Security

• Application and database: Render, Singapore region. Render has no Australian region yet, so this is an overseas disclosure, set out in our privacy policy.
• Documents (licence and permit images, signed forms, confirmations): Cloudflare R2, Oceania region, encrypted before they leave the application.
• Sign-in: WorkOS, which holds your login, not your records.

• All traffic uses TLS, with HTTP Strict Transport Security.
• Licence numbers, dates of birth and storage addresses are encrypted field by field with AES-256-GCM before they reach the database. Searching by licence number uses a keyed blind index, so the number itself is never stored in the clear.
• Each document is encrypted with its own key before upload (envelope encryption). Downloads go through the application, which checks the user may see that record.
• Encryption keys are held separately from the database and can be rotated.

Every request runs inside a database transaction scoped to one business and premises, and Postgres row-level security enforces that scope on every table. The application connects as a role that cannot bypass it. Cross-business references are impossible at the schema level, not just checked in code.

• Sign-in through WorkOS, with multi-factor authentication, passkeys and breached-password checks.
• Microsoft Entra single sign-on, with roles taken from directory groups.
• Roles from owner to read-only, with per-premises adjustments, checked on the server for every request.
• Shop tablets are paired to one premises with a revocable device credential that can only run signing and photo sessions. No staff login is ever left on a shared device.

Register entries are append-only. A correction is a new amending entry that points to the original, which matches what the Firearms Act expects of a register and makes false entries visible.

Changes that matter legally or commercially are written to an audit log, each event hash-chained to the one before, so an altered or deleted event breaks the chain.

Emails and text messages tell customers that something is ready or needs attention. They never include the make, model or serial of a firearm, or a storage address. Logs record identifiers, not the contents of customer records.

Register entries are kept for at least five years, as s 87(5) requires. You can print the register for an inspection or export it at any time, and you can take everything with you if you leave.

If you think you have found a vulnerability, email hello@gundesk.com.au with the details. Please don't access other people's data or disrupt the service while testing. We will acknowledge your report within two business days.