Security and Trust

Hosting and data location

Standard Essentials, Professional and Scale subscriptions run on commercial enterprise cloud infrastructure in the Asia-Pacific region. Website content is delivered through a global network for speed.

Government agencies, defence sector providers and organisations with mandatory IRAP, ISM or regulated requirements must use the Enterprise / Custom plan, which provides tailored hosting, IRAP/ISM alignment and custom SLAs agreed in writing.

Checkmate is not itself IRAP-assessed or certified. See our Privacy Policy for how cross-border disclosure is handled.

Encryption

Data is encrypted in transit over HTTPS and encrypted at rest by our hosting providers. Uploaded files are private and are shared only through short-lived signed links.

Tenant isolation and access control

Every customer organisation is logically isolated. Database-level row security ensures users can only read and change their own organisation's records.

Role-based access (administrator, compliance manager, editor, viewer, audit lead) limits what each person can do. External auditors and suppliers receive expiring, single-purpose links rather than accounts.

Sign-in

Checkmate is invitation only, with no public sign-up. Customers can enable Microsoft 365 (Entra ID) single sign-on or SAML 2.0 providers such as Okta, once activated by CNETS.

Backups, logging and resilience

Our hosting providers perform automated backups of the platform database. Key actions such as approvals, plan changes and sign-on changes are recorded in an audit log. Customers should still keep their own copies of important records.

AI processing

The AI Assistant and quiz generator send only the content needed for the request to our AI service provider through secure APIs. Customer content is not used by CNETS to train public AI models. AI output is a draft and must be reviewed.

Subprocessors

Cloud hosting, database and file storage provider (platform hosting).

Transactional email provider (invitations, notices and summaries).

AI service provider (AI Assistant and quiz generation).

Microsoft and SAML identity providers chosen by the customer (single sign-on).

A current list with provider names is available to customers on request.

Enterprise agreements

Enterprise and Custom customers can request a security questionnaire response, a Master Services Agreement, a Data Processing Agreement and a dedicated SLA. Contact provisioning@cnets.com.au.

Reporting a security issue

Please report suspected vulnerabilities or incidents to privacy@cnets.com.au. We will acknowledge and investigate promptly.