Trust and security
How responda protects brigade records
Issue 1Dated First issue
This page explains where brigade records are kept, how they are protected and backed up, who can access them, and what happens to them if a brigade stops using responda. Each section has the date it applies from.
Who runs responda
As of
responda is built and operated by Entent, ABN 14 207 250 964.
For anything on this page, write to contact@responda.app.
Where the data lives
As of
Brigade records, and every backup of them, are held on Microsoft Azure infrastructure hosted in Australia. They are never replicated outside Australia.
Two things are handled outside Australia:
- This website's pages are served from static hosting outside Australia. The pages are the same for every reader and hold no personal information.
- The email service that carries responda's email is in the United States. Such an email carries a member's address, their name and the message itself. It does not carry their attendance record.
When someone uses responda while signed in, each request they make is logged with their account's internal identifier and roles. The hosting platform's request log records the internet (IP) address and the full web address of every request. The privacy policy says the same thing for members.
Controls
As of
| Control | Position | Status | Since |
|---|---|---|---|
| Data location | Every brigade record, and every backup of it, is held on Microsoft Azure infrastructure hosted in Australia. None is ever replicated outside Australia. This website's own pages are served from static hosting outside Australia and hold no personal information. Email sent by responda passes through an email service whose data location is the United States. | Held | |
| Encryption in transit | Every connection is encrypted with TLS 1.2 or later: a browser to responda and responda to its file storage, both over HTTPS only, and responda to its database. Older protocols are refused. | Held | |
| Encryption at rest | The database and the file storage are encrypted at rest with platform-managed keys. | Held | |
| Backups | Point-in-time restore from Azure SQL's automatic backups, and long-term backups kept under a retention policy. Backup storage is geo-redundant across two regions in Australia, so no copy leaves Australia. A restore of the production database from these backups has been rehearsed. | Held | |
| Access model | Access is by role: a member sees only their own record, an officer sees what their role allows, and the station sign-in screen shows nothing about any other member. Sign-in is by password with lockout after repeated failures. | Held | |
| Audit trail | Every change a person makes to a sign-in, a member record, a fire warden activity or a permit application keeps the prior value, who made it and when. Nothing in responda deletes an attendance or member record, and a correction is recorded beside the original. Report views, exports and password resets are each logged. These are removed from history on purpose: when an account is deleted, its credentials at once and its email address and user name 30 days later, and 30 days after a fire warden marks a permit application as spam, the applicant's name and the ways to reach them. | Held |
This table is plain text, so it can be selected and pasted into a vendor assessment.
Custody and exit
As of
The organisation owns the records of its brigades: their members, sign-ins and sign-outs, reports and the history of every change to them. Entent is the custodian of those records, not their owner.
A brigade that leaves gets an export of the records responda holds for it: spreadsheets of members, sign-ins and the history of changes, together with a PDF activity report for every member, current and former. Its organisation gets the same export. The formats are open, so the export can be used without responda.
The steps are the same whichever side ends the arrangement:
- The brigade, or Entent, gives 90 days written notice.
- Entent keeps operating responda for the brigade for the whole of that period.
- Entent delivers the export to the brigade and its organisation within those 90 days.
- The brigade confirms in writing that it has the export, and Entent deletes the brigade's data 30 days after that confirmation, and not before. Where a law requires a record to be kept for longer, that law prevails.
If Entent stops operating responda, every brigade gets at least 90 days written notice and the same export within it. Entent holds a written continuity instruction naming a person who acts if Entent cannot: keeping responda running where they can, and producing the export in any case.
Every brigade record is kept for at least 15 years after the last action on it. The brigade's written agreement with Entent carries the same position.
Security incidents
As of
A security incident is unauthorised access to, or the loss or disclosure of, a brigade's records. Entent tells the affected brigade and its organisation in writing without delay, and within 5 business days of becoming aware of it, stating what happened, which records were affected and what Entent has done about it.
The organisation owns the records, so it decides what members are told. Entent helps with any notification the law requires.
Report a security concern to contact@responda.app. A named person reads it.