10.2 Security measures

We implement layered controls and commercially reasonable safeguards across the data lifecycle. These may include, without limitation:

E

Encryption and secure transmission

Encryption of data at rest and in transit; secure HTTPS and TLS communications; encrypted storage and backups; and secure API authentication, including tokenised authentication and encrypted ingestion of bank feed data via Fiskil.

A

Access controls and authentication

Role-based access controls; multi-factor authentication; secure credential management; and session and account monitoring.

M

Monitoring and threat detection

Continuous monitoring; automated detection of suspicious activity; security logging and audit trails; and intrusion detection and incident response.

T

Testing and maintenance

Internal security reviews and vulnerability assessments; independent penetration testing where appropriate; and timely deployment of patches and updates.

D

Data handling and storage

Segregation of sensitive data where appropriate; controlled production access; secure storage and backup procedures; and data minimisation and retention controls.

We may modify or enhance our security measures at any time to address evolving threats or operational requirements.

10.3 User responsibilities

Security is a shared responsibility. When using the Services, you must:

• maintain secure credentials and never share them;
• enable multi-factor authentication where available;
• securely store any records you export or download;
• restrict unauthorised access to your devices and accounts;
• promptly notify us of any suspected unauthorised access, security incident, phishing attempt or data breach;
• ensure that information you upload does not contain malicious code or unlawful material; and
• comply with our reasonable security instructions.

You are responsible for activity under your account that results from a failure to maintain adequate security.

10.4 Information handling

Information may be collected and processed to provide the Services, including user data, system logs, processed information, Bank Feed Data received via Fiskil, AI Memory data, and depreciation schedules and fixed asset registers.

That information may be:

• stored in secure hosted environments;
• retained for legal, compliance, backup, operational and audit purposes;
• accessed by authorised personnel, contractors or providers strictly on a need-to-know basis; and
• disclosed where required by law.

We take reasonable steps to keep personal information accurate, and to protect it against misuse, interference and loss.

10.5 Security commitments

Sparkview is committed to:

• alignment with ISO 27001 security principles where commercially appropriate;
• compliance with applicable Australian privacy and data protection laws;
• regular internal reviews and penetration testing where applicable;
• ongoing monitoring and incident response;
• secure, current encryption standards; and
• compliance with applicable breach-notification obligations.

10.6 Data breach and incident response

We maintain procedures to identify, investigate, contain, document and remediate suspected security incidents, as described in the Incident Response and Breach Notification Policy. You must promptly report any suspected incident or unauthorised access involving your account.