Security at Vantage

01Our approach

Vantage is used by government, defence, critical infrastructure and corporate teams. Their exercise records can show plans, weak points and decision-making under stress, so we design the platform around four principles:

02Infrastructure

• Vantage is hosted on Amazon Web Services (AWS), whose data centres are independently certified to standards including ISO 27001 and SOC 2. Primary hosting region: AWS Asia Pacific (Sydney), so data is stored in Australia.
• Servers are kept patched, expose only the ports they need, and are administered over encrypted connections.
• Application code, configuration and secrets are kept outside the public web root and are never sent to the browser.
• Backups are encrypted and access to them is restricted. backup frequency and retention

03Data protection

• In transit: all traffic to Vantage is served over HTTPS using TLS 1.2 or higher.
• At rest: stored data and backups are encrypted.
• Separation: each customer's exercises, participants and after-action reports can be reached only by that customer's authorised users.
• Data ownership: customers own their exercise data. We process it only to provide the service, as set out in our data processing agreement, and delete or return it when the contract ends.
• Privacy: we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. See our Privacy Policy.

04Access control

• Role-based permissions separate exercise controllers, participants and observers, so each sees only what their role allows.
• Single sign-on through your organisation's identity provider is on our roadmap. This will let you enforce your own multi-factor authentication and access policies.
• Inside Difiza, access to production systems is limited to named staff who need it, protected by multi-factor authentication, and reviewed regularly.
• Staff are bound by confidentiality obligations and receive security awareness training.

05Website protections

Our public website handles very little data, but we still protect it:

• Form security: the demo request form uses single-use anti-forgery tokens, an origin check, size limits and strict input validation.
• Abuse prevention: rate limits per visitor and per email address, plus quiet bot detection. Rate-limit records are hashed, not stored as raw IP addresses.
• Hardened headers: responses include headers that prevent content-type sniffing and clickjacking and limit referrer data. Browser features we don't use, such as camera, microphone and location, are switched off.
• No secrets in the browser: email credentials stay on the server and are never sent to visitors.
• No trackers: we don't run advertising or analytics scripts.

06Secure development

• Changes are reviewed before release, and production is kept separate from development and test environments.
• Third-party libraries come from trusted sources, are pinned to specific versions, and are updated when security fixes are released.
• We design against common web risks, including those in the OWASP Top 10, such as injection, cross-site scripting and cross-site request forgery.
• We run security testing on the platform and fix findings according to severity. independent penetration test: frequency / most recent date

07Incident response

We monitor our systems for unusual activity and keep logs to help investigations. If we confirm a security incident that affects customer data, we will:

• act at once to contain it and limit the impact;
• notify affected customers without undue delay, as set out in our agreements, with what we know and what we're doing about it;
• assess the breach within 30 days and, where it is likely to cause serious harm, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme; and
• review the root cause and improve our controls.

We help train organisations to handle exactly these moments, and we hold ourselves to the same standard.

08Responsible disclosure

If you think you've found a security vulnerability in Vantage or this website, please tell us. We'll work with you to understand and fix it.

How to report

• Email [email protected] with "Security" in the subject line.
• Include the affected URL or feature, steps to reproduce, the potential impact, and your contact details.

What we ask

• Give us reasonable time to fix the issue before you share it with anyone else.
• Don't access, change or delete data that isn't yours. Stop and tell us as soon as you encounter any.
• Don't degrade the service. That means no denial-of-service attacks, spam, social engineering or physical attacks, and no heavy automated scanning.
• Test only against accounts you own or have explicit permission to use.

What we commit to

• We'll acknowledge your report within 3 working days and keep you updated as we investigate.
• We won't take legal action against anyone who reports in good faith and follows these guidelines.
• With your permission, we'll credit you once the issue is resolved.

09Contact