Security
How FoodSafety HQ protects your food safety data: encryption in transit and at rest, role-based and venue-scoped access, managed backups, security headers, our service providers, and how we handle data breaches.
Our approach
FoodSafety HQ is a software-only platform run by Toradigm Pty Ltd (ABN 70 679 136 577). We build security in rather than bolt it on: least-privilege access, encryption, managed infrastructure and audit trails are part of how the product works. We aim to be clear about what we do and honest about what we do not yet do.
Encryption
Data is encrypted in transit using HTTPS/TLS across the Platform, and at rest by our database and storage providers. HTTPS is enforced site-wide with HSTS, so traffic is not served over plain HTTP.
Hosting & data location
The Platform runs on managed cloud infrastructure. Some providers store and process data outside Australia, notably in the United States; where data is processed overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles (APP 8), including contractual protections. We do not claim local-only hosting.
Access control
Role-based access (staff, manager, admin) so users get only the permissions their role needs; venue-scoped data so a user only sees the venues they are assigned to; append-only amendment history on sensitive records such as individual dietary plans; and passwords stored hashed, never in plain text.
Backups & reliability
We run on managed, redundant infrastructure with automated backups, so records are protected against accidental loss. Compliance records are timestamped and append-only by design, supporting both reliability and audit integrity.
Application & network security
HTTPS enforced site-wide with HSTS, a Content-Security-Policy and other security response headers, rate limiting on authentication and public endpoints, and server-side tenancy checks on data access. Payment card details are entered directly with Stripe and are never stored on our servers.
Service providers (subprocessors)
We use a small set of reputable providers under contract and only to deliver the service: Vercel (application hosting), Neon (managed database), Vercel Blob (file and photo storage), Stripe (payment processing) and Resend/SMTP (transactional email). The current list is maintained in our Privacy Policy.
Data breach response
We maintain procedures to detect, contain and assess security incidents. If a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.
Your responsibilities
Security is shared: use a strong, unique password and keep your credentials confidential; invite only the people who need access and give each the lowest role that fits; remove team members promptly when they leave; and keep any sensitive records you store to the minimum you need.
Certifications & roadmap
We build to recognised security practices, but we want to be straight: FoodSafety HQ is not yet certified to a formal standard such as ISO 27001. As we grow, and to support procurement in the aged care, NDIS and childcare sectors, we intend to pursue formal certification, and will update this page when that status changes.
Reporting a security issue
If you believe you have found a security vulnerability, email hello@foodsafetyhq.com.au with the details. We take reports seriously, will acknowledge your report, and ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure.