Security

Your data is held in Australia. The application front-end and back-end, and all stored data, run within Australian data-centre regions. Tier-A sensitive information (identity and authority documents, signed agreements) does not leave Australia at rest.

Some limited operational processing happens overseas, disclosed in our Privacy Policy under APP 8: error monitoring and email delivery. Personal information is redacted at our application boundary before any error data leaves, and email is limited to envelope and routing information. Neither carries Tier-A documents.

All traffic to and from Senly Rent is encrypted in transit with TLS. Sensitive personal information is encrypted at rest with AES-256-GCM at the application layer, and the encryption keys are held outside the database, so a copy of the database alone does not reveal the protected fields. Production secrets live in encrypted secret stores and are never committed to source code.

Access to our administrative consoles is restricted and protected by multi-factor authentication. Every table enforces row-level security as a second layer of defence behind the application’s own access checks, so a request can only ever read or write the records the acting party is entitled to. Staff access follows the principle of least privilege and is logged.

The compliance record is append-only. Each attestation is attributed to a named person, timestamped, and sealed into a hash-chained ledger, so the history cannot be quietly rewritten. A late certificate is logged late; nothing back-fills. This is what lets a record answer a question about a past date years later.

We monitor the service for errors and abuse. Application logs use structured fields and reference records by identifier, not by name or email, so personal information is not written into free-text log lines. Error reports are scrubbed of personal information at our application boundary before they are sent to our error-monitoring provider.

We maintain an incident-response runbook aligned with the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)). If an eligible data breach occurs, we contain it, assess it, and notify affected individuals and the Office of the Australian Information Commissioner as required, and within 30 days of becoming aware.

Use a unique, strong password and keep your sign-in details private. Only share a compliance record link with people you intend to see it, and revoke a link if it may have leaked. Tell us straight away if you think your account has been accessed without your permission.

If you believe you have found a security vulnerability, please email security@senly.ai. We investigate every report and will acknowledge yours. Please give us a reasonable opportunity to resolve an issue before disclosing it publicly.

Operator: Uinspo Pty Ltd, ABN 47 664 833 872, trading as SenlyAI.