Skip to content

Security Framework

Protecting Sensitive Member and Organisational Data

Executive Summary

Agend Systems (Agend) is committed to maintaining the highest standards of security across every product we operate — both our established Agend Pro (WordPress-based member experience) platform and our new Agend Product Suite (Next.js/Vercel/Supabase SaaS products). This page sets out the security principles and practices that apply company-wide, regardless of which Agend product you use. Product-specific implementation detail — the exact hosting environment, firewall stack, and authentication mechanics — lives under each product's own section:

Document History
Author Update Date Version
Glen Rosie Initial Release (as part of single-product Security Framework) 3 May 2024 1.0
Glen Rosie Updates to Application Security 15 Aug 2024 1.1
Garth Walker Reviewed 14 Feb 2025 1.2
Glen Rosie Split into shared framework + per-product implementation pages as part of Agend Product Suite launch 1 Jul 2026 2.0
Glen Rosie Reviewed 1 Jul 2026 2.1

1. Network & Infrastructure Security

  • Encrypted, Firewalled Edge Network: every Agend product sits behind a hardened network edge — firewalling, DDoS mitigation, and bot filtering — before traffic reaches application servers.
  • TLS/SSL Encryption: mandatory HTTPS across all products, with automatic certificate renewal and modern TLS versions (TLS 1.3 where supported).
  • IP/Geographic Access Restrictions: capability to restrict access based on geographic location when a client's risk profile requires it.
  • Data Sovereignty: all client data is hosted and stored within Australia — see Data Hosting & Sovereignty for specifics per product.

2. Application Security & Access Control

  • Strong Password Policies: enforcement of complex password requirements across all products.
  • Multi-Factor Authentication (MFA): available/required for administrative access — implementation differs by product (see product-specific pages).
  • Role-Based Access Control: granular permission settings so users only have the access they need.
  • Session Management: automatic timeout of inactive sessions and secure session handling.
  • Login Attempt Limitations: automatic blocking after repeated failed login attempts.

3. Data Protection

3.1 Data Encryption

  • Data-in-Transit Encryption: all communication with Agend products is encrypted using TLS.
  • Data-at-Rest Encryption: sensitive data is encrypted at rest, with additional application-layer encryption for particularly sensitive fields (e.g. payment gateway credentials).

3.2 Data Handling Procedures

  • Data Minimisation: we collect and retain only necessary data.
  • Data Classification: data is classified according to sensitivity, with handling procedures appropriate to each level.
  • Secure Data Disposal: data no longer needed is securely deleted according to industry best practice.

4. Backup and Recovery

  • Automated Backups: daily automated backups with 30-day retention across Agend products.
  • Off-site Backup Storage: backups stored in geographically separate Australian locations.
  • Regular Backup Testing: restoration processes are regularly tested to ensure data recoverability.
  • Disaster Recovery Planning: defined recovery time objectives (RTOs) and recovery point objectives (RPOs) per product.

5. Monitoring and Incident Response

5.1 Continuous Monitoring

  • 24/7 Security Monitoring: real-time monitoring for security incidents and anomalies.
  • Performance Monitoring: tracking application performance to detect unusual patterns that might indicate security issues.
  • Automated Alerting: immediate notification of suspicious activity or potential incidents.

5.2 Incident Response

  • Documented Incident Response Plan: step-by-step procedures for addressing security incidents.
  • Dedicated Security Contact: reach our security team at security@agend.com.au.
  • Post-Incident Analysis: thorough review after any security incident to improve processes.

Note

A fully documented, product-specific incident-response and breach-notification runbook is an active area of investment as part of our Agend Product Suite security programme — see Compliance & Standards for current status.

6. Compliance and Assessment

  • Regulatory Compliance: alignment with relevant Australian regulations, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
  • Security Assessment: we encourage clients to arrange independent penetration testing and vulnerability scans, and support automated vulnerability scanning internally.
  • Code Reviews: security-focused code review before deployment, across both products.

See Compliance & Standards for our position on PCI DSS, GDPR, the Essential Eight, ISO 9001, and ISO 27001.

7. Vendor Management

  • Vendor Security Assessment: thorough evaluation of all third-party vendors with access to our systems or data.
  • Preference for Independently Attested Vendors: we prefer vendors holding independent certifications such as SOC 2 Type II and ISO 27001 (e.g. our hosting and infrastructure providers).
  • Vendor Access Limitations: strict controls over vendor access to our systems and data.
  • Vendor Contract Security Provisions: clear security requirements in all vendor contracts.

8. Employee Security

  • Security Awareness Training: regular training for all team members on security best practices.
  • Acceptable Use Policies: clear guidelines for appropriate use of systems and data.
  • Principle of Least Privilege: staff are granted only the minimum access required for their roles.

9. Physical Security

  • Data Centre Security: our hosting providers maintain state-of-the-art physical security at their data centres.
  • Office Security: physical security measures at our offices to protect equipment and information.
  • Device Security: policies for the secure use and storage of company devices.

10. Continuous Improvement

  • Security Roadmap: planned security enhancements and timelines.
  • Regular Framework Review: periodic assessment and updating of this security framework.
  • Industry Trend Monitoring: staying current with evolving security threats and countermeasures.
  • Customer Feedback Integration: incorporating security suggestions from clients into our framework.

Conclusion

Agend's security framework demonstrates our commitment to protecting your sensitive member and organisational data, whichever Agend product you use. We view security as an ongoing process rather than a one-time achievement, and continually evaluate and enhance our posture to address emerging threats and incorporate new best practices.

We welcome any specific security requirements or questions — contact us for more detail on any aspect of our security framework.