Certifications, sub-processors and governance

SMB1001:2026 Gold (Level 3) is held by Black Shard Pty Ltd. The IRAP assessment, ISO 27001 and SOC 2 are Microsoft's, at the Azure platform level.

Start the 14-day free trial

Certifications and frameworks

Australian data residency Sydney primary, Melbourne backups
Platform control · Aurii Pty Ltd
Patient records, files and backups are stored in Microsoft Azure Australia East, in Sydney, with backups in Australia Southeast, in Melbourne.
Data residency
AES-256 at rest · TLS 1.2+ in transit Encryption
Platform control · Aurii Pty Ltd
Every database and file store holding clinical data is encrypted at rest with AES-256. Connections accept TLS 1.2 and 1.3, and older versions are refused.
Encryption and keys
Multi-factor authentication on every account Passkeys
Platform control · Aurii Pty Ltd
A second factor is required before any clinical screen loads: a passkey over WebAuthn, or a one-time code.
Access and authentication
Australian Privacy Principles Privacy Act 1988 (Cth): designed to comply
Self-assessed · Aurii Pty Ltd
Self-assessed against the 13 Australian Privacy Principles, 11 October 2026.
Principle by principle
Notifiable Data Breaches scheme ready Privacy Act 1988 (Cth), Part IIIC
Self-assessed · Aurii Pty Ltd
Self-assessed against Part IIIC of the Privacy Act 1988 (Cth), 11 October 2026: escalation within 30 minutes, assessment within 30 days, notification where serious harm is likely.
Data breaches
HIPAA-aligned safeguards HIPAA Security Rule
Self-assessed · Aurii Pty Ltd
Self-assessed against the technical safeguards of the HIPAA Security Rule, 11 October 2026: unique user identity, multi-factor sign-in, session expiry, audit controls, integrity checks and encryption.
GDPR-aligned Articles 5, 25, 28 and 32
Self-assessed · Aurii Pty Ltd
Self-assessed against GDPR Articles 5, 25, 28 and 32, 11 October 2026. The data processing agreement is provided on request.
Request the agreement
Aligned with the NZ Health Information Privacy Code 2020 New Zealand
Self-assessed · Aurii Pty Ltd
Self-assessed against the 13 rules of the Health Information Privacy Code 2020 (New Zealand), 11 October 2026.
SMB1001:2026 Gold Black Shard Pty Ltd · Certified by CyberCert
Held by Black Shard Pty Ltd
Black Shard Pty Ltd, which builds, hosts and secures aurii, is certified to SMB1001:2026 Gold (Level 3) by CyberCert, valid to June 2027.
View on Black Shard
Essential Eight Maturity Level 3 Black Shard Pty Ltd
Held by Black Shard Pty Ltd
Black Shard Pty Ltd, which builds and hosts aurii, runs its own systems at Essential Eight Maturity Level 3, assessed September 2026.
View on Black Shard
Hosted on Microsoft Azure IRAP PROTECTED, ISO/IEC 27001, SOC 2 · held by Microsoft
Held by Microsoft
Microsoft Azure, aurii's hosting platform, holds IRAP assessment to PROTECTED, ISO/IEC 27001, 27017 and 27018, SOC 1, 2 and 3, and CSA STAR. Held by Microsoft.
Microsoft's IRAP assessment
Medical Objects secure messaging HL7 v2 over mutual TLS
Live integration
Signed letters reach the recipient's clinical software as HL7 v2 over mutual TLS, and the delivery acknowledgement returns to the letter in aurii.
Integrations

Sub-processors

Microsoft Azure Hosting, storage, encrypted backups, Key Vault, speech-to-text, and the text recognition applied to photographed and uploaded clinical documents. Australia East is the primary region; Australia Southeast holds the geo-redundant backups.

Enterprise AI provider Turns the consult transcript into the draft note, letters and discharge summary, and receives each photographed or uploaded clinical document attached to the encounter on each note generation. Engaged under commercial terms and a data processing agreement, with no training on your content.

Medical Objects Carries signed correspondence to the recipient's clinical software as HL7 v2 over mutual TLS, and returns the delivery acknowledgement. Operated in Australia.

Notifyre Carries the rendered PDF of a signed letter, discharge summary or order to the fax line the clinician addressed it to, and returns the delivery receipt.

Twilio Carries a short text message with a notice and either a secure link or a one-time code, for handover access codes, secure-portal share codes, patient order links and prescription tokens. The recipient's mobile number, including a patient's, is disclosed to it. No clinical content is carried in the message body.

Microsoft 365 Carries account and notification email, and any letter a clinician addresses to a plain email recipient, from no-reply@aurii.com.au through aurii's own Australian Microsoft 365 tenant. Delivery failure notices return on the same path.

Apple, Google and Microsoft sign-in Where a clinician signs in to the aurii application with an Apple, Google or Microsoft account, that provider authenticates the sign-in and returns the account identifier and email address aurii matches to the user.

Apple and browser push services Deliver a notification to the aurii iOS app, or to a browser on which a clinician has allowed notifications, through the device or browser vendor's push service.

Cloudflare Sits in front of the aurii website and the aurii application as the network edge, terminates the encrypted connection there and passes the request through.

Stripe Processes subscription payments on an Australian account, charged in Australian dollars. Card details are entered with Stripe and never held by aurii. No clinical information is disclosed to Stripe.

Google Analytics Records page views, clicks on telephone and email links, and form submissions on this marketing website. Advertising storage, advertising user data and advertising personalisation are denied on every page load.

Cloudflare Web Analytics Records page views on this marketing website without cookies and without cross-site tracking.

LinkedIn Measures whether a visitor who arrived from an aurii advertisement on LinkedIn went on to start a trial. It runs on this marketing website only, for a visit that arrived on a LinkedIn link or channel tag and for a later visit from the same browser while the 30-day channel cookie lasts.

GlitchTip aurii's own error tracker, run by Black Shard Pty Ltd on its own server in Australia. It receives a report when a script on this marketing website fails in a visitor's browser, with no form contents and no IP address.

Black Shard Analytics aurii's own page-view measurement, run by Black Shard Pty Ltd on its own servers in Azure Australia East. It runs on this marketing website and inside the aurii application, where every address is rewritten to a route template before a measurement is sent, so no record identifier reaches it.

Named in writing before you sign.

No analytics service receives clinical information.

Companies and ABNs

Aurii Pty Ltd, ABN 52 697 638 538, operates the platform and is the party to the terms of service and the privacy policy.
Black Shard Pty Ltd, ABN 66 696 910 773, builds, hosts and secures aurii.
The seller of record on the Australian App Store listing is BLACK SHARD PTY LTD.

Clinical board

The board's practising specialists review every specialty template, the clinical safeguards and every material change to the documentation system before it reaches a ward.

Hospital evaluation pack: hospital overview, security architecture, Australian Privacy Principles mapping, clinical safety position, data processing agreement and audit trail walkthrough.

Start the free trial

Start the 14-day free trial

hello@aurii.com.au