Data Security & Privacy

RTObase is designed to protect sensitive student data, training records, and payment information. This page explains the security controls in place across the platform and its infrastructure vendors.

Infrastructure security

RTObase is built on industry-leading vendors that hold SOC 2 Type II certification, an independent audit of security controls covering data protection, availability, and confidentiality.

Vendor compliance

All vendors that handle student data hold SOC 2 Type II certification. Payment processors (Stripe and eWAY) additionally hold PCI DSS Level 1: the highest level of payment security certification.

Data encryption

At rest

All data stored in the database is encrypted at rest using AES-256 encryption, managed by the database infrastructure provider (Supabase / AWS).

In transit

All connections use TLS/HTTPS encryption. This includes:

• Browser to application (HTTPS)
• Application to database (TLS)
• Application to third-party services (TLS)
• Webhook callbacks (HTTPS with signature verification)

No student data is ever transmitted over unencrypted connections.

Access controls

Role-based access

RTObase enforces role-based access for all users:

Trainer assignment does not grant access to another trainer's delivery or organisation settings. Trainers see only the learner and payment readiness information offered by their assigned delivery screens. Custom roles cannot receive organisation management, which covers members, roles, billing, organisation settings and API keys. See Managing Team Members for role configuration.

Tenant isolation

Each organisation's records are isolated from every other organisation's. Isolation is enforced in the database itself, not only in the application, so a request that reaches the data layer without the right organisation context returns nothing rather than another tenant's records.

Automated database security checks run against every change before it can ship, and isolation is reviewed again as part of our release process.

Two-factor authentication

Administrators, staff, Marketing, Auditor and custom-role members must use an authenticator before accessing organisation records. The requirement follows the account across organisations. Trainers who enable an authenticator must also verify it when signing in. Organisation data checks enforce this requirement as well as the sign-in screens. See Two-Factor Authentication for setup instructions.

Server-side authorisation

Database access policies protect organisation records. Server functions also check authorisation for guarded operations:

• Every request is authenticated against the user's session
• Organisation membership is verified before any data is returned
• Area permissions and administrator-only organisation operations are enforced at the server or database boundary, as well as in the UI

Audit trail

RTObase automatically logs all changes to core data entities:

• Students: profile changes, status updates, USI verification
• Enrolments: status changes, unit completions, outcome updates
• Classes: schedule changes, trainer assignments
• Courses: content updates, unit changes
• Assessments: content changes, submission grading
• Attendance: marking changes

Each audit entry records who made the change, when, and the exact before/after values. Audit records are retained for 7 years to meet VET compliance requirements.

See Audit Logging for details.

Payment security

RTObase does not store credit card numbers, CVVs, or other sensitive payment details. All payment processing is handled by PCI DSS Level 1 certified providers:

• Stripe: handles all card processing for Startup and Business plans
• eWAY: available as an alternative gateway for Custom plans

Payment credentials for eWAY integrations are held in a dedicated encrypted secrets store, never in plain-text database columns.

Student data privacy

Data minimisation

RTObase only collects the student data required for:

• VET enrolment and AVETMISS reporting
• USI verification (as required by the Australian government)
• Communication (email and SMS messages)

Data isolation

Each organisation's data is completely isolated. There is no shared student data between organisations, even if the same student enrols with multiple RTOs.

Student portal access

Students can only see their own:

• Enrolments and progress
• Assessment submissions
• Certificates and statements of attainment
• Class schedules

Students cannot see other students' data, trainer notes, or organisational information.

AI access to personal records

AI features that read personal records are off by default. An administrator turns them on under Settings > AI & privacy, after confirming the organisation's privacy notices cover the use. RTObase records who enabled it and when.

When the opt-in is off, identity documents go to manual staff review, and assessment document import, the Admin Agent and AI support chats are unavailable.

Video subtitles are always on

Audio from a submitted practical assessment video is always sent to Cloudflare's speech-recognition model to generate captions, whether the opt-in is on or off. Learners with hearing loss or low literacy need captions to access the evidence they submitted, so this is treated as an accessibility feature rather than an optional one. Only the audio is sent, it is processed on Cloudflare's global network, and it is not used to train the model. Learners are told this on the recording screen before they record. An organisation that does not want speech recognition applied should not collect video evidence.

Training and overseas processing

No AI provider is permitted to use data submitted by RTObase to train its models. OpenAI processes data in the United States; Cloudflare processes on its global network. Where personal information is disclosed overseas, RTObase takes reasonable steps under Australian Privacy Principle 8 to ensure it is handled consistently with the Australian Privacy Principles.

Incident response

If a security issue is identified:

1. The affected service is isolated immediately
2. Organisation admins are notified
3. The issue is investigated and remediated
4. A post-incident summary is provided

Questions

If you have questions about data security or need compliance documentation for an audit, contact support via the in-app chat or raise a support ticket.

Keep going