HomeSecurity
Security and privacy
You're trusting us with your team's details. Here's how we look after them.
Tax file numbers, bank details and certificates deserve care. This is what Onboardly does, in plain English.
How your data is protected
Stored in Sydney
Your data and uploaded documents are stored in Australia, in Sydney, and the app runs in Sydney too.
Encrypted
Encrypted at rest and in transit, from your staff member's phone to our database.
Your business, walled off
Every business's data is kept separate at the database level, and that separation is checked by automated tests.
Two-factor for managers
Owners, operations managers and site managers must sign in with an authenticator app.
Access by role
Site managers see only their own sites. Staff see only their own records.
Every view on record
Admin actions are logged, and so is every time someone opens a staff member's document.
Leavers lose access
When you deactivate someone, they can't sign in or see anything. Their record stays for your files.
Certificates can't be swapped
Once a certificate is on record, the file can't be replaced or deleted behind your back.
No card details stored
Subscription payments are handled by Stripe. Onboardly never sees or stores your card number.
Who else is involved
The providers that help run Onboardly.
Each one gets only what it needs for its job. Some process information outside Australia. Our privacy policy has the full list and exactly what each receives.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | Sydney, Australia |
| Vercel | Hosts and runs the app | Sydney; short-lived request logs in the US |
| Resend | Sends emails: invites, sign-in codes, reminders and offers | See privacy policy |
| Stripe | Takes your subscription payment | See privacy policy |
| Anthropic | Reads the name and dates on uploaded certificates; deletes them within 30 days | US, Europe, Asia or Australia |
| Xero | Payroll, only if you connect it | Australia, New Zealand and the US |
| Expo, Apple and Google | Deliver push notifications to the staff app | See privacy policy |
Your rights
Your data, your say.
Under the Privacy Act 1988 you can ask to see, correct or delete personal information we hold. Email support@onboardly.com.au. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Your next new starter could be ready before day one.
14 days free. No card. Bring your whole team.