Effica security, privacy and AI

Security and privacy, built for sensitive care data.

Effica protects sensitive care and operational information using managed Google Cloud and Supabase services in Sydney, layered access controls, encryption, privacy-aware AI and tested recovery safeguards.

Version 1.8 | Reviewed 20 October 2026

Download PDFView PrivacyView Sub-processors

Effica security and privacy safeguards

Managed Sydney cloud foundation

Customer data is not hosted on office servers. Supabase provides the primary database, authentication, file storage and realtime services in Sydney. Google Cloud runs the web application, background processing, document OCR, secrets, recovery and Effica's own document search model in Sydney. Melbourne holds a live standby copy, about 30 seconds behind, and hourly backup copies.

Controlled access

Tenant separation, row-level security, role, branch and folder permissions, and audit trails restrict access to authorised users and activities. Two-step sign-in, with an authenticator app or a passkey, is required for staff on the web and the phone app from 20 October 2026.

Encryption and key management

Data is encrypted in transit and through infrastructure encryption at rest. Independent backup copies in Sydney and Melbourne each use a customer-managed key through Google Cloud KMS. Selected high-risk records receive additional application-level encryption.

Privacy-aware AI

AI follows user permissions and privacy settings. People review outputs and approve record changes. See our Privacy Policy for providers, data handling and retention.

Security governance and response

Code and configuration changes pass automated security checks, secret scanning, dependency monitoring and controlled release gates. Security findings are triaged according to risk. Documented incident procedures cover reporting, containment, assessment, recovery and customer or regulator notification where required.

Resilience and recovery

Point-in-time recovery covers 14 days, and a live standby database copy in Melbourne runs about 30 seconds behind. Backups are CMEK-encrypted, copied every hour from Sydney to Melbourne and kept 35 days in each region, files included. Effica has completed isolated recovery exercises from both regions.

Restricted Effica personnel access

Customer information may be accessed only by authorised Effica personnel who need it for their role in operating, supporting or securing the service. Administrative access is permission-scoped, and each Effica support visit to a customer account is recorded with the reason given.

A record of who did what

Effica keeps an activity record for your organisation: who did what, and when, naming the person or automatic process behind each entry. Personal and health details are hidden inside the change details. Effica's app and background services can only add entries, the only change allowed is hiding a value for privacy (and that change is recorded too), and entries are kept for 7 years. Owners, and auditors they invite, can search it, see what changed and export any period.

How your activity record is kept

Each statement here is tied to automated checks that run before every release or every night. A statement appears only once it is true in the live service.

  • Each entry names the person who did it, or the automatic process. Effica support is named too.
  • The record covers changes to your records, sign-ins, sensitive records and files being opened, and lists being exported.
  • Personal and health details are hidden inside the change details.
  • Effica's app and background services can only add entries. The only change allowed is hiding a value for privacy, and that change is itself recorded.
  • Entries are kept for 7 years.
  • Each time Effica support enters your account, the visit is recorded with the reason given, owners are told, and the visit ends on its own after 4 hours.
  • Owners, and auditors they invite, can search the record by person, record or date, see what changed, and export any period.
  • Each day Effica checks that recording is on and that these protections are in place, and Effica staff are alerted if a check fails.
  • Each day a fingerprint of the record is saved in a separate store, so a later change would show.
  • Server logs are kept for 12 months in Sydney and Melbourne.

Independent certification

AI Core CRM Pty Ltd, the company behind Effica, is certified to ISO/IEC 27001:2022 for the Effica platform (certificate SIS010725I048, SIS Certifications; next surveillance audit June 2027). Google Cloud, Supabase and AWS publish their own ISO/IEC 27001 and SOC 2 assurance, which apply to the suppliers' own service boundaries. Supabase publishes ISO/IEC 27001 and SOC 2 Type 2 assurance; Supabase's Sydney region runs on AWS infrastructure.

Where data sits, moves and expires

Sydney core

Core operational records are hosted in Australia. Supabase services, Google Cloud application, background and OCR services, and workflow orchestration are configured in Sydney; document search runs on Effica's own search model in Sydney. A live standby copy and backup copies are also kept in Melbourne.

Disclosed supporting services

See our Privacy Policy for service providers, processing locations and safeguards.

Lifecycle and requests

Effica supports requests for access, correction, export and deletion where available. Information is retained while needed to provide and secure the service, follow provider instructions and meet applicable legal, financial, safeguarding, audit and NDIS record-keeping obligations. Recovery copies expire through their backup schedules.

View PrivacyView Sub-processors

Need evidence for procurement or due diligence?

Ask us for the current sub-processor list, supplier trust material or help with a security questionnaire. Architecture and confidential evidence can be provided through an appropriate review process.

Request a security review