Trust

Security & Compliance

Last updated: 7 November 2026

Note: This page describes the security measures AspireOS is designed with. It is written to align with the Australian Privacy Principles; it does not by itself constitute a certification. A formal certification (for example an independent security review or ISO 27001) would be carried out by an accredited assessor.

Data residency

Your practice data is stored in a Postgres database hosted in Sydney, Australia, on infrastructure operated by Contabo Australia Pty Ltd, and voice recordings are transcribed on our own server there. AspireAi runs on OptiTide’s custom AI, hosted in Sydney. See the Privacy Policy for every service involved.

No training on patient data

Patient data is never used to train AI models, ours or anyone else’s. AspireAi uses it only to answer the request in front of it. AspireOS does not build, train or fine-tune AI models, and OptiTide’s terms exclude what we send from training its models and delete it within 30 days, unless a request is flagged for a misuse review or the law requires it to be kept longer.

Automations and AspireAi

Automations handle the everyday. AspireAi prepares the rest for your approval. Reminders, confirmations and payment follow-ups are automations: they run on the rules your practice sets, and each one can be switched off in Settings. Everything else AspireAi drafts or suggests is shown to a person first, and nothing runs until they approve it. Both are recorded in the audit trail.

Encryption

  • In transit — all traffic is served over HTTPS/TLS.
  • Secrets — these are encrypted one by one with AES-256 before they are stored, with the key kept apart from the database: bank-feed logins, tax file numbers and bank details, two-factor secrets, email passwords, the platform’s own API keys, and the access keys for connected calendars and Google accounts.
  • Session recordings — encrypted (AES-256) before they are stored.
  • Backups — encrypted.
  • At rest — the practice database, including uploaded files, and the backups kept on its server are stored on an encrypted volume (AES-256).
  • Passwords are never stored in readable form (scrypt, salted), and the API keys AspireOS issues are stored only as hashes.
  • Card data is never stored or handled by AspireOS. Card payments run through your chosen provider — Tyro Health or Stripe — on their own hosted payment pages, under their PCI-DSS compliance.

Multi-tenant isolation

Every practice’s data is separated, and the separation is enforced in the application: each request is resolved to one practice and every read and write is scoped to it, and public capability links (payments, patient portal, booking, telehealth) are gated by unguessable per-practice tokens. We state the mechanism rather than promise an absolute, because that is the honest description of the control: it is application-enforced, not a database-level policy, and it is covered by our own automated tests and reviews.

Access control

  • Role-based access — owner, admin, senior and practitioner roles gate who can see and change what (for example, financials are restricted).
  • Least privilege — platform administration is limited to an explicit allowlist and is separate from practice accounts.
  • Passwords are hashed (scrypt, salted); sessions are HTTP-only cookies.

Audit logging

Sensitive actions — record changes, status changes, exports, administrative actions and impersonation — are written to an audit trail so there is a record of who did what and when.

Backups & availability

The database is backed up automatically on a scheduled basis, and backups are monitored so a run that fails is noticed rather than discovered later. Those are periodic snapshots — we do not currently offer point-in-time recovery to an arbitrary moment. We work to keep the service available and to recover quickly from incidents.

Breach response

We maintain an incident-response process and comply with the Notifiable Data Breaches (NDB) scheme. If an eligible breach likely to cause serious harm occurs, we notify the OAIC and affected individuals as required, and support your practice in meeting its obligations. See the Privacy Policy.

Sub-processors

We use a small set of vetted providers to run the service. AspireOS’s database, files and backups are stored in Sydney, Australia:

  • Contabo Australia Pty Ltd — application and database hosting, Sydney.
  • Encrypted backup storage — Sydney.
  • OptiTide — builds, runs and supports the platform, and runs AspireAi, AspireOS’s AI service, on OptiTide’s custom AI, hosted in Sydney.
  • An Australian SMS carrier — texts are sent and received on AspireOS’s own account.
  • Email delivery, address and travel-time lookups, and the direct-debit and card providers for AspireOS subscriptions.

Services a practice connects with its own account (Stripe or Tyro Health for card payments, Tyro Health or HICAPS for claiming, Xero, Mailchimp, Google or Outlook calendars, and Google Drive or other storage) work under their own terms. The Privacy Policy lists what each one receives.

Responsible disclosure

Found a security issue? Please report it privately to admin@aspireos.io so we can fix it before disclosure. We appreciate responsible reports.