Encryption at rest
Files are encrypted while they are stored, so the data on disk is unreadable without the keys that protect it.
Security
Your data stays under your control.
Encrypted in transit and at rest. Hosted in Australia. Every action logged permanently. We hold the infrastructure — you hold the access.
Reports & analytics
An immutable record of who did what — read-only, and scoped to your organisation only
Try
2 events matching “shared”
- Shared Financials with Dawson & CoSharingRead-only link to an external accountant. Stops working on 14 Oct 2026.
- Opened shared Financials linkSharingExternal viewer, read-only. Download disabled on this link.
What’s guarding your vault right now.
One account, taken apart. Every safeguard below is live in the app today, so protection doesn’t depend on someone remembering to switch it on.
- A
Sign-in
Email and password sign-in to your organisation. Repeated failed attempts lock the account, so a password can’t be guessed by trial and error.
- B
Session lock
Step away and lock the screen without losing your session. Unlock when you’re back, and log out cleanly at the end of the day.
- C
Password vault
Shared business logins are stored in their own vault and stay hidden until someone chooses to reveal them.
- D
Permanent records
Records that must never be deleted are kept apart from ordinary documents, in a place of their own.
- E
Subcontractor links
Subcontractors get a private invite link and upload their compliance documents through it, without an account on your vault.
- F
Your documents stay yours
The AI Document Assistant only reads your organisation’s documents. One business can never retrieve another’s document text.
Security fundamentals
Six controls working underneath every vault, protecting each document from the moment it’s uploaded.
Hosted in Australia
Your documents and our main database are stored in Australian data centres. A few service providers, such as email delivery, process limited data overseas.
TLS in transit
Every connection between your browser and our servers uses TLS 1.2 or higher. No unencrypted transfer at any point.
Immutable audit trail
Every view, download, share and permission change is logged against a user and timestamp. The log cannot be edited or deleted — by anyone.
Two-factor authentication
TOTP-based 2FA is available for all users and can be made mandatory by vault administrators for every member of the team.
Availability monitoring
We monitor the platform for downtime and errors, and investigate incidents as soon as they are detected.
Questions people ask.
How does BusinessVault keep business documents secure?
Documents are encrypted in transit and at rest, hosted in Australia, and every action on them is logged permanently. On top of that, accounts lock after repeated failed sign-ins, and your organisation’s documents are kept separate from every other business on the platform.
Where is BusinessVault data stored? Is it hosted in Australia?
Your documents and our main database are hosted in Australia. Some service providers we rely on, such as email delivery, process limited information overseas. Our Privacy Policy lists the countries involved.
How are documents encrypted in BusinessVault?
Files are encrypted while they are stored, and every connection between your browser and our servers uses TLS 1.2 or higher.
Is there an audit log of who viewed or changed our documents?
Yes. BusinessVault keeps an immutable audit log of who changed what, scoped to your organisation only. Entries are logged against a person and a time, and cannot be edited or deleted.
What happens after repeated failed login attempts?
The account is locked. BusinessVault applies brute-force protection to every account, so repeated failed sign-in attempts can’t be used to guess a password.
How can our team store and share business passwords securely?
Use the built-in password vault. Shared business logins, such as bank or government portals, are stored in one place and stay hidden until someone with access chooses to reveal them.
Can important business records be protected from deletion?
Yes. Records that must never be deleted can be stored as permanent records, kept separately from your ordinary documents so they can’t be removed along with everyday files.
Do subcontractors need a BusinessVault account to upload compliance documents?
No. Each subcontractor receives a private invite link and uploads their compliance documents through their own portal, without needing an account or access to your vault.
Does the AI Document Assistant share my documents with other businesses?
No. The AI Document Assistant only reads your own organisation’s documents. One business can never retrieve another business’s document text, and this is enforced where documents are retrieved.
Security you can hand to an auditor.
Start a free trial and see the encryption, access controls and audit trail working against your own documents.