The procurement pack
This is the starting point for a security or procurement review of First Six. It pulls the whole assessment bundle into one place and sets out what is in place today and what is still ahead.
Where something isn't in place yet, you'll find it named below with the plan attached, rather than an optimistic "yes" that a pen test would contradict.
Ask your First Six contact for the procurement pack and we share it under NDA: the pre-filled HECVAT-Lite responses, the subprocessor list, the incident- and disaster-recovery summaries, and the crisis-detection boundary. Or complete your own questionnaire. Whichever your team prefers.
Who you're contracting with
First Six is operated by First Six Technologies Pty Ltd (ACN 699 938 817, ABN 19 699 938 817), a company registered in Queensland, Australia. That is the entity that signs the service agreement and Data Processing Agreement, and the data processor named throughout this pack.
What's in the pack
| Document | What it answers | Where |
|---|---|---|
| HECVAT-Lite responses | The standard vendor security questionnaire, pre-filled and current | HECVAT and vendor reviews |
| Data residency + isolation | Where data lives, how it's encrypted, how tenants are kept apart | Data residency and tenant isolation |
| Subprocessor list | Every third party that touches data, what they see, where they're hosted | Subprocessors |
| Incident response | What happens if data is exposed, and the notification clock | Breach and incident response |
| Disaster recovery | Backup posture, recovery objectives, and the last restore drill | Summarised below |
| Crisis-detection boundary | What the automated crisis detection does, and where the institution's duty of care begins | Summarised below |
The short version
First Six meets or exceeds the technical controls a standard HECVAT looks for: encryption, single sign-on with institution-enforced MFA, row-level tenant isolation, append-only audit logging, data minimisation, and a documented breach process.
The open items are independent attestation and process maturity: the kind of thing that takes an external audit or time as a company, not an engineering change. We propose those as milestones for a pilot rather than blockers.
Headline answers
| Area | Status |
|---|---|
| Data residency (Australia, AWS Sydney) | Yes |
| Encryption in transit and at rest | Yes |
| Single sign-on with institution-enforced MFA | Yes |
| Row-level tenant isolation on every table | Yes |
| Append-only audit logging | Yes |
| Data minimisation with small-cell suppression | Yes |
| Student data used to train AI | No |
| Right to erasure and data export | Yes |
| Accessibility Conformance Report (VPAT 2.5, self-assessed) | Published 3 August 2026; sent alongside the pack, ask for it by name |
| SOC 2 / ISO 27001 | On the roadmap |
| Third-party penetration test | Planned (happy to make it contractual) |
| Data Processing Agreement | Yes: a signable template, current as at 13 August 2026, shared with the pack |
| Cyber insurance | Yes, in force since 16 August 2026: $2M cyber, $10M professional indemnity, $20M public and products liability |
| Separate prod / non-prod environments | Yes, enforced in code: preview and development builds run against the non-production project, and a deployment that is not production refuses to build against the production database |
Data handling
- What we store: student name, email, and program; weekly check-in sentiment, plus the student's stated reason for a hard week (visible to their support staff on the audited per-student profile, and disclosed to the student at collection); and help or welfare requests. No passwords (sign-in is delegated to your identity provider), no payment data, and no health records beyond what a student self-reports in a wellbeing message.
- Residency: the system of record is Supabase on AWS in Sydney
(
ap-southeast-2), and one deliberate offshore copy exists: a daily encrypted off-site backup in GitHub's US artifact storage, readable only with a key held offline, kept 30 days, disclosed in the DPA as the one copy of application data at rest outside Australia. Most other disclosed subprocessors carry scrubbed diagnostics or notification email, but not all are content-free: crisis alerts to a Slack or Teams workspace you enable carry the student's name and their own words, and staff can attach files to the console AI assistants. The subprocessor list names each one and what it can see; hold us to that page, not to a summary sentence. - Minimisation: staff dashboards are aggregate-only and suppress any cell below five students, so no dashboard can single a student out.
- Erasure and export: you are the data controller. First Six executes deletion only on your instruction, and provides a JSON export on request. This matches how Canvas, Blackboard, and Moodle handle institutional records. The institution stays in control of records it may still need.
Authentication and access
- Single sign-on over OIDC, live with Microsoft Entra; a SAML proof-of-concept has been demonstrated, and production SAML would be enabled as part of an engagement that needs it. MFA is enforced by your own identity provider, so your MFA policy governs First Six too.
- Role-based access: platform owner, institution admin, content editor, support responder, and student, plus institution-defined custom roles built from the same permission set (two capabilities can never be delegated to a custom role, and the database enforces that). Enforced at the database layer, not just in the UI.
- Row-level security is enabled on every application table. Tables reachable directly carry per-row policies; tables reachable only through vetted server-side functions are deny-by-default. A daily automated sweep fails our build if any table drifts from that posture.
- Session management: short-lived signed sessions with server-side revocation, including "log out everywhere".
Application and infrastructure
- Security headers (HSTS, frame, nosniff) on every response; a nonce-based Content Security Policy is live in report-only and moving to enforcing after a violation-review window.
- CSRF protection via origin and fetch-metadata checks on every state-changing request.
- Rate limiting on help, sign-in, and AI endpoints.
- Append-only audit logging of staff actions and sensitive-record access: update and delete are revoked at the database, so the trail can't be quietly rewritten.
- Secrets are environment-based with a documented rotation schedule; no secrets in source.
Business continuity and disaster recovery
This is the section where an early-stage vendor differs most from an incumbent, so it is worth reading closely.
- Backups: Supabase managed daily snapshots. Point-in-time recovery is a paid-tier add-on scheduled for enablement at the first paying customer; realistic recovery-point objective today is 24 hours or better.
- Restore drill: a logical restore was run against the live project on 2026-07-01: a scratch-schema damage, restore, and verify cycle, with checksums matched on the institution, cohort, and audit-log slices. A full point-in-time drill is scheduled with the paid-tier upgrade.
- Vendor viability: we are an early-stage company, which carries the risk you would expect. The mitigations we offer are data export on demand, a source- and data-escrow option, and a defined support contact written into the agreement.
The crisis-detection boundary
If your institution enables the crisis pathway, it's important that procurement and legal understand exactly what it is:
- The detector runs a per-tenant list of text signals against help-request wording, twice (in the app and again on our server), and can only ever upgrade a request to crisis, never downgrade.
- It is not a clinical tool and not a substitute for care. It routes signals to your responders and the contacts you configure, and surfaces the support resources you choose to show students. The detection baseline itself is maintained by First Six: it can be extended for your institution but never weakened or switched off by a local setting. First Six never provides care itself.
- Staff judgment is the final safety net: any responder can escalate a ticket the detector missed, and every escalation is audit-logged.
- The institution remains the data controller and the care provider. First Six is a processor and a tool. The binding version of this boundary lives in the service agreement and DPA, whose crisis-boundary language was written and approved in-house in July 2026.
The crisis-detection boundary is the item most worth a careful read, and it is the item we most want your lawyers on. We have no external counsel engaged, so the contractual language here was written and approved in-house. We have tried to make it hold up to scrutiny, and it has had none from outside the company. Corrected 13 August 2026: this page previously said the language had been reviewed by Australian privacy and education-technology counsel, which was not accurate and is exactly the kind of claim a procurement team is entitled to rely on.
What is still outstanding
- SOC 2 / ISO 27001: not yet certified; both on the roadmap. The controls are largely in place; the external attestation is what's ahead.
- Third-party penetration test: planned; happy to make it a contractual condition. (An internal adversarial security review has already been run; its findings are remediated or tracked to closure in the risk register we share.)
- Data Processing Agreement: a signable template has existed since July 2026 and is shared with this pack, with four amendment rounds since (2 August: the off-site backup disclosure; 4 August: AI attachments, a change of substance; 9 August: a disclosure-alignment pass; 13 August: notices, the retention floor and its legal holds, and general contract machinery). Each was held back from signature until it was settled, and the version you receive is the current one. The reasoning behind each clause is written into the document itself, so your privacy office can weigh it rather than take it on trust. How the pack is reviewed, and by whom, is set out on our Trust Centre.
- Cyber insurance: closed 16 August 2026, before any pilot with real students began. Cyber liability and privacy protection of $2M any one claim and in the aggregate, covering breach response, notification, regulatory investigation and enforceable-undertaking costs; professional indemnity of $10M and public and products liability of $20M on a companion policy, with defence costs payable in addition to the limit. Certificates of currency on request.
- Prod / non-prod separation: closed 11 August 2026. A separate non-production project was stood up in July 2026; preview and development builds now run against it, and the rule is enforced in code rather than by convention, so a misconfigured deployment fails to build instead of quietly reading production. What remains open, and stays named: both projects sit in one cloud organisation, so this is environment separation and not account separation.
Using the pack in your review
- Request the pack
Ask your First Six contact or procurement lead. We share it under NDA.
- Start from the HECVAT responses
They're organised by the standard HECVAT sections, so they line up with whatever internal checklist your team runs.
- Read the gaps, not just the ticks
Every item is Yes, Partial, Planned, or No, with a note. The notes are where the real picture is.
- Write the open items as milestones
Where something is still in progress (SOC 2, the pen test), we can write it into the pilot agreement as a milestone rather than a blocker.
Common questions
Can you send a completed security questionnaire today?
Yes. We keep pre-filled HECVAT-Lite responses that reflect the current state of the product, so your review can start straight away. If your institution has its own questionnaire, we'll complete that instead.
Where is student data stored, and does it leave Australia?
The system of record is in Australia, in the AWS Sydney region, and one deliberate offshore copy exists: the daily encrypted off-site backup (GitHub, US), which only an offline key can read. Beyond that, disclosed subprocessors carry what the subprocessor list says they carry, which for most is scrubbed diagnostics or notification email, and for opt-in crisis alerts is genuinely welfare-relevant content. Each is named in the list with its region and payload.
Are you SOC 2 or ISO 27001 certified?
Not yet, and we won't imply otherwise. Both are on the roadmap. The technical controls those frameworks look for are largely in place today; the independent attestation is what's still ahead. We're happy to make it a contractual milestone for a pilot.
What happens to our data if First Six winds down?
Data export is available on demand, and we offer a source- and data-escrow option written into the agreement. You're the data controller throughout, so the records stay yours.
Does the crisis detection replace our duty of care?
No. It's a text-pattern tool that routes signals to your responders and the contacts you configure. The detection baseline is First Six's to maintain (you can extend it for your institution, never weaken it); it has known limits, staff can escalate what it misses, and the institution remains the care provider and data controller.
Related
The fastest answer is usually one question away.