Security and privacy at Lucivion

All client data is stored in Australia, in AWS's Sydney region. Our AWS organisation blocks every other region by policy, so data can't be placed overseas by mistake. Your reports' AI processing and our backup copies also stay in Australia.

Yes. Every connection uses TLS 1.2 or 1.3, and plain HTTP is redirected to HTTPS. All stored data is encrypted with AES-256. The database, report files, backups and our audit trail are encrypted under keys we control in AWS KMS, which rotate automatically every year.

Yes, and the database enforces it, not just the application. Row-level security limits every query to a single organisation, so a software bug can't return another client's records. Automated tests check this every week against our development environment, which runs the same code, by signing in as one test organisation and trying to reach another's data.

Every user needs a password of at least 12 characters and a code from an authenticator app, and MFA can't be switched off. Passwords are stored with Argon2id. Repeated failed sign-ins lock the account. Sessions end after 30 minutes of inactivity and after 8 hours at most, and every sign-in is logged.

Only named staff whose role requires it, each bound by a confidentiality agreement. They sign in through single sign-on with MFA, never with shared or long-lived keys, and their sessions expire within 8 hours. Admin tools are reachable only over our private network. Every action is recorded in a tamper-evident audit log kept for seven years.

On AWS in Sydney, split across separate accounts for production, development, backups and security logs, and management, so a problem in one can't spread to the others. The database and application servers can't be reached from the internet, and the public entry point sits behind a web application firewall.

Every application change must pass automated tests, code security analysis, dependency vulnerability checks, secret scanning and infrastructure checks before it can be deployed. Application releases are deployed by pipelines using short-lived credentials, and every application change runs in development before it reaches production.

Every AWS account is monitored continuously: an organisation-wide audit trail that can't be altered, kept for seven years; AWS GuardDuty threat detection, including runtime monitoring of our containers; and daily checks against the CIS AWS Foundations Benchmark. Urgent findings alert the team directly, and so do password-guessing attacks on the portal.

We follow a written incident response plan with severity levels, first-hour steps and containment playbooks. If a breach involves your data, we tell you within 24 hours of confirming it, so you can meet your own obligations. Every suspected data breach is assessed under the Notifiable Data Breaches scheme within 30 days.

Our container images are rebuilt from scratch at least once a week on current base images and scanned for known vulnerabilities. Every change is checked for vulnerable software libraries before it can be deployed, and our servers are patched automatically every week.

Yes, automated and weekly rather than once a year. Every week, automated tests attack our development environment: they try to reach one organisation's data while signed in as another, scan for common web vulnerabilities with OWASP ZAP and Nuclei, and check our security settings. We have not yet commissioned an independent third-party test.

Email security@lucivion.com. We acknowledge every report within 2 working days and keep you updated until it is resolved. We won't take action against anyone who reports in good faith, avoids accessing other people's data, and gives us reasonable time to fix the issue before disclosing it.

The database can be restored to any point in the last 15 days, to within about 5 minutes. Daily backups of the database and report files are kept for 120 days, with a second copy in a separate, restricted AWS account. Every month an automated test restores the database and report files from backup and checks the restored copies against the live data.

If an AWS data centre in Sydney fails, we restore the database from backup into another one. Our target is to have the service back within 4 business hours, or by the next business day if it happens out of hours, losing at most about 5 minutes of data. We don't run a standby database in a second data centre; that decision is recorded in our risk register. If the whole Sydney region went down, the service would be unavailable until AWS recovered it, but backups are stored across several data centres, so your data would not be lost. If your organisation needs higher availability, such as a standby database ready to take over within minutes, we can provide it as an option. Talk to us about your requirements.

We hold the resident and care information your organisation sends us from your care and medication systems (for example names, dates of birth, clinical observations, medications and care notes), and the names and email addresses of your portal users. We use it only to produce the reports and dashboards you have asked for. We never sell or share personal information, or anything you would consider confidential. We may publish aggregate figures that identify no resident, staff member, client or facility, such as how many facilities we support or broad trends across the sector.

You are. Your organisation holds the relationship with residents and decides how their information is used. Lucivion handles it on your behalf and only on your instructions.

Client data is stored in Australia, and our team accesses it only from Australia. The suppliers we use outside Australia for source code, our private network, accounting and password management never receive resident information.

Some reports use AI models run by AWS in Australia (Amazon Bedrock, in Sydney and Melbourne). Your data isn't used to train any model, AWS doesn't keep prompts or outputs, and an organisation-wide policy blocks AI calls outside Australia.

While you are a client, we keep your data for as long as your reports need it. Within 90 days of your contract ending, we delete your report files and the copies held in our document storage, and we delete your records from our database, or de-identify them where deletion isn't technically feasible, so they no longer identify anyone. Backup copies expire up to 120 days after that.

Two kinds of record are kept longer. Our security audit trail must be kept unaltered for seven years, and it records file names that can include residents' names. Our activity records keep the names and email addresses of the people who used the system, and when they did.

Through the facility. Residents and their representatives should ask the facility, which holds their record. When a facility asks us, we acknowledge within 5 working days and help it provide or correct the information. If the facility asks us to remove a resident's information, we de-identify it so it no longer identifies the person, or delete it where that is technically feasible.

We switch off your organisation's access when the contract ends. Within 90 days, we delete all the files we hold for you, and delete or de-identify your records in our database. Backup copies expire up to 120 days after that. See "How long do you keep data?" for the records we keep longer.

Yes. Our privacy policy is published at lucivion.com/privacy-policy.

We keep a written risk register. Every risk we accept records the reason, who accepted it and the date it must be reviewed again, so accepted risks are revisited rather than forgotten.

Yes. Information security, access control, acceptable use and vendor management policies, plus an incident response plan. Each is reviewed at least once a year.

Every quarter we review who has access to what, and remove anything no longer needed within 5 working days. Leavers lose access on their last day.

All staff complete security and privacy training when they join and again every year, and our developers also complete secure coding training. We don't currently carry out police checks. Every staff member is bound by a confidentiality agreement.

Staff devices must use full-disk encryption, lock after 5 minutes idle, and install operating system and browser updates within 14 days. Client data may be given only to the AI tools approved in our policies.

We design our controls against the Australian Privacy Principles and ISO/IEC 27001:2022, and check our AWS setup every day against the CIS AWS Foundations Benchmark. We don't hold a certification yet.