Stored in Australia
Your documents and the AI that reads them stay in Australian data centres. Nothing is sent overseas.
- Home
- Security and privacy
Your data
How we keep your documents safe
Your financial records are some of the most personal information you have. Here is exactly how SmartIntake protects them, in plain English.
Encrypted, always
Files are encrypted while they travel to us and while they are stored. Downloads use links that expire within minutes.
Your TFN is hidden
SmartIntake finds tax file numbers in your documents and masks them. They are never shown in the portal, logs or chat.
People stay in charge
AI sorts and reads documents, but a qualified accountant checks and approves every result before it is used.
Every action logged
Who viewed, changed or approved a document, and when, is recorded in an audit log that cannot be quietly edited.
Deleted when done
Uploaded copies are removed once your work is complete and records are kept in our practice system.
Behind the scenes
Built security first
- Sign in with a passkey (Face ID, fingerprint or Windows Hello) or with Microsoft
- Two-step sign-in for clients and staff
- Staff can only see the clients they work with
- Every software change is tested and scanned before release
- No advertising trackers or third-party scripts on this website
- Every upload is safety-checked before anyone opens it, and PDFs with scripts or attachments are refused
What you can do
Help us protect you
- Send documents through the portal, never by email
- Never type your TFN into a form or chat
- We will never ask for your password or a payment by email or SMS
- If something looks wrong, call us on our published number
Comptrust follows the Australian Privacy Principles. Read our privacy policy.
Standards
The Australian cyber security baseline
Our minimum is Maturity Level One of the Essential Eight from the Australian Signals Directorate (ASD), with selected Maturity Level Two practices in the software itself. This is where the beta stands today. It runs on synthetic data only, and we will not call it complete until every row reads "In place".
| Strategy | Status | What it means here |
|---|---|---|
| Multi-factor authentication | In place | Clients and staff sign in with a passkey, or with a password or Microsoft account plus a passkey or authenticator app code. Codes cannot be reused, and wrong attempts are limited and logged. |
| Patch applications | Partly | Every change is scanned for known vulnerabilities before release. Daily scheduled scans and fixed patch deadlines are next. |
| Patch operating systems | Partly | The software image installs security updates at every build. Automatic server updates and a weekly rebuild are next. |
| Restrict administrative privileges | Partly | Services run without administrator rights and staff see only their own clients. Separate administrator accounts are next. |
| Regular backups | Partly | The database is backed up before every release and a failed release rolls back by itself. Scheduled off-site backups and restore tests are next. |
| Application control, Office macros and user application hardening | Planned | These protect the computers staff work on. They apply to each firm's workstations when the portal goes into production. |
Ready for ASD Essentials
In October 2026 ASD published ASD Essentials, the successor to the Essential Eight. It is organised into chapters for enterprise IT, cloud and operational technology, and reports security outcomes for each area of a business instead of one maturity level. ASD has said existing Essential Eight work carries across. As ASD's transition guidance firms up, we will map the portal to the cloud and enterprise IT chapters, so firms using it are not caught out by the change.
Secure by design
The software is built to the NIST Secure Software Development Framework (SP 800-218): code, dependency, secrets and container scans on every change, hash-locked dependencies, automated tests, and a tamper-evident audit log.
Passkeys go beyond the baseline: they cannot be phished, which is what Maturity Level Two asks for. Every upload passes a safety check that refuses PDFs with scripts, launch actions or attached files, password-protected PDFs and damaged images. In production, Amazon GuardDuty adds full malware scanning of stored files.
Sources: ASD Essentials and the Essential Eight maturity model on cyber.gov.au.