Security

We host software that holds our customers' business records and their clients' personal information. This page summarises how we protect it. It describes our general practices, not a guarantee, and specific commitments for each customer are set out in our Service Terms and Data Processing Terms.

Hosting and data location

• Customer data is hosted on Amazon Web Services in the Sydney region (ap-southeast-2), including backups.
• Our production systems run in dedicated AWS accounts, separate from development and testing.
• In our multi-customer software, each customer's data is held in its own separate database.

Protecting data

• Data is encrypted in transit (HTTPS/TLS) and at rest.
• Backups are taken automatically and kept for a limited period.
• Uploaded images have location and other metadata removed before they are published.

Access

• Customer users sign in through a managed identity service, with multi-factor sign-in available.
• Montra staff access to production systems is restricted to those who need it, uses multi-factor sign-in, and is logged.

Monitoring

• A web application firewall filters malicious traffic to our public sites and applications.
• Account activity is recorded in tamper-resistant audit logs.
• Automated threat detection alerts us to suspicious activity.

Incidents

If a security incident affects customer data, we will tell the affected customer without undue delay, help them meet their obligations under the Notifiable Data Breaches scheme, and take steps to contain the incident and prevent it from happening again.

Reporting a vulnerability

If you believe you have found a security vulnerability in any Montra website or service, please email consulting@montra.com.au with the details and steps to reproduce it. Please give us a reasonable time to fix it before disclosing it publicly, do not access or change data that is not yours, and do not disrupt our services. We will acknowledge your report within five business days. We do not currently run a paid bug bounty program.