Effica security, privacy and AI
Effica protects sensitive care and operational information using managed Google Cloud and Supabase services in Sydney, layered access controls, encryption, privacy-aware AI and tested recovery safeguards.
Version 1.7 | Reviewed 6 October 2026
Customer data is not hosted on office servers. Supabase provides the primary database, authentication, file storage and realtime services in Sydney. Google Cloud runs the web application, background processing, document OCR, secrets, recovery and Effica's own document search model in Sydney. Melbourne holds a live standby copy, about 30 seconds behind, and hourly backup copies.
Tenant separation, row-level security, role, branch and folder permissions, and audit trails restrict access to authorised users and activities. Two-step sign-in, with an authenticator app or a passkey, is required for staff on the web and the phone app from 20 October 2026.
Data is encrypted in transit and through infrastructure encryption at rest. Independent backup copies in Sydney and Melbourne each use a customer-managed key through Google Cloud KMS. Selected high-risk records receive additional application-level encryption.
AI is optional and follows each user's permissions. Your organisation's AI switch stops all in-app AI. While a participant's switch is off, AI features linked to their record are refused and Effie will not name them. Customer data is not used to train AI models. Most AI requests go to OpenAI under a signed data processing agreement. Effica Shield first hides 10 kinds of ID, card and bank numbers, not names or care details. People review important decisions.
Code and configuration changes pass automated security checks, secret scanning, dependency monitoring and controlled release gates. Security findings are triaged according to risk. Documented incident procedures cover reporting, containment, assessment, recovery and customer or regulator notification where required.
Point-in-time recovery covers 14 days, and a live standby database copy in Melbourne runs about 30 seconds behind. Backups are CMEK-encrypted, copied every hour from Sydney to Melbourne and kept 35 days in each region, files included. Effica has completed isolated recovery exercises from both regions.
Customer information may be accessed only by authorised Effica personnel who need it for their role in operating, supporting or securing the service. Administrative access is permission-scoped, and each Effica support visit to a customer account is recorded with the reason given.
Effica keeps an activity record for your organisation: who did what, and when, naming the person or automatic process behind each entry. Personal and health details are hidden inside the change details. Effica's app and background services can only add entries, the only change allowed is hiding a value for privacy (and that change is recorded too), and entries are kept for 7 years. Owners, and auditors they invite, can search it, see what changed and export any period.
Each statement here is tied to automated checks that run before every release or every night. A statement appears only once it is true in the live service.
AI Core CRM Pty Ltd, the company behind Effica, is certified to ISO/IEC 27001:2022 for the Effica platform (certificate SIS010725I048, SIS Certifications; next surveillance audit June 2027). Google Cloud, Supabase and AWS publish their own ISO/IEC 27001 and SOC 2 assurance, which apply to the suppliers' own service boundaries. Supabase publishes ISO/IEC 27001 and SOC 2 Type 2 assurance; Supabase's Sydney region runs on AWS infrastructure.
Sydney core
Core operational records are hosted in Australia. Supabase services, Google Cloud application, background and OCR services, and workflow orchestration are configured in Sydney; document search runs on Effica's own search model in Sydney. A live standby copy and backup copies are also kept in Melbourne.
Disclosed supporting services
Some disclosed supporting services may process limited information overseas for specific purposes, including AI requests and email delivery. Effica discloses these services and applies data minimisation, access controls, contractual protections and security safeguards appropriate to each service.
Lifecycle and requests
Effica supports requests for access, correction, export and deletion where available. Information is retained while needed to provide and secure the service, follow provider instructions and meet applicable legal, financial, safeguarding, audit and NDIS record-keeping obligations. Recovery copies expire through their backup schedules.
Ask us for the current sub-processor list, supplier trust material or help with a security questionnaire. Architecture and confidential evidence can be provided through an appropriate review process.
Request a security review