Written for the person who has to ask the hard question.
If your club is handing over records about children, you are entitled to a straight account of where they go and who can reach them. This page is that account, including the parts that are still in progress.
Australian by design — and verified before your records go in.
The design commitment is that personal information is stored and processed in Australian regions only. Concretely:
- Infrastructure is defined as code targeting AWS Sydney (ap-southeast-2).
- Any AI feature is restricted to models running in an Australian region. Cross-region inference routes are refused in the code and denied at the permission layer — and AI analysis is switched off by default regardless.
- Services without an Australian residency guarantee are excluded rather than used with a caveat.
Where this is honest rather than absolute: GovSport is in early access and the production stack is mid-migration onto that Australian infrastructure. Before any real club records are loaded, I confirm in writing exactly where your club's data sits — hosting region, database region and backups. If it isn't in Australia at that moment, you will be told that, not sold around it.
Who can reach what.
Fails closed
If entitlement to a module can't be established, access is refused. There is no "allow by default" path for sensitive modules.
Tenant and organisation scoped
Every query is scoped to your club. A record belonging to another organisation is not reachable by guessing an identifier.
Role-based, least privilege
Committee, safeguarding, coaching and administrative roles see different things. Being an administrator of one area does not grant another.
Multi-factor authentication
Time-based one-time codes, enrolled from the portal, and able to be required on child-data and audit surfaces.
No open sign-up
Public self-registration is closed. Accounts are created by an administrator of a specific club, so nobody joins a tenant by finding a URL.
Rate limited sign-in
Authentication attempts are limited per client address, and the limiter can't be reset by forging a proxy header.
Audit logging.
- Access to and changes of sensitive records are written to an append-only audit log with actor, time, entity and change.
- Log payloads carry identifiers, never a child's personal details — an audit trail should not become a second copy of the data it protects.
- A failure to write an audit entry is surfaced, not silently swallowed.
- The log is retained under a retention period you set; until you set one, nothing is deleted.
Built as though the Privacy Act applies in full.
Many community clubs sit under the small-business exemption. GovSport is designed as though they don't, because a child's record does not care about a turnover threshold.
- Collection notices shown at the point personal information is collected, saying what it is for and how long it is kept.
- Purpose limitation — data collected for a stated purpose isn't repurposed silently.
- Retention limits — form submissions are deleted when their declared retention window expires.
- Access and correction — an individual's data can be exported across every table that holds it.
- Erasure — a deletion request scrubs identifying fields and removes dependent records, not just the primary row.
How the code is kept honest.
Continuous checks
Every change runs linting, type checking, unit tests, integration tests against a real database, security regression tests, a dependency audit and a secret scan before it can merge.
No fabricated data
The platform does not invent numbers to fill a screen. If a figure can't be produced, the screen says so. That rule is enforced in review and in tests.
Synthetic test data only
No real personal information is used in development or testing, ever.
Encryption in transit and at rest
TLS for everything in transit; storage encrypted at rest. Secrets live in environment configuration and are never committed to the repository.
Parameterised queries
Database access goes through a typed query layer. Input is validated on the server, not just in the browser.
Vulnerability response
Dependency advisories are gated in the build. Found something? security@govsport.com.au.
What GovSport is not.
GovSport is not ISO 27001 certified, and not SOC 2 attested. The controls are being built toward an ISO 27001 path, and I will say so plainly the day that changes. Anyone selling you a compliance product should be able to answer this question without a brochure.
There is no independent penetration test report yet. When there is one, it will be offered to clubs on request.
Questions your association or insurer needs answered?
Send them through and I'll answer them directly, in writing.