Enterprise Trust & Privacy

Bank-Grade Security Built Into Every Layer

At GloProx, security is not an afterthought or an add-on. We designed our architecture from the ground up to protect your sensitive financial records with defense-in-depth isolation.

PostgreSQL Row Level Security (RLS)

Data isolation is enforced at the database engine level. Even if an application bug occurred, a customer's query cannot physically return records belonging to another company.

Explicit SELECT, INSERT, UPDATE, and DELETE policies on every table

Company membership checks verified via cryptographic JWT sessions

Staff can query only explicitly assigned companies

Zero Public Storage & Signed URLs

GloProx document buckets are 100% private. Files cannot be discovered, enumerated, or viewed without an authenticated, expiring cryptographic signature.

Physical storage keys use immutable UUIDs, masking original filenames

Signed download URLs expire in 60 seconds

Multi-file ZIP backups reconstruct virtual folder hierarchies securely on the fly

Multi-Factor Authentication (MFA)

All internal GloProx accountants, squad leaders, and platform administrators must authenticate via mandatory TOTP Multi-Factor Authentication.

Enforced hardware/authenticator app MFA for staff

HTTP-only, SameSite=Lax secure cookies prevent script-based token extraction

Automatic session termination upon prolonged inactivity

Strict Human-in-the-Loop AI Guardrails

Our AI assistant operates under strict sandboxes. It never executes raw SQL, never accesses document file contents in early phases, and cannot mutate records without explicit customer confirmation.

Zero unassisted record creation or booking mutations

Deterministic server-side tool permissions

Customers can permanently delete their conversational memory at any time

Continuous Audit Trail & Event Logging

Every document upload, download, permission change, and task status transition is logged to an immutable PostgreSQL activity ledger.

Actor profile ID, IP address, timestamp, and resource metadata logged

Zero sensitive document contents or passwords recorded in application logs

Real-time alerts triggered on unusual access spikes

Australian Privacy Principles (APP) Aligned

Our operational policies and infrastructure are architected in full alignment with the Privacy Act 1988 (Cth) and Australian Privacy Principles.

Australian data sovereignty options with local database hosting

Strict data retention and soft-deletion recovery workflows

Formal Mutual NDAs provided to every client organization

Data Governance & Compliance

Questions About Our Compliance Framework?

Our Chief Information Security Officer and compliance team regularly assist enterprise IT and internal audit departments with vendor risk assessments, data flow diagrams, and SOC2/ISO 27001 control mapping.