What we touch, and what we don't.

Last updated Pending: publication date

01What Austral reads

Austral holds read access to four kinds of record, and pulls them when a dispute needs them — against the specific order the notice matched, not in bulk.

• The order: line items, amount, currency, and the capture the dispute is attached to.
• The shipment: dispatch timestamp, carrier scans, proof of delivery, signature where one exists.
• The correspondence: the shopper's thread with your support team, in order.
• The payment: the capture and the refund record.

These records contain personal data about your shoppers — names, delivery addresses, and whatever they wrote to you. For that data you are the controller and Austral is the processor. What that means in law is set out in the privacy policy and governed by the data processing agreement, not by this page.

02What Austral never sees

Card numbers. Austral works from the capture or transaction reference the payment provider gives it, never from a PAN. Nothing on the platform stores a card number, because nothing on the platform is ever handed one. Pending: confirmation that this holds for every current integration

Austral also has no write access anywhere. It cannot change an order, issue a refund, move stock, or post to your books. That is a property of how the connections are built, not a policy someone could relax later.

03Where the data lives

Pending: hosting provider, region, and whether any data leaves the EEA

04In transit and at rest

Pending: minimum TLS version for data in transit; encryption at rest and key management

05Who can reach it

Pending: access-control posture — named accounts, MFA, least privilege, audit logging, and who inside Austral can read merchant records

06How long we keep it

Pending: retention period per record type, and what happens to your data when the contract ends

07Sub-processors

The third parties that process data on Austral's behalf. We'll give notice before adding one.

08Data processing agreement

A DPA forms part of the contract and covers the merchant records Austral processes on your instructions — scope, security measures, sub-processors, breach notification, and what happens on termination. Ask and we'll send the current version before you sign anything.

09Reporting a vulnerability

If you've found something, mail Pending: security email address. Tell us what you did and what you saw; you don't need a proof-of-concept exploit and we'd rather you didn't build one against production.

Pending: acknowledgement time commitment, and whether there is a safe-harbour statement

10Certifications

We don't hold ISO 27001 or SOC 2 today. When we do, this section will say so, with a certificate number and the name of the auditor who issued it.