Security Controls

Encryption at rest: Database storage is encrypted with AWS-managed KMS keys, and sensitive fields carry an additional application-level AES-256-GCM layer whose master key we manage in AWS Secrets Manager.

Encryption in transit: TLS 1.2 or higher on every connection, with TLS 1.3 preferred where the peer supports it. Government claiming channels run at Services Australia's published TLS profile.

Security headers: praxi.au sends HSTS with a one-year max-age, X-Content-Type-Options nosniff, X-Frame-Options DENY (with SAMEORIGIN for our embedded film and practice tour), Referrer-Policy strict-origin-when-cross-origin, a Permissions-Policy, and a Content Security Policy that restricts script, frame and object sources. app.praxi.au sends the same set with X-Frame-Options SAMEORIGIN, because it frames its own booking widget.

Key management: AWS KMS manages the storage-level keys, including their rotation. The application-level field-encryption key is a single platform key held in AWS Secrets Manager, versioned on a key ring so it can be rotated with a resumable re-encryption sweep; that rotation is founder-run, not automatic. Per-tenant key derivation is on the roadmap ahead of our first multi-site customer.

Field-level encryption: Sensitive fields (Medicare numbers, clinical notes) encrypted with additional application-level encryption.

Multi-factor authentication: MFA required for all clinical and management roles, and available to every user. Passkeys come first: Face ID, Touch ID, Windows Hello or a hardware security key, always with user verification, so a passkey is phishing-resistant and counts as full MFA. An authenticator app (TOTP) and single-use recovery codes remain as fallbacks. Every sign-in step runs in Praxi itself.

Role-based access control: Granular permissions with practice owner, practitioner, and staff roles.

Session management: Automatic session timeout after inactivity: 15 minutes for clinical roles and 30 minutes for administrative roles (Essential Eight aligned), configurable per practice. Client portal sessions end after 60 minutes of inactivity and 24 hours after sign-in, in line with NIST SP 800-63B-4 at AAL2. Concurrent session controls.

SSO integration: Enterprise SSO via OpenID Connect (OIDC) for larger organisations, handled by Praxi itself.

Audit logging: Seven-year immutable audit trail for all data access and changes. Hash-chain integrity verification. Aligns with the Privacy Act 1988 and AHPRA record-keeping standards (PsyBA: 7 years adult; minor records to age 25 or 7 years from last session, whichever is longer).

Real-time monitoring: Continuous security monitoring with automated alerting for anomalous activity.

Threat detection: Managed threat detection integrated with our cloud provider. WAF protection against common attacks.

Log retention: Security logs retained for seven years per Australian healthcare record retention expectations.

Network segmentation: VPC isolation with private subnets. No direct internet access to databases.

DDoS protection: Managed DDoS protection at the edge.

Web application firewall: WAF with OWASP Top 10 rule sets. Rate limiting and geo-blocking capabilities.

Private connectivity: VPC endpoints for managed services. Traffic between Praxi services does not traverse the public internet.

Australian data residency: All protected health information stored in AWS ap-southeast-2 (Sydney). Clinical AI runs only in Australian AWS regions. AWS Service Control Policies restrict our production account to Australian regions, apart from a narrow set of AWS global-service actions (such as certificates and DNS signing) that AWS offers only in us-east-1. Praxi does not currently integrate with My Health Record. The overseas services Praxi uses, such as payments and telephony, are named on the Sub-processors page.

Immutable infrastructure: Infrastructure as Code with automated deployments. No routine manual server access.

Backup & recovery: Our production configuration specifies a 35-day database point-in-time recovery window and seven-year AWS Backup retention. Cross-region backup copy to ap-southeast-4 (Melbourne) on the disaster recovery roadmap (Plan 16).

Vulnerability management: Automated scanning with Dependabot and Trivy. Weekly vulnerability assessments.

Breach detection: Automated breach detection with multiple detection rules.

Notification commitment: Under the Notifiable Data Breaches scheme (Privacy Act 1988, Pt IIIC), we notify the OAIC and affected customers as soon as practicable after confirming an eligible data breach. Our internal target is to notify customers within 24 hours of completing the §26WE assessment. See /trust/breach-notification for our full commitment and Privacy Policy §6.3 / §6A.4.

Incident response plan: Documented IR procedures with defined roles. Tabletop exercises run at least once a year; the first has not run yet and is due by 30 November 2026, before any practice goes live.

Forensics capability: Log preservation and chain-of-custody procedures, with seven-year immutable audit trails available as evidence. External forensic and legal counsel are engaged when an incident is declared.

No model training: Your clients' data is never used to train AI models. Clinical AI runs on Anthropic Claude via AWS Bedrock, which contractually excludes customer data from model training or improvement.

Clinical inference: Names and clinical content needed for the task are processed on AWS Bedrock in Sydney (ap-southeast-2). Identifiers are not removed before inference.

Boundary redaction: Personal information is redacted when it leaves the entitled clinical boundary: analytics and log storage, or a report to a recipient who is not the treating practitioner.

Audio & transcript retention: Session-recording audio retention is a per-practice policy, including a zero-retention mode that destroys audio the moment transcription completes. Transcript retention is likewise configurable, and transcripts are encrypted at rest.

Full detail: AI Transparency Statement.