & tenant isolation

    Every read and write passes through a single, centrally-enforced authorisation check before any data is returned. A caller can only ever reach data their identity is explicitly entitled to; a mismatch returns zero records. Isolation is enforced in server-side code and AWS configuration, not in the browser.

    • Role-based access (super-admin, admin, contributor, viewer), with company admins scoped to their own company.
    • Sign-in via AWS Cognito and optional Microsoft single sign-on; least-privilege IAM across all services.
    • Production and non-production run as fully separate environments (separate data stores and identity pools).

    Sub-processors

    Third parties that process data on PlanEase's behalf, with the region in which they process it:

    Sub-processorPurposeRegion
    Amazon Web ServicesHosting, storage, database, AI, email, authenticationAustralia (Sydney, ap-southeast-2)
    Microsoft (Entra ID)Optional single sign-onGlobal (Microsoft)
    PostHogProduct usage analyticsUnited States
    Amazon SES (inbound)Inbound project email receiptUnited States (us-east-1)

    Availability & resilience

    • Target monthly uptime of 99.5%, with a live public status page at status.planease.net.
    • Continuous backups: DynamoDB point-in-time recovery across 27 tables (35-day window) and S3 object versioning.
    • Audit and access logging via AWS CloudTrail, API Gateway access logs, and an in-application audit trail.

    Compliance posture & roadmap

    Live

    Application-security hardening20+ fixes (access control, tenant binding, SSRF, email authentication) shipped to production.
    Australian data residencyHosted in AWS Sydney; encrypted at rest and in transit (TLS/HSTS).
    Tenant isolationEnforced server-side on every request; Cognito + Microsoft SSO sign-in.
    Continuous backups & audit loggingPoint-in-time recovery across 27 tables, CloudTrail, API access logs.
    Public Privacy PolicyLive and aligned to the Australian Privacy Principles.
    Public status page & uptime monitoringLive uptime monitoring of the app, API, and website, with a public status page at status.planease.net.
    Sub-processor registerEvery third party, region and purpose.
    Tenant-isolation statementHow each council's data is kept isolated from every other tenant.
    Data retention & deletion policyRetention periods set; data frozen on offboarding, deleted on written request.
    Incident Response & data-breach planAligned to the Notifiable Data Breaches scheme; operational.

    In progress

    Data Processing AgreementBinds PlanEase under the Qld Information Privacy Act.
    SLA & disaster-recovery commitments99.5% uptime; near-zero data-loss recovery (PITR); 4-hour recovery validated by a restore drill. Off-region backup remains.

    Roadmap

    ISO 27001Roadmap drafted; certification decision pending.
    Customer-facing exportable audit trailFor councils' Public Records obligations.
    Independent penetration testExternal, on an annual cadence.
    WCAG 2.1 AA accessibility auditLeading to a published conformance statement.

    Privacy & legal

    • Public Privacy Policy aligned to the Australian Privacy Principles (planease.net/privacy).
    • When engaged by a Queensland council, PlanEase is bound as a contracted service provider under the Information Privacy Act 2009 (Qld).
    • Incident-response and data-breach plan aligned to the Notifiable Data Breaches scheme; a data processing agreement is available for council contracts.

    Contact

    Security and compliance enquiries: support@planease.net.

    This overview is an indicative self-assessment of PlanEase's posture on the evidence to date. It is not an independent certification, audit, or legal advice. Reviewed 2026-07-20.

    planease.net · Security & Compliance Overview
    We use cookies to improve your experience and analyse site usage. Learn more about our privacy policy