Trust, transparency, and compliance

Annex A controls library implemented; row-level security on every database table, TOTP MFA, scoped admin access via warroom_admins, mission audit log, and security_audit_log table. Certification target Q4 2026.

MFA enforced via Supabase TOTP, application control via row-level security, restricted admin privileges via warroom_admins table, regular patching cadence, daily backups via Supabase PITR. Maturity Level 2 across the eight controls.

Govern via Compliance Navigator advisor; Identify via Mission Gap Radar; Protect via security_audit_log + RLS; Detect via real-time mission audit; Respond via tactical execution tracker; Recover via Supabase PITR backups.

AI risk register, advisor instruction governance via admin panel, mission audit log capturing every AI interaction, prompt-injection guardrails, and de-identified output review process.

Information-security capability commensurate with size and complexity, incident reporting via security@fortecyberx.au within 72 hours, and annual control testing aligned to APRA expectations.

Critical infrastructure obligations mapped via Compliance Navigator advisor; mandatory incident reporting workflows and risk-management programme documentation supported.

APP 1–13 alignment; OAIC complaint pathway documented; full disclosures in our Privacy Policy.

EU/UK addendum in Privacy Policy; DPA available on request; lawful basis register maintained for EU/UK data subjects.