Statement
Security
Last updated 25 September 2026
How Remit protects agency information, and what remains to be certified before production use.
Access
Sign-in with the agency's own identity provider over OpenID Connect (single sign-on with the agency's own multi-factor policies) or an agency-issued password. No self-registration. Sessions expire and are revoked on sign-out.
Separation between agencies
Every database query is scoped to the signed-in user's agency. Uploaded files are stored outside the web root and served only through authenticated, agency-checked routes.
Audit
Every create, update, approval, export, sign-in and AI call is written to an append-only audit log the agency can filter and export.
Transport and headers
HTTPS only in production with HSTS, a strict content security policy that loads nothing from third parties, frame denial and MIME sniffing disabled.
Assurance status
Remit is designed for IRAP assessment and has not yet been assessed. No independent penetration test has been done yet. Both will be stated here, with dates, once they have.
Reporting a vulnerability
If you believe you have found a security weakness in Remit, tell us through the contact form at remitai.com.au/contact, with what you found and how to reproduce it. We will acknowledge your report within 2 business days, keep you told of progress, and agree a disclosure date with you once it is fixed. Please do not access, change or keep other people's data, do not degrade the service, and do not publish details before a fix is in place. We will not take legal action against anyone who acts in good faith within these terms. The same contact is published at remitai.com.au/.well-known/security.txt.