What we actually do to protect your data.

Where does your data live?

• Register data, accounts and SDS files are stored in Sydney, Australia.
• The application runs in Sydney. This website's pages are served from a global content network, which is normal for websites and doesn't move your data.
• Transactional email (sign-up confirmation, invitations, notifications) is sent through an email provider whose servers for our account are in Japan. Email addresses and message content pass through that service. The Privacy Policy names it.

Who can see what?

• Every database table has row-level security switched on and forced. A person signed in to one company can read that company's rows and nothing else. An automated test suite sweeps every table as three different attackers, and fails the build if any table is missing a policy.
• Default deny. Anonymous visitors have no table access at all. The public QR register page returns a short, fixed list of fields: product, brand, location, the register's public label and the SDS details. Never account data.
• Manufacturers never see which workplaces hold their products, or how many. That is a database rule, not a screen setting.
• SupplySafe staff work in a separate operator console. Staff access is a specific grant, never a company role, and every staff action is marked in the audit trail.

Signing in

• Passwords are at least 12 characters, checked against known leaked-password lists, and email confirmation is required.
• Owners and admins must complete two-step verification (an authenticator app) before they can publish an SDS, invite people or change roles. The database refuses those actions from a session that hasn't, so a stolen password alone can't do them.
• Invitations are single-use, expire, and are bound to the invited email address.
• Sign-up, sign-in and password reset are protected by a bot check.

SDS files and links

• SDS PDFs sit in private storage. There are no public file URLs.
• Every download link is minted for one request and expires after 60 seconds.
• QR posters and product links point to a permanent SupplySafe address, never to the file. When an SDS is replaced, the poster keeps working.

Nothing gets rewritten

• Published SDS cannot be edited or deleted. A new revision replaces the current one through an explicit, confirmed step; the previous revision stays in the history.
• The audit trail is append-only. Every publish, verification, correction, role change and register change is recorded. Nobody can edit or delete those records, including SupplySafe staff.
• We never edit a manufacturer's PDF.

Backups

• Our database provider takes daily backups of the production database.
• We also keep our own nightly encrypted copy of the database and every SDS file, stored off the main platform, with seven daily and four weekly copies.

What don't we collect?

We store what a chemical register needs and nothing about your commercial history. We don't store invoices, prices, quantities, margins, payment data or purchase history.

This website

• HTTPS everywhere, with HSTS and a strict content security policy.
• No cookies, no analytics, no advertising trackers.
• No sign-in form on this website. Sign-in happens only at app.supplysafe.com.au.

Reporting a security issue

If you find a security problem, email hello@supplysafe.com.au with "Security report" in the subject and we will reply within two business days. Please don't test against other people's data.