Our assurance pathway
What is true today, and IRAP, ISO 27001 and hosting certification on the roadmap.
Where is my data, who can touch it, and who has checked. The first two are answered now; the third is stated plainly.
| Area | Today | Next |
|---|---|---|
| Data residency | All customer data, metadata, backups and logs are stored and processed in Australia. | Written residency commitments in every agreement; residency attestations on request. |
| Personnel | ADC staff with access to customer environments are Australians based in Canberra. Physical access is controlled by the data centre operator. | Security clearances for ADC staff as customer requirements call for them. |
| Information Security Manual (ISM) | ADC's service is being designed against the ISM's controls. Hosting partners are chosen for their own security standing. | Independent assessment of the controls, documented and shared with customers under agreement. |
| IRAP | Not yet assessed. We do not describe the service as IRAP-assessed. | An IRAP assessment is part of the roadmap; customers are told the date when it is fixed. |
| ISO/IEC 27001 | An information security management system is being established on the standard. | Certification once the system has operated long enough to be audited. |
| Hosting Certification Framework | ADC does not hold certification. Customers are told the certification status of the data centre hosting their capacity. | Preference for certified data centres as the service grows. |
| Tenancy isolation | Dedicated GPUs and storage per customer; no multi-tenant sharing of accelerators. | Physically separate hardware arrangements for customers who require them. |
| Transparency | Customers may review the control documentation for their environment under agreement. | Scheduled customer audits and a published assurance calendar. |
We do not describe the service as IRAP-assessed or ISO-certified until it is. If a page anywhere on this site says otherwise, tell us and we will fix it.