What we touch, and what we don't.

Last updated 12 October 2026

01What Austral reads

Austral holds read access to four kinds of record, and pulls them when a dispute needs them — against the specific order the notice matched, not in bulk.

• The order: line items, amount, currency, and the capture the dispute is attached to.
• The shipment: dispatch timestamp, carrier scans, proof of delivery, signature where one exists.
• The correspondence: the shopper's thread with your support team, in order.
• The payment: the capture and the refund record.

These records contain personal data about your shoppers — names, delivery addresses, and whatever they wrote to you. For that data you are the controller and Austral is the processor. What that means in law is set out in the privacy policy and governed by the data processing agreement, not by this page.

02What Austral never sees

Card numbers. Austral works from the capture or transaction reference the payment provider gives it, never from a PAN. Nothing on the platform stores a card number, because nothing on the platform is ever handed one. That holds for every integration Austral offers today: none of them requests, receives or stores card data.

Austral also has no write access anywhere. It cannot change an order, issue a refund, move stock, or post to your books. That is a property of how the connections are built, not a policy someone could relax later.

03Where the data lives

The Austral platform runs on Railway, in its EU region. Merchant records are stored and processed there, and backups stay in the same region. Railway Corporation is a US company, so any access it has from outside the EEA is covered by the Standard Contractual Clauses in its data processing agreement.

This website is a separate, static site served through Cloudflare. It holds no merchant data.

04In transit and at rest

Every connection into and out of the platform — from your systems, to the payment providers, and to the dashboard — uses TLS 1.2 or higher; older protocols are refused. At rest, databases, file storage and backups are encrypted with AES-256, with keys held in the hosting provider's managed key service and never stored alongside the data.

05Who can reach it

• Named accounts only. Every person has their own account; there are no shared logins.
• MFA everywhere it matters. Multi-factor authentication is required on every account that can reach production, the hosting console, or source code.
• Least privilege. Access is granted per role and removed when it is no longer needed.
• Audit logging. Access to production systems and merchant records is logged.
• Who can read your records. Only Austral engineers, and only when investigating a case or a fault on your account.

06How long we keep it

• Records pulled for a dispute — kept while the dispute can still move, including any appeal or second stage the regime allows, then deleted, and in any case no longer than the contract runs.
• Evidence packs and filing history — kept for the length of the contract, so you can see what was filed and why.
• When the contract ends — we stop reading your systems the same day. You can ask for an export of your evidence packs; everything else is deleted within 30 days, and rolls out of backups within a further 30.

07Sub-processors

The third parties that process data on Austral's behalf. We'll give notice before adding one.

08Data processing agreement

A DPA forms part of the contract and covers the merchant records Austral processes on your instructions — scope, security measures, sub-processors, breach notification, and what happens on termination. Ask and we'll send the current version before you sign anything.

09Reporting a vulnerability

If you've found something, mail founders@austral-technologies.com. Tell us what you did and what you saw; you don't need a proof-of-concept exploit and we'd rather you didn't build one against production.

We'll acknowledge your report within three business days and keep you told as we fix it. If you act in good faith — you don't access more data than you need to show the problem, you don't degrade the service, and you give us reasonable time to fix it before telling anyone else — we won't take legal action against you over the research.

10Certifications

We don't hold ISO 27001 or SOC 2 today. When we do, this section will say so, with a certificate number and the name of the auditor who issued it.