What we actually run.
Parkway is operating software for NDIS providers. The database sits in Australia. Access is scoped to the organisation. Money movement needs a fresh authenticator check. That is the posture. Not a badge.
In place today
These are the controls we operate. If a control is not here, we do not claim it.
Hosted in Australia
Personal information in the Service is stored in Sydney (Supabase, region ap-southeast-2). Files sit in the same region. Transport is TLS. Data at rest is encrypted by Supabase (AES-256).
Row-level security
Every query is restricted to the requesting organisation. Staff see what their role allows. We do not sell personal information. We do not use participant or worker data for advertising.
TOTP step-up
Two-factor authentication (TOTP) is optional for ordinary sign-in. A fresh authenticator check is required before money movement. We do not hard-block support workers on MFA at clock-in.
GitHub required checks
Production deploys go through GitHub. Required checks on main include lint, typecheck, tests, build, generated types, scope-guard, migrations, and e2e smoke. Force-push on main is off. That is how a change reaches parkways.com.au.
Audit logs
Admin and team audit logs record who did what in the platform. Email send logs sit separately. We keep operational records for seven years where NDIS retention requires it.
Report a vulnerability
Email hello@parkways.com.au (also listed in /.well-known/security.txt). Good-faith research under our disclosure policy is welcome: we acknowledge valid reports within two business days, and we will not pursue you if you avoid privacy harm and do not access or keep participant or worker records beyond what shows the issue.
No badge theatre
We are not SOC 2 certified. We are not ISO 27001 certified. Connecting a trust-management tool is not a certificate. We do not publish a pentest letter from a named firm on this page. When we have those, they will be named here.
Named sub-processors
A vendor is on the public list before it sees personal information. The same names sit in the Privacy Policy.
- Company
- Parkways Software Pty Ltd
ACN 697 911 890
ABN 54 697 911 890 - Office
- Unit 5/5-7 Cairns Street, Loganholme QLD 4129
- Contact
- hello@parkways.com.au