Orderfy security: your own database in Australia, built to 32 ISO standards
Security first.
Your orders, customers, prices and suppliers are your business. Orderfy is built for the day an auditor asks, and for every day before it.
Yours
Your own database
For your business only. Never shared with another customer.
99.95%
Uptime, with failover
A live standby in a second data centre takes over automatically.
AU
Hosted in Australia
Your data and its backups stay in Australia.
32
ISO standards
Built into how Orderfy is designed, tested and run.
How we protect your data
Twelve safeguards.
Each one is part of the design, on every plan. None of them is an extra.
Your own database
Your business gets a database of its own. It is never shared with another customer, and it is opened by an account that can reach only your database, so even a routing mistake could not show your data to someone else.
Hosted in Australia
Your business data and its backups are kept in Australia. Files and images you upload, and an encrypted off-site copy of backups, stay in Australia and New Zealand, never in the US, Europe or Asia. Ask us and we will tell you the exact locations.
99.95% uptime, with automatic failover
Each database runs on a high-availability server with a live standby in a second data centre. If a server, or a whole data centre, fails, the standby takes over automatically, usually in about a minute, and nothing you have saved is lost.
Sign-in at the door
Every request is checked against a signed identity before it reaches the app. Your business has its own sign-in setup: email and password or single sign-on with your work accounts, and multi-factor authentication you can require for everyone.
Roles and permissions
You decide who can see and do what. Owners, sales, purchasing, warehouse staff and drivers each get only the screens and records their job needs.
Encryption everywhere
TLS 1.2 or later for everything in transit, encryption at rest for databases and files, and backups encrypted with managed keys that rotate every 90 days.
Backups and recovery
Nightly backups kept 7, 14 or 30 days by plan, point-in-time recovery, an encrypted off-site copy, and an automated restore drill every week to prove the backups work.
Staff access is limited and logged
Orderfy support opens your account only in a time-limited session that records who and why. Every session is logged, any change our staff make appears in your audit log as “System admin”, and HR records stay hidden unless you allow them.
A 7-year audit log
Who changed what, and when, is recorded for every record and kept for 7 years on every plan, the period Australian businesses must keep financial records.
Monitoring and incident response
The service is monitored continuously, with alerts to our team. A written incident process sets out who does what, and if a breach affects your data we tell you without undue delay.
Secure development
Every change is reviewed, tested automatically and checked against our build rules before it is released. Third-party code is scanned for known vulnerabilities.
Your data stays yours
We never sell your data, use it for advertising or train AI on it. A full export is available whenever you ask, and when you leave your data is deleted on a published timetable.
Uptime
99.95% uptime, explained.
Uptime is the share of the time the service is there when you need it. Failover is how it stays there when something breaks.
- What 99.95% means
- No more than about 22 minutes of unplanned downtime in a month, or about 4 hours 23 minutes in a year.
- What failover means
- Your database runs in one data centre with an up-to-date standby in a second. If the first fails, the standby takes over by itself, usually in about a minute.
- What you would notice
- At worst, a short pause and a page reload. Work you had saved is still there, because every change is written to both data centres before it is confirmed.
- What we still do
- Nightly backups, point-in-time recovery, an encrypted off-site copy and a weekly restore drill, in case of a failure that failover alone cannot fix.
Standards
Built to 32 ISO standards.
Orderfy's build guide turns 32 international standards into 144 rules, and every release is checked against them before it reaches you.
32ISO standards. We build to every one of them.
Building to a standard and holding a certificate for it are two different things. Certification is an audit by an independent body, and each certificate is published here when it is issued.
Management systems
How the whole organisation is run. These six are the standards an auditor certifies against.
6 standards-
Information security management systems: requirements
The international standard for managing information security: deciding what must be protected, assessing the risks, choosing controls and improving them over time.
In Orderfy: It is the backbone of how Orderfy is run. Risks are assessed and recorded, controls are chosen against them, and each release is checked against our build rules.
-
Privacy information management systems: requirements and guidance
Extends security management to privacy: how an organisation that holds personal information manages the risk to the people it is about.
In Orderfy: We act as a processor of your business data, handle it only on your instructions, and keep records of what we hold, why and for how long.
-
Business continuity management systems: requirements
Business continuity: working out what must keep running, how quickly it must come back, and proving the plan works.
In Orderfy: Every database has a standby in a second data centre, backups are restored in an automated drill each week, and recovery targets are set and tested.
-
Service management system requirements
Service management: how a service provider plans, delivers, supports and improves its service to agreed levels.
In Orderfy: Changes follow a release process, incidents and requests are tracked to resolution, and service levels are published.
-
Quality management systems: requirements
The best-known quality standard: understand what customers need, control how the product is made and delivered, measure the result and improve.
In Orderfy: Requirements, reviews, testing and release are controlled steps, and feedback from customers feeds the next release.
-
Artificial intelligence management system
A management standard for artificial intelligence: policy, risk and impact assessment, and oversight for any organisation that builds or uses AI.
In Orderfy: Your data is never used to train AI. Any use of AI in building or running Orderfy is assessed and recorded first.
Security controls and the cloud
The specific safeguards, and how they apply to a cloud service.
7 standards-
Information security controls
The reference catalogue of 93 information security controls, with guidance on putting each one in place.
In Orderfy: Our build rules map to these controls one by one, from access control and encryption to logging and secure coding.
-
Guidance on managing information security risks
Guidance on information security risk: how to identify, analyse, evaluate and treat risks in a consistent way.
In Orderfy: We keep a risk register, score each risk the same way, and record the treatment and the owner.
-
Information security controls for cloud services
Security controls written for cloud services, covering both the provider and the customer of a cloud.
In Orderfy: Each customer is isolated in its own database, responsibilities between us and our hosting provider are documented, and environments are kept apart.
-
Protection of PII in public clouds acting as PII processors
A code of practice for protecting personal information held in a public cloud on someone else's behalf.
In Orderfy: We process personal information only to provide the service, never for advertising, tell you where it is kept and who our sub-processors are, and give it back or delete it when you leave.
-
Storage security
Securing stored data: at rest, in backups and replicas, in shared storage, and when it is deleted.
In Orderfy: Data and backups are encrypted, each customer's database and files are stored separately, and backups cannot be altered by the services that write them.
-
Information security management: monitoring, measurement, analysis and evaluation
How to measure whether security is working: what to measure, how and how often.
In Orderfy: We measure backups, restores, patching, access reviews and response times, and act on the results.
-
ISO/IEC 27036ISO/IEC 27036-1:2021 and 3 more partsISO/IEC 27036-1:2021 at iso.org (opens ISO's website)
Cybersecurity: supplier relationships
Security in supplier relationships: choosing, contracting with and monitoring the suppliers a service depends on.
In Orderfy: Every supplier that handles your data is assessed, bound by contract, listed on our sub-processors page and reviewed.
Secure, well-made software
How the software itself is specified, written, measured and tested.
6 standards-
ISO/IEC 27034ISO/IEC 27034-1:2011 and 6 more partsISO/IEC 27034-1:2011 at iso.org (opens ISO's website)
Application security
A framework for application security through the whole life of a piece of software.
In Orderfy: Security requirements are set before code is written, every change is reviewed and tested, and dependencies are checked for known vulnerabilities.
-
Software life cycle processes
The processes of the software life cycle, from requirements and design through to operation and retirement.
In Orderfy: Orderfy is built through defined stages, with requirements, review, automated testing and controlled release.
-
SQuaRE: product quality model
A model of software quality with nine characteristics, including reliability, security, performance and ease of use.
In Orderfy: We set targets against these characteristics, so quality is specified up front and not judged after the fact.
-
SQuaRE: measurement of system and software product quality
Standard ways to measure the quality characteristics, such as response time and availability.
In Orderfy: Performance and availability are measured the same way every time, against published targets.
-
Automated source code quality measures
Automated measures of source code quality in four areas: security, reliability, performance and maintainability.
In Orderfy: Code is scanned automatically for these weaknesses on every change, before it can be released.
-
ISO/IEC/IEEE 29119ISO/IEC/IEEE 29119-1:2022 and 7 more partsISO/IEC/IEEE 29119-1:2022 at iso.org (opens ISO's website)
Software testing
The software testing series: concepts, processes, documentation and test techniques.
In Orderfy: We have a written test policy and strategy, with unit, integration and end-to-end tests run on every change.
Incidents, vulnerabilities and continuity
What happens when something goes wrong, and how the service keeps running.
6 standards-
ISO/IEC 27035ISO/IEC 27035-1:2023 and 3 more partsISO/IEC 27035-1:2023 at iso.org (opens ISO's website)
Information security incident management
Incident management: prepare, detect, assess, respond and learn from security incidents.
In Orderfy: We have a written incident process with named roles, severity levels and notification steps, and we review every incident afterwards.
-
Vulnerability disclosure
How a vendor should receive reports of vulnerabilities from outside and tell people about fixes.
In Orderfy: We publish a disclosure policy and a security.txt file, acknowledge reports within 2 business days, and offer safe harbour to good-faith researchers.
-
Vulnerability handling processes
How a vendor should handle a vulnerability once it is known: verify, fix, release and learn.
In Orderfy: Each vulnerability is rated, given a deadline by severity (7 days for critical) and tracked until the fix is released.
-
ICT readiness for business continuity
Keeping the technology a business depends on running, or bringing it back within agreed times.
In Orderfy: Automatic failover between data centres, point-in-time recovery, an encrypted off-site backup copy and rehearsed restores.
-
Incident investigation principles and processes
Principles and processes for investigating incidents, starting with being ready before one happens.
In Orderfy: Logs are designed in advance to answer who, what, when and from where, so an investigation can rely on them.
-
Identification, collection, acquisition and preservation of digital evidence
Guidelines for handling digital evidence so it stays reliable: identifying, collecting and preserving it.
In Orderfy: Security logs are kept in tamper-resistant storage with a recorded chain of custody if they are ever needed as evidence.
Privacy and records
How personal information and business records are handled, kept and deleted.
5 standards-
Privacy framework
The privacy framework the other privacy standards build on: common terms, roles and eleven privacy principles.
In Orderfy: Its principles shape the product: collect only what is needed, use it only for its purpose, keep it only as long as required, and be open about all of it.
-
Guidelines for privacy impact assessment
Guidelines for privacy impact assessments: when one is needed, how to run it and how to act on it.
In Orderfy: A change that touches personal information in a new way gets a privacy assessment before it is built.
-
Guidelines on PII deletion
Guidelines for deleting personal information: retention periods, deletion rules and proof that deletion happened.
In Orderfy: Each kind of data has a retention period. When you leave, your data is deleted on a published timetable, and we confirm it in writing on request.
-
Records management: concepts and principles
Records management: records must be authentic, reliable, intact and usable to count as evidence of what a business did.
In Orderfy: Your audit log records who changed what and when, cannot be edited, and is kept for 7 years on every plan.
-
Specification for digital redaction
A specification for digital redaction: removing sensitive information from a document so it cannot be recovered.
In Orderfy: When records are shared or exported for support, sensitive fields are removed for good, not just hidden.
People
Designing for the people who use Orderfy, including people with disability.
2 standards-
Human-centred design for interactive systems
Human-centred design: base the design on real users, their tasks and their workplaces, and test it with them.
In Orderfy: Orderfy was shaped at a working trade counter, in a warehouse and on delivery runs, with separate, simpler screens for scanners and drivers.
-
Code of practice for creating accessible ICT products and services
A code of practice for building accessibility into how digital products are made.
In Orderfy: We design to WCAG 2.2 level AA: keyboard access, readable contrast, status in words as well as colour, and motion that can be turned off.
Standard titles and editions are from ISO Open Data (© ISO, ODC-By 1.0). ISO is a registered trademark of the International Organization for Standardization. The descriptions are Orderfy's own.
FAQ
Orderfy security: common questions.
Need more for a tender or an audit? Write to security@orderfy.com.au
Is Orderfy ISO 27001 certified?
Orderfy is built to ISO/IEC 27001 and 31 other ISO standards. Certification is a separate audit by an independent body. We publish each certificate on this page when it is issued, and we do not claim one we do not hold.
Why 32 standards? Most software lists one.
One standard covers one subject. Information security alone does not cover privacy, business continuity, software quality, testing, accessibility or record keeping. Orderfy runs your whole business, so we build to the standard for each of those subjects.
Where is my data stored?
In Australia. Your database and its backups are on Australian servers. Uploaded files and an encrypted off-site backup copy stay in Australia and New Zealand. Sign-in, email and billing services are listed on the sub-processors page.
Is my data shared with other customers?
No. Your business has its own database. It is never shared, and only your business can open it.
What does 99.95% uptime mean?
It is the availability Orderfy is built for each month: no more than about 22 minutes of unplanned downtime. It is possible because every database has a live standby in a second data centre that takes over automatically.
Who at Orderfy can see my data?
Only authorised support staff, only in a time-limited session with a recorded reason, and every session is logged. Records you keep as HR records stay hidden unless your settings allow it.
Do you use my data to train AI?
No. Your data is used only to provide Orderfy to you.
Can I get my data out?
Yes. A full export of every table, as CSV files, is available on every plan whenever you ask, and for 90 days after you leave.
How do I report a security problem?
Email security@orderfy.com.au. Our disclosure policy explains what to expect, including safe harbour for good-faith research.
Questions from your IT or your auditor?
Send them through. We answer security questionnaires and can tell you exactly where your data is kept.