How myLot keeps your data secure

Where your data lives

Core application hosting, storage, databases, processing and backups are in AWS Australia, with production and non-production environments separated. Development and demonstration environments never contain council personal information.

Backups are versioned, block public access and are retained in an administratively separate immutable copy. AI processing is described separately on our Privacy and data page, because it deserves a plain answer of its own.

How it is protected

• All browser and API traffic uses HTTPS with TLS 1.2 or higher and legacy protocols disabled.
• Data at rest uses AES-256 encryption across databases, storage and backups.
• Passwords are salted and one-way hashed.
• Keys and secrets are restricted by identity and access management and held in AWS cryptographic services.
• Access follows least privilege.
• myLot staff use unique identities, role-based access, approval-based provisioning, multi-factor authentication for privileged production access, quarterly access reviews and activity logging.
• Councils can use single sign-on through SAML, OpenID Connect or Microsoft Entra ID, with platform roles applied to council users.

How we watch it

• Security events are generated and monitored across endpoint protection, AWS CloudTrail, GuardDuty, VPC flow logs, application logging and code repository monitoring.
• Logs capture logins, data changes, security-setting changes and administrator activity, and are protected by IAM and retained. All privileged activity is logged and reviewed.
• We maintain a formal incident response plan covering reporting, triage, containment, recovery and lessons learned, reviewed and tested annually.
• Councils are notified immediately on awareness of an actual or reasonably suspected security incident, and root cause analysis is documented for every material incident.

How it is built

• Security and privacy requirements are assessed from project initiation through design, development, testing, deployment and change.
• The platform applies secure defaults, least privilege, defence in depth and controlled change management.
• Code is peer reviewed, security tested and scanned before release, and production deployment requires documented testing and release approval.
• Vendor default accounts are removed before systems are deployed, and security patches are prioritised.

Standards and assurance

Our security program is aligned with the ASD Essential Eight and built on the SOC 2 control set, with risk management mapped to ISO 27005 and NIST practices.

Controls are monitored continuously through Vanta, and our policies, including information security, risk management, incident response, AI governance and AI privacy, are published in the myLot trust centre.

‍