MyHazMate
Security & Data Protection
Your business data is sensitive. We take security seriously, using enterprise-grade protection to keep your hazardous materials register and company information safe.
How We Protect Your Data
Encrypted in Transit & at Rest
All data moving between your device and our servers is encrypted using TLS (industry-standard). Data at rest — including your register, SDS files and backups — is encrypted by our cloud storage provider using AES-256.
Secure Authentication
Passwords are hashed using SHA-256 cryptographic algorithms. We never store plain-text passwords, and your credentials are protected against common attack vectors.
Role-Based Access
Control who can access what with granular permission levels. Managers, admins, and standard users each have appropriate access without over-privileging.
Activity Logging
All actions are logged with timestamps and user identification. Maintain a complete audit trail for compliance purposes and security monitoring.
Secure Cloud Infrastructure
We use established cloud providers (Supabase for database and storage, Cloudflare for edge + WAF) with redundant storage and automatic backups.
Regular Backups
Your data is automatically backed up daily with point-in-time recovery capabilities. In the unlikely event of data loss, we can restore your information quickly.
Enterprise-Grade Cloud Security
Your data is protected by industry-leading cloud infrastructure with enterprise-grade security measures.
- ✓ Supabase Postgres database with row-level security
- ✓ Encrypted storage for all SDS documents (AES-256 at rest)
- ✓ Cloudflare DDoS protection and Web Application Firewall
- ✓ Aligned with the Australian Privacy Principles (Privacy Act 1988)
- ✓ Primary customer records held in an Australian-region database; some processing (AI label scan, SDS search) uses global providers under written data agreements
We use trusted cloud providers so your chemical register data and SDS documents are secure, available and backed up.
Enterprise Security
Protected by industry-leading infrastructure.
Our Security Practices
Secure Development Lifecycle
Security is built into our development process from the ground up. We follow secure coding practices, conduct code reviews, and test for vulnerabilities before any release.
Access Control & Authentication
Internal access to systems is strictly controlled with multi-factor authentication, principle of least privilege, and regular access reviews. Only authorised personnel can access production systems.
Monitoring & Incident Response
We monitor our systems for unusual activity and rely on our cloud providers' 24/7 platform monitoring. If a security event occurs, our incident response procedure is to investigate, contain, notify affected customers where required, and remediate.
Regular Security Assessments
We conduct regular security assessments and vulnerability scanning to identify and address potential weaknesses before they can be exploited.
Third-Party Security
Our core infrastructure providers (Supabase, Cloudflare, Stripe) publish independent security assurance information (including SOC 2 reports for their respective platforms). We carefully review the partners who process customer data on our behalf.
Security Questions
Can other users see my company's data?
No. Each company's data is completely isolated. Users can only see data for their own company. Even within a company, access is controlled by role-based permissions set by your administrator.
What happens to my data if I cancel my subscription?
If you cancel, your data is retained for 90 days in case you want to reactivate. After that period, it's permanently deleted from our systems. You can also request immediate deletion at any time.
How do you handle the Emergency QR codes?
Emergency QR codes provide read-only access to your hazmat manifest for first responders. This data is intentionally accessible without login to aid emergency services. You control what information is visible and can disable QR access anytime.
Is my payment information secure?
We don't store credit card details. All payment processing is handled by Apple (App Store) and Google (Play Store) through their secure payment systems. We only receive subscription status notifications.
Questions about security?
We're happy to discuss our security practices in more detail. Contact our team for a security overview or to address specific compliance requirements.
Contact Us