Frontline FinancialTaxFlowAI
TaxFlowAI
Sign inGet started

Data security

Your data, secured the Australian way.

TaxFlowAI's tax services are provided by a registered Australian tax agent, on a platform with security practices aligned to ISO/IEC 27001. Australian-hosted and encrypted in transit and at rest.

See how it works
Flo pointing to a glowing map of Australia with a pulsing node on Sydney

AWS SYDNEY · AP-SOUTHEAST-2

  • Australian-hosted
  • Encrypted at rest
  • 2FA on every login
  • ISO 27001-aligned

How we protect your data

Follow your data, start to finish

HOSTING REGION

AP-SOUTHEAST-2

Sydney, Australia

Amazon Web Services

  • PlatformSydney
  • DatabaseSydney
  • BackupsSydney

01 · AUSTRALIAN DATA RESIDENCY

Hosted in Sydney, Australia.

The TaxFlowAI platform, its database and its backups are hosted and stored in Amazon Web Services’ Sydney region (ap-southeast-2), on infrastructure certified to ISO 27001, SOC 2 and IRAP-assessed standards.

Flo guiding a document through a glowing tunnel between a laptop and a server, scrambled in transit

02 · ENCRYPTION

Encrypted in transit and at rest.

Every connection uses TLS (HTTPS). Data at rest is encrypted on disk, backups are encrypted with managed keys, and integration credentials are additionally protected with AES-256 encryption inside the database itself.

Sign-in verification screen asking for a six-digit code sent by text, with options to resend by email or SMS

03 · ACCESS & AUTHENTICATION

Two-factor authentication on every sign-in.

Every login — client or accountant — requires a password plus a one-time verification code. Client and staff portals are fully separated, access is role-based and least-privilege, and security events are audit-logged.

Flo beside a tidy filing drawer, waving away a redacted card toward a separate sealed capsule

04 · DATA MINIMISATION

We don’t store what we don’t need.

Tax File Numbers and bank account details are not stored in TaxFlowAI. Sensitive identifiers stay in dedicated, purpose-built systems — so a breach of any one system can never expose them all.

REPLICATION

CONTINUOUS

Database

Sydney

Encrypted storage

Australia

~1 second

maximum data loss

VERSIONED RECOVERY POINTS · TESTED RECOVERY PLAN

05 · RESILIENCE

Backed up continuously.

Our database replicates to encrypted Australian storage with roughly one second of maximum data loss, with versioned recovery points and a tested disaster recovery plan.

This page is a summary. How we collect, store, share and protect your information, including where it is held and who can access it, is set out in full in our Privacy Policy, Collection Notice and Terms of Service.

maximum data loss, with continuous replication
~1smaximum data loss, with continuous replication
factors on every login: password plus one-time code
2factors on every login: password plus one-time code
encryption for stored integration credentials
AES-256encryption for stored integration credentials
on every connection, HTTPS everywhere
TLS 1.2+on every connection, HTTPS everywhere
Flo in glasses reviewing a binder of policies, holding a ticked checklist

Governance

Aligned to ISO 27001.

We operate a documented Information Security Management System — risk register, incident response, retention and vendor management — aligned to ISO/IEC 27001. We comply with the Privacy Act 1988 (Cth), including the Notifiable Data Breaches scheme.

  • Risk register
  • Incident response
  • Retention
  • Vendor management
Read our Privacy Policy
Quick factsThe spec sheet, for the detail-minded
HOSTING
Amazon Web Services, Sydney (ap-southeast-2): platform, database and backups
ENCRYPTION IN TRANSIT
TLS 1.2+ (HTTPS everywhere)
ENCRYPTION AT REST
Encrypted storage and backups; AES-256 for stored credentials
AUTHENTICATION
Password + one-time code (2FA) on every login; role-based access
BACKUPS
Continuous replication (~1 second), encrypted, versioned, in Australia
SENSITIVE IDENTIFIERS
TFNs and bank account details are not stored in the platform
GOVERNANCE
ISO 27001-aligned ISMS; Privacy Act 1988 & Notifiable Data Breaches compliance
E-SIGNATURES
Annature — Australian, ISO 27001-certified provider

BUILT ON

AMAZON WEB SERVICESXEROSTRIPEMICROSOFT

Named as the platforms TaxFlowAI is built on. Their inclusion does not imply endorsement.

Flo holding a shield with a glowing tick, waving

Questions about our security practices?

Contact hassan@taxflowai.com.au.

TaxFlowAI · Owned and operated by Frontline Holdings Group Pty Ltd trading as TaxFlowAI by Frontline Financial · ABN 59 671 861 475 · ASIC Agent 51843

Your tax, under control.

Always know what's happening. Stay organised. Reach your accountant. Start today — free to get started.

Get startedTalk to a human

The call is free, 15 minutes, by phone or Teams, with no obligation.

FREE TO SIGN UP · NO CARD · NO SUBSCRIPTION · YOU APPROVE EVERY QUOTE