Security & privacy

You are about to tell us what is wrong with your business.

The tools on this site collect exactly the information a competitor, an acquirer or an attacker would most like to have: your revenue, your client numbers, your key-person risk, your compliance gaps and your cyber weaknesses. We think you are entitled to know precisely how that is held before you type any of it.

1Nothing leaves your browser unless you save it

Every tool runs entirely in your browser. Your answers sit in your device's local storage while you work. They are transmitted only when you choose to save the result to your account, and you can use every tool without an account at all.

2Encryption in transit and at rest

All traffic is TLS 1.2 or higher with HSTS. Stored data is encrypted at rest with AES-256. Database backups are encrypted with separately managed keys and tested for restore.

3Two-factor authentication

Available on every account and required on Practice accounts, which hold other people's data. Time-based one-time codes from an authenticator app, or a passkey. SMS is offered as a fallback only, because SIM-swap attacks make it the weakest of the three.

4We never see your card

Payment details are entered on Stripe's hosted checkout. Countique receives a customer reference and a subscription reference. No card number, expiry or security code reaches our systems or our logs.

5Australian data residency

Practice profile data is stored in Australian data-centre regions. Where a supplier processes data offshore, that supplier is named in the list below, so you can meet your own APP 8 cross-border disclosure obligations.

6Access is least-privilege and logged

No Countique staff member has standing access to a subscriber's practice profile. Support access is time-boxed, requires your approval, and is written to an audit log you can request.

7You can delete it, and delete means delete

Deleting your account removes your profile from production immediately and from encrypted backups within 35 days as those backups age out. We keep only what tax and corporations law requires us to keep, transaction records, not tool answers.

8If something goes wrong, you hear it from us

A suspected eligible data breach is assessed within 30 days as the Notifiable Data Breaches scheme requires, and we notify affected subscribers and the OAIC as soon as practicable once assessed. We will tell you what happened, what was taken and what to do, not a holding statement.

The obligations behind this

Why a consulting site takes this seriously

Two sets of obligations meet here. Ours, as a business holding personal information about you. And yours, as an AFS licensee choosing a supplier, because outsourcing a function does not outsource the obligation.

Obligation	Whose	What it requires
Australian Privacy Principle 11 Privacy Act 1988 (Cth), sch 1	Both	Take such steps as are reasonable in the circumstances to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, and to destroy or de-identify it when no longer needed.
Notifiable Data Breaches scheme Privacy Act 1988 (Cth), pt IIIC	Both	Assess a suspected eligible data breach within 30 days and, if serious harm is likely, notify affected individuals and the Information Commissioner as soon as practicable.
Section 912A(1)(h) Corporations Act 2001 (Cth)	Licensee	Have adequate risk management systems. In ASIC v RI Advice Group [2022] FCA 496 the Federal Court held that inadequate cyber risk management can breach this provision, including risk arising through authorised representatives and third-party systems.
Outsourcing and supplier oversight ASIC RG 104	Licensee	A licensee remains responsible for functions it outsources, and must be able to monitor the supplier's performance and terminate the arrangement. Which is why the list below exists.
Essential Eight Australian Signals Directorate / ACSC	Guidance	Not law, but the baseline ASIC and most professional indemnity insurers now measure against: patching, application control, multi-factor authentication, restricted admin privileges, and tested backups.

A word on what this page is not. This is a description of how the Countique platform is built and operated. It is not a warranty, and it is not legal advice about your own obligations. If you are assessing Countique as a supplier, ask for the security schedule and the sub-processor list in writing, and ask every other supplier you use for the same thing.

Sub-processors

Who else touches your data

Named so you can complete your own APP 8 assessment. We give 30 days' notice before adding a sub-processor that handles personal information.

Supplier	Purpose	Data location	What they receive
Stripe	Payments and subscription billing	United States	Name, email, billing address, card details entered directly with them. No tool answers.
Application hosting	Running the platform	Australia (Sydney)	All account and practice profile data, encrypted at rest.
Transactional email	Verification codes, reports, receipts	Australia	Name, email address, and any report you ask us to send you.
Error monitoring	Diagnosing faults	Australia	Technical diagnostics with personal information scrubbed before transmission.

Build note

The sub-processor list above is illustrative pending real supplier confirmation. Before launch this page must carry the real supplier list, the real data-centre regions, and a privacy policy and collection notice reviewed by an Australian privacy practitioner.