HutSix understands that our clients entrust us with sensitive information about participants, employees and their organisations. Protecting that information and being open about how we do so is fundamental to the way we design, operate and support our projects.

We work collaboratively with clients throughout onboarding and beyond. We provide clear information about data handling, security controls, system resilience and the responsibilities shared between HutSix and each client.

This page describes our general approach. The controls and services applying to a particular solution are set out in the relevant proposal, quotation or contract.

Our approach to security

HutSix believes integrity in technology begins with being honest about what is—and is not—in place.

We do not claim certifications, controls or levels of assurance that we have not achieved. Our approach is instead based on practical risk management, transparent conversations with clients and the continued improvement of our systems and processes.

No technology provider can credibly promise that a system will never experience a vulnerability, outage or security incident. What we can promise is that we will take security seriously, communicate openly and work constructively with clients to identify and address risk.

We welcome reasonable security review and are open to independent testing. Where a client requires penetration testing, formal assessment or additional controls, we can work with them to define the scope and arrange the work as a separately quoted service. Any findings are reviewed and addressed according to their risk and relevance.

Practical and proportionate controls

Security controls need to reflect how a solution will be used in practice. This is particularly important for organisations with remote teams, shared operational environments, varying levels of connectivity or users who may not have access to centrally managed devices and identity systems.

Controls such as multi-factor authentication can materially improve security, but their implementation may require decisions about:

• The identity provider being used
• Whether users have individual email addresses or devices
• Mobile coverage and internet availability
• Account recovery and support processes
• Accessibility and workforce requirements
• The responsibilities of HutSix and the client

HutSix discusses these considerations during solution planning. Where a control cannot be implemented immediately, we work with the client to understand the risk, consider alternative safeguards and identify a practical path for improvement.

We would rather be transparent about a limitation than create a false impression of assurance. Our goal is to build solutions responsibly, invite informed scrutiny and continue strengthening our practices as the technology and the needs of our clients evolve.

Data location and residency

Data stored or processed within a HutSix-managed Australian dashboard environment remains in Australia. Unless otherwise agreed, the application, databases, storage and HutSix-managed backups are hosted in the Amazon Web Services Sydney region (ap-southeast-2).

The specific hosting architecture and data-residency requirements for each solution are confirmed with the client during onboarding.

Account isolation

Where a dedicated environment forms part of the agreed solution, the dashboard is deployed within an isolated AWS account administered through the HutSix AWS organisation.

This provides account-level separation between client environments and prevents client data from being stored in a shared client AWS account.

Specific infrastructure identifiers and detailed architecture information are available to authorised client representatives through HutSix’s security assurance process but are not published publicly.

Third-party services

A dashboard may connect to third-party systems selected or used by the client.

Information received by the dashboard is processed and stored within the agreed HutSix-managed environment. However, third-party providers operate their own infrastructure and networks. HutSix does not control where those providers process API requests, authentication traffic or related communications and cannot guarantee that every interaction with a third-party service remains exclusively within Australia.

The residency, privacy and security practices of each third-party service remain subject to that provider’s infrastructure, terms and policies. HutSix works with clients to identify relevant integrations and document associated data-handling considerations.

Security architecture

HutSix maintains documentation describing the high-level architecture of each solution and how information moves between relevant systems.

Subject to appropriate confidentiality and security controls, authorised client representatives may request a high-level architecture or data-flow diagram covering relevant application components, integrations and information flows.

Detailed infrastructure information is not published publicly where doing so could create an unnecessary security risk.

Security assessment and testing

HutSix applies security considerations throughout the design, development and operation of its solutions.

Independent penetration testing is not included as a standard component of the dashboard service. Where testing is required by a client’s governance or assurance program, HutSix can arrange it as a separately scoped and quoted service.

The agreed scope may cover:

• The testing provider and methodology
• The systems and environments included
• Timing and testing frequency
• Reporting and deliverables
• Remediation responsibilities
• Retesting of identified issues

Any testing reports or findings will be shared subject to appropriate confidentiality and security controls. Depending on the engagement, HutSix may provide a full report, remediation summary or executive assurance statement.

Access control

Access arrangements are designed with reference to least privilege and the responsibilities agreed with each client.

Depending on the solution, controls may include:

• Unique user accounts
• Multi-factor authentication
• Role-based permissions
• Documented access requests and approvals
• Timely changes when users or responsibilities change
• Periodic access reviews
• Restricted administrative access
• Logging of relevant account and administrative activity

During onboarding, HutSix works with the client to determine who can approve access and how provisioning, access reviews and offboarding will be managed.

Backup and recovery

Backup and recovery arrangements are established on a client-by-client basis. They are informed by the sensitivity of the information, the client’s operational requirements, acceptable risk and available budget.

Where backup or recovery services are required, the applicable quotation or contract will define matters such as:

• The systems and information covered
• Backup frequency and retention
• Storage location and encryption
• Restoration testing
• Recovery responsibilities
• Recovery Time Objectives
• Recovery Point Objectives
• Additional disaster-recovery arrangements

Backup services and recovery objectives should not be assumed unless expressly included in the applicable quotation or contract.

HutSix works with clients during onboarding to identify appropriate arrangements and ensure responsibilities are clearly understood.

Privacy

HutSix works with clients to identify the privacy obligations relevant to each solution, including obligations arising under the Privacy Act 1988, the Australian Privacy Principles and applicable industry or contractual requirements.

Our approach includes considering:

• The types of personal and sensitive information involved
• The purpose for which information is collected and used
• Who may access the information
• Relevant retention and deletion requirements
• Third-party disclosures and integrations
• Data location and overseas processing
• Security and breach-response arrangements

Where required, a Privacy Impact Assessment or equivalent assessment can be scoped as part of the engagement.

Use of artificial intelligence

HutSix recognises that clients need visibility over whether and how artificial intelligence tools may interact with their information.

Our AI governance considers:

• The tool and its intended purpose
• The types of information it may process
• Where processing occurs
• Applicable retention arrangements
• Whether information may be used to train a provider’s models
• Security, privacy and human-oversight controls

Unless otherwise agreed with the client, HutSix does not disclose or process client-provided personal information using AI tools.

Relevant information about approved AI tools can be made available to authorised clients as part of security and privacy due diligence. This may take the form of an AI Tool Register, a project-specific extract or another suitable assurance document.

Audit logging

The audit logging appropriate for each project depends on the solution’s functionality, information sensitivity and compliance requirements.

Depending on the agreed scope, logging may cover:

• Authentication attempts and account activity
• Administrative and permission changes
• Access to sensitive information
• Important data changes
• Integration activity
• Security alerts and system events

Log retention, authorised access and client reporting capabilities are agreed as part of the solution requirements. Access to security and operational logs is restricted to authorised personnel.

Service continuity and transition

The ownership, licensing, documentation, support and termination arrangements applying to each project are governed by the client’s contract with HutSix, including the accepted quotation and HutSix’s Terms and Conditions.

Project-specific continuity protections may be discussed during procurement or onboarding. Depending on the client’s needs, separately agreed arrangements may include:

• Export or handover of client data
• Technical and operational documentation
• Transition assistance
• Extended support
• Alternative hosting or operational arrangements

These protections are not included automatically and apply only where expressly documented in the applicable quotation or another written agreement.

HutSix encourages clients to raise continuity and exit requirements early so that suitable arrangements, responsibilities and costs can be agreed before implementation.

Starting the conversation early

Security and privacy work best when expectations are discussed from the beginning.

As part of planning and onboarding, we encourage clients to raise their requirements concerning:

• Information sensitivity and permitted uses
• Hosting and data residency
• User access and approvals
• Integrations and data flows
• Security testing
• Backup and recovery
• Audit logging and reporting
• Privacy and regulatory obligations
• AI use
• Service continuity and transition

This collaborative process allows us to identify additional controls or assessments, explain the available options and ensure the agreed solution reflects each client’s needs.