Security and your data

Where things are kept

• Your ledger (invoices, claims, payments, providers) is in a database in Sydney, Australia (Microsoft Azure Database for PostgreSQL), encrypted at rest, with automatic backups and point-in-time restore.
• Invoice files (PDFs, photos, the emails they arrived in) are in Sydney, Australia (Amazon S3), private, encrypted at rest.
• Email we send goes out from Sydney (Amazon SES).
• The app itself runs on Cloudflare's network, which serves you from the nearest location — usually Australia, not guaranteed. Nothing is stored there but our server logs, for up to a week.

What leaves Australia

Only if the plan's owner says yes when Sortaroo asks: to read an invoice, we send that document — or, when the email itself is the invoice, its text — to Anthropic's API, whose servers are in the United States. Under their API terms, what we send is not used to train models and is kept only briefly for abuse monitoring. Say no, or turn it off under Account → Reading invoices, and nothing is sent: invoices are typed in by hand.

Notifications (through Google's Firebase and Apple) and our error alerts (Gmail) are handled overseas too. The Privacy page lists what each one gets.

Bank details

• A provider's BSB and account number are encrypted field by field (AES-256-GCM) with a key that is not in the database, and bound to that provider's record so a value cannot be moved to another.
• They are never written to logs or error reports.
• Every time a decrypted value is shown, it is recorded in your account's history.
• A change to a provider's bank details on an invoice is never applied automatically: the saved details stay in force until you confirm the new ones, after ringing the provider on a number you already had. The provider can answer from their own sign-in, or with a code we text to the mobile we already had, and a "no" from either of you stops it.

Email

• Your forwarding address is a secret. Mail from a sender you haven't approved is held until you say who it's from. It is read, so we can tell you who it seems to be from, but nothing joins your ledger until you confirm it. Mail that fails its sender check isn't read unless you approve it. You can change the address at any time.
• Attachments are stored as-is, never run, and served in a way that cannot execute anything. We don't scan for malware; we don't open files, and neither should you unless you know the sender.
• When an email links to an invoice instead of attaching it, we fetch the file from that link over HTTPS only, never from private addresses, and keep only a PDF.

Sign-in

No passwords. A six-digit code goes to your email; it lasts 30 minutes, and five wrong guesses burns it. A support worker's identity is the email on their invoices — their sign-in shows only their own invoices, never your plan or other providers' details.

Keeping and deleting

• Invoice files are deleted 90 days after you mark the provider paid; raw emails 30 days after they arrive. Files that never reach "paid" in Sortaroo stay until the account is deleted.
• The ledger itself is kept while your account exists.
• You can export everything, free, from Account — and delete the account, which removes the ledger, every file and every provider's bank details immediately. Database backups are kept for 7 days, then gone.

What Sortaroo never does

• Hold, move or touch money.
• Log in to, submit to, or read from the NDIS portal or myGov.
• Sell your data, pass it to anyone for their own use, or use it for advertising.