How DeltaIQ protects your data
DeltaIQ is built for NDIS providers who handle sensitive participant information. This page is written for the IT and compliance teams evaluating us - concise and specific, not marketing copy.
Data location
All customer data - your database, your uploaded documents, the AI artefacts we generate from them - is hosted in Australia. Specifically: AWS (Sydney).
Edge requests are served via AWS CloudFront with geographic restrictions: only requests originating from Australia are served. Foreign traffic is blocked at the edge.
Encryption
Data is encrypted in transit using TLS 1.2 or higher - TLS 1.3 where the client supports it - on every internal and external connection. TLS 1.0 and 1.1 are refused.
Data is encrypted at rest using AES-256.
Access controls
DeltaIQ is multi-tenant by design but isolated at the database layer. Every table containing customer data has row-level security policies that scope reads and writes to the requesting user's provider.
Authentication
Two authentication paths, both yielding signed JWTs validated on every request:
- WorkOS for OAuth sign-in (used by enterprise customers with managed identity providers like Microsoft Entra ID).
JWTs use ES256 elliptic-curve signatures in production. Tokens are scoped to a single user profile and a single provider; a deactivated user's tokens stop working immediately.
Network controls
AWS Web Application Firewall sits in front of the application with AWS-managed rules covering the OWASP Top 10 - SQL injection, XSS, common bot patterns, known bad-IP lists.
Per-IP rate limiting blocks credential stuffing and basic scraping.
Response security headers - HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - grade A+ on securityheaders.com (last verified 2026-07-14).
Audit and AI provenance
Every AI-generated artefact in DeltaIQ - progress-note triage results, participant summaries, evidence packs - carries provenance metadata: which model produced it, when, against which inputs. AI artefact tables are write-once from the application layer; revisions create new versions.
All application activity is logged with structured fields. Personally identifying information is scrubbed from logs and error monitoring at the boundary.
Subprocessors
| Subprocessor | Purpose | Primary location |
|---|---|---|
| Amazon Web Services | Application hosting, file storage (S3) | Sydney (ap-southeast-2) |
| Supabase | Managed Postgres, authentication, file storage | Sydney |
| Anthropic | LLM inference. Customer data not used for model training, under Anthropic's commercial data terms. | United States |
| WorkOS | Identity | United States |
| Sentry | Application error monitoring. | United States |
Data ownership and exit
Customer data remains the property of the provider. DeltaIQ holds it under licence to deliver the service. On contract termination, the customer can request a full data export; data is then deleted from production systems within 30 days, and from backups in accordance with our standard backup retention cycle.
Contact
General security questions: security@deltaiq.com.au