Logging and monitoring policy
What First Six logs, where it lives, how long it is kept, who can read it, and how trouble is detected — consolidating verified mechanisms into one policy and stating the open items honestly.
What this policy commits us to
- Staff and system actions are written to an append-only audit log via database triggers; UPDATE and DELETE are revoked, making the trail tamper-evident.
- Sensitive-record access — not just mutation — is logged: profile opens, contact reveals, bulk exports, and every consented break-glass read.
- Crisis fan-out outcomes are captured, including a loud all-channels-failed alert.
- Error monitoring is PII-scrubbed before anything leaves Australia, and session replay is disabled entirely.
- Log access is tenant-isolated: institution admins read only their own tenant's audit log.
Controls mapped to this policy
Mapping controls to the policy is how we check adherence. A green dot marks a control that is operating and traceable to evidence; an amber dot marks one that is documented and scheduled but has not run yet.
- Daily database security sweepMonitoring
- Append-only immutable audit logMonitoring
- Sensitive-record read auditingMonitoring
- AI-assisted change attributionMonitoring
- Sending-domain authentication (SPF, DKIM, DMARC)Monitoring
- Staff anomaly detectionMonitoring
- Uptime monitoring and public status pageMonitoring
- Crisis-failure alertingMonitoring
- PII-scrubbed error monitoringMonitoring
- External heartbeat on the security sweepMonitoring
- Log access restrictionMonitoring
- Incident response and breach notificationBusiness operations
Standards mappings
Through its controls, this policy maps to the following standards and frameworks. Each entry states our real relationship with the standard.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.8.16Monitoring activities
- A.8.15Logging
- A.5.33Protection of records
- A.5.14Information transfer
- A.8.12Data leakage prevention
- A.5.15Access control
- A.5.24Incident management planning
- A.5.26Response to incidents
SOC 2 (AICPA Trust Services Criteria)InfoSec complianceAligned
Controls are explicitly mapped to the criteria — change management to CC8, logging and monitoring to CC7, access control to CC6 — but no SOC 2 attestation of any type exists. Independent attestation is a tracked roadmap item, offered as a contractual milestone for a pilot.
- CC7.1Detection of security events
- CC7.2Monitoring for anomalies
- CC6.6Boundary protection
HECVAT (Higher Education Community Vendor Assessment Toolkit)Higher educationSelf-assessed
A full HECVAT answer pack is maintained and kept current for university procurement, deliberately honest about gaps (no SOC 2 or ISO attestation, no independent penetration test, PITR not enabled). It is a vendor self-assessment, not an externally validated response, backed by a full internal HECVAT-aligned self-audit.
- MonitoringContinuous security monitoring of the hosted environment
- AuditAudited access to institutional data
Australian Privacy Act 1988 (APPs, incl. the NDB scheme)PrivacyApplicable law
The primary legal regime. APP 8 drives the residency objective and every disclosed cross-border flow, APP 11 drives retention and erasure, and the Notifiable Data Breaches scheme's assessment clock is built into the incident runbook with OAIC contacts documented. The privacy policy, terms, and DPA template are counsel-reviewed and approved.
- APP 8Cross-border disclosure (a disclosed, minimised flow)
- NDBNotifiable Data Breaches scheme
GDPR (EU General Data Protection Regulation)PrivacyApplicable law
Applies via international students. The 72-hour breach path is in the incident runbook, Article 28 processor terms sit in the counsel-approved DPA, Article 17 erasure maps to the student's own hard-delete cascade (with the audit-trail carve-out disclosed rather than hidden), and Article 22-equivalent disclosure covers automated crisis detection.
- Art. 33Notification of a breach to the supervisory authority
FERPA (US Family Educational Rights and Privacy Act)PrivacyAligned
For US-institution contexts, the platform addresses FERPA expectations through verifiable controls — tenant isolation, the append-only audit log behind record-access accountability, erasure, and a breach-notification path — rather than asserting a compliance label. The position is self-assessed as partial, with the audit-trail erasure carve-out disclosed as a live residual. A control you can verify is worth more than a label.
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.