Security & trust

1. Read-only by design

The single most important security property of this product is what it cannot do. Dashboard Solutions reads from ServiceM8, Xero and your mailbox and never writes back. There is no code path in the product that creates, edits or deletes a job, a quote, an invoice or a client in your source system. Even if someone got into your dashboard, they could not change your books or your job records from here.

2. How we connect

Connections use OAuth 2.0, the standard authorisation flow the platforms themselves provide. You approve the connection inside ServiceM8 or Xero, and we receive a scoped access token. We never receive, see or store your ServiceM8, Xero, Google or Microsoft password. Tokens are stored encrypted, refreshed automatically, and you can revoke them at any time from either side — access stops immediately when you do.

3. Separation between businesses

Each business's records are fenced off at the data layer, not just in application code, so a query for one account cannot reach another account's data. We do not pool your data with other customers' to build benchmarks or industry statistics, and we do not use it to train AI models. If we ever want to, we will ask you first, and no is a complete answer.

4. Who inside your business sees what

Money views — revenue, margin, invoicing, staff productivity — can be restricted to owners, while the office team gets the worklists they need and nothing more. That is a security feature as much as a product one: the fastest way to leak sensitive numbers is to show them to everyone by default.

5. Support access is approval-gated

We cannot open your dashboard whenever we like. If we need to see what you see, a request goes to the account owner naming the person asking and the reason, and nothing happens until you approve it. An approved session is read-only, expires within 24 hours, and can be revoked instantly. Every request, approval, refusal, expiry and revocation is recorded and shown to you in your own Settings page. Saying no never affects your service.

6. Infrastructure and encryption

Data is encrypted in transit with TLS and at rest. The platform runs on SOC 2 compliant managed cloud infrastructure, with automated backups and restore testing, audit logging of authentication and data access, least-privilege administrative access on our side, and dependency and vulnerability monitoring on our own code.

To be precise about a claim people often blur: our infrastructure providers hold SOC 2; Dashboard Solutions is not itself SOC 2 certified, and we will not imply otherwise. We are a small Australian company building carefully, not an enterprise vendor with a compliance department.

7. Where your data lives

Our platform and database infrastructure is currently located in the United States, so your data is stored overseas. We think you deserve to know that in one sentence rather than find it in clause 14 of something. Our obligations when data goes offshore, and the steps we take under Australian Privacy Principle 8, are set out in the Privacy Policy, and every provider is named on our subprocessor page. If an Australian region becomes available for our stack, we intend to move.

8. If something goes wrong

We have a documented incident response process. If there is an actual or suspected breach affecting your data, we notify the account owner within 48 hours of becoming aware, tell you what we know and what we are doing, and help you meet your own obligations. Where a breach is likely to cause serious harm we notify affected individuals and the OAIC under the Notifiable Data Breaches scheme. Full detail is in clause 10 of the Data Processing Addendum.

9. Responsible disclosure

If you find a security flaw, email info@dashboardsolutions.com.au with enough detail to reproduce it, and give us a reasonable chance to fix it before disclosing publicly. We will acknowledge within 2 business days, keep you updated, and we will not pursue anyone acting in good faith. Please do not test against another customer's account or run load or denial-of-service testing against production.

10. What we have not built yet

Being straight about the gaps is part of being trustworthy:

• We are not SOC 2 or ISO 27001 certified in our own right, and we have no penetration test report to hand you yet.
• Multi-factor authentication and single sign-on are on the roadmap, not shipped.
• There is no customer-facing status page yet; incident communication is by email.
• Data residency is United States, not Australia (section 7).

If any of these is a blocker for your business, tell us — it helps us prioritise, and we would rather know than lose you quietly.

11. Contact

Security questions, and requests for our security documentation: info@dashboardsolutions.com.au

SOLE ENTERPRISE PTY LTD (ACN 703 066 782), trading as Dashboard Solutions. Queensland, Australia.