Security

We don't run our own servers. Client work runs on established platforms — Cloudflare, Supabase, Microsoft 365, Stripe — that hold independent security certifications such as SOC 2 and ISO 27001 and are monitored around the clock. That means patching, physical security and DDoS protection are handled by teams whose whole job is security.

• All our sites are served only over HTTPS (TLS), with modern security headers
• Data is encrypted at rest by our hosting and database providers
• Email we send is authenticated with SPF and DKIM, so it can't easily be spoofed in our name

Each client's data is walled off from every other client's. In shared databases we enforce this with row-level security, switched on from day one and checked with automated security advisors before release. Clients who need full isolation, or want to own their infrastructure outright, get their own dedicated project.

• Multi-factor authentication on every administrative account we use
• Access only for the people who need it, for as long as they need it
• Production data is never copied to personal devices or used for testing

• We never build our own password storage. Sign-in uses Supabase Auth, which hashes passwords with bcrypt and supports magic links, social sign-in and multi-factor authentication
• API keys and secrets live in encrypted secret stores — never in code, repositories, spreadsheets or email
• Forms are validated on the server and protected against spam bots, without puzzles for real people

Card details are entered directly into Stripe, which is PCI DSS Level 1 certified. We never see or store full card numbers.

Client databases on our managed hosting are backed up daily by the provider, and code lives in version control, so a bad change can be rolled back. We plan the exit for every project at kickoff, so a client can take their data and code with them at any time.

Where our systems use AI, we choose providers whose business terms say they don't train models on our data, we send only the information a task needs, and a person stays accountable for decisions that matter. Read more in section 8 of our Privacy Policy.

When something goes wrong, we follow the same four steps: contain the problem, assess who's affected, fix the cause, and tell the people who need to know. Where a breach is likely to cause serious harm, we notify affected people and the OAIC under the Notifiable Data Breaches scheme, and tell affected clients without undue delay.

Please tell us. Email security@nirmana.com.au with the details and steps to reproduce. We'll acknowledge you within 2 business days, keep you updated, and credit you if you'd like. We ask that you give us reasonable time to fix the issue before sharing it, don't access or change other people's data, and don't run tests that disrupt the service. We won't take legal action against good-faith research that follows these guidelines.