Legal

Security Policy

Our security architecture and data protection practices.

SECUVA™, PixelIQ™, SlideIQ™, GenomeIQ™, CardioIQ™, ClinicalIQ™ and SignalIQ™ are trademarks of SECUVA SOLUTIONS PTY LTD.

Security Overview

Security is the core design principle behind SECUVA - not a compliance checkbox. Three of SECUVA's co-founders have backgrounds in offensive security, defensive architecture, and Australian privacy law. The threat model was written before the first line of code. For detailed technical specifics, see our Security & Trust page.

  • Australian data residency
  • Designed for the Australian Privacy Act 1988
  • OAIC-aligned data handling
  • SOC 2 readiness program underway
  • ISO 27001 aligned practices

Note: SECUVA's SOC 2 readiness program is underway. SECUVA is designed for the Australian Privacy Act 1988 and is not a HIPAA-regulated product.

Security Architecture

Zero-Trust Network

All network traffic is encrypted. No implicit trust is granted to any user or system, regardless of network location.

Encryption in Transit and at Rest

Data is encrypted in transit and at rest.

Supply Chain Integrity

All SECUVA releases are cryptographically signed. A software bill of materials (SBOM) is published with each release. Dependency scanning runs on every build.

Access Controls

All user accounts require MFA. Role-based access controls (RBAC) ensure users can only access data necessary for their role. All access is logged to an immutable audit trail.

Regular Security Assessments

Independent security assessments, penetration testing, and vulnerability scanning are conducted on a regular schedule. Findings are triaged against the CVSS framework and remediated according to severity SLAs.

Data Protection

Patient identity never leaves your network.

SECUVA processes DICOM imaging inside your network. Raw PHI is never transmitted to SECUVA's systems. Only de-identified, anonymised outputs are released to downstream services, and only to recipients you explicitly authorise.

Australian Data Residency

SECUVA's control-plane infrastructure is hosted exclusively in Australia. Customer data does not leave Australian borders.

Data Minimisation

We collect and process only the data necessary to provide our services. Data retention policies ensure information is not held longer than required under applicable Australian law.

Responsible Disclosure Policy

We welcome security researchers and the broader community to help us maintain the security of our platform. If you discover a security vulnerability, please follow our responsible disclosure process.

In Scope

  • secuva.ai, secuva.com.au and all subdomains
  • SECUVA software deployed in customer environments
  • SECUVA cloud services and web applications
  • Audit log integrity
  • Any component or flow that could expose patient data

Out of Scope

  • Social engineering or phishing attacks against SECUVA staff
  • Physical access to infrastructure or hardware
  • Denial of service or volumetric resource exhaustion
  • Third-party services not operated by SECUVA
  • Findings in environments operated by customers
  • Vulnerabilities already reported and under active remediation

Guidelines

  • Make good faith efforts to avoid privacy violations and service disruption
  • Do not access or modify other users' data
  • Report vulnerabilities as soon as possible after discovery
  • Allow us reasonable time to remediate before public disclosure
  • Do not perform testing that could harm our users or services

Reporting Process

How to Report

Send detailed reports to our security team:

security@secuva.com.au

For sensitive reports, request our PGP public key at the address above before submitting.

What to Include

  • Description of the vulnerability and its potential impact
  • Steps to reproduce the issue
  • Screenshots or proof-of-concept code if applicable
  • Your contact information for follow-up questions

Our Response

  • Acknowledgment within 24 hours
  • Initial triage and severity assessment within 72 hours
  • Regular progress updates until resolution
  • Public credit for responsible disclosure (if desired)

Security Monitoring

We continuously monitor our systems for security threats and anomalous behaviour.

  • Real-time threat detection and response
  • Automated vulnerability scanning on every build
  • Immutable audit trail for all control-plane events
  • Regular security awareness training for all staff

Questions about our security practices?

Or read the full technical detail on our Security & Trust page.

Contact security team