Last updated 12 Oct 2026
How Autonomy Care protects participant information
The controls in the product today, described plainly.
Autonomy Care protects participant information with field-level encryption for sensitive details, activity logs that can't be edited and are hash-chained to detect tampering, two-step sign-in, single sign-on with Microsoft Entra ID or Google Workspace, custom roles and permissions, and encrypted backups. Here is what each control does, and what we haven't confirmed yet.
Where is our data stored?
Don't publish a location until it is in place.
Which privacy rules do you follow?
Autonomy Ops follows the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our privacy policy explains what we collect, why, and how to ask for access or a correction.
How is sensitive information encrypted?
Sensitive fields are encrypted in the database with AES-256-GCM, using a key kept separate from the application key. They include NDIS numbers, dates of birth, medication and MAR details, progress note text, incident narratives and complaint details. Exact NDIS number lookups use a keyed index so the number itself isn't stored in plain text.
How can we see who accessed or changed a record?
Activity logs record who did what and when, and can be exported as CSV. Document records also log each view and export. Audit tables can't be updated or deleted, activity logs are hash-chained for each organisation, and the chain is checked every night with an alert if it is broken. Logs are kept for at least 7 years.
Can staff sign in with our Microsoft or Google accounts?
Yes. Single sign-on uses OpenID Connect with Microsoft Entra ID or Google Workspace, set up for your organisation. You can require it for admins or all staff, and owners keep a separate break-glass sign-in. Two-step sign-in with an authenticator app can be optional, required for admins or required for everyone.
Who can see what?
Access is controlled by roles you define, with fine-grained permissions grouped by module. Sensitive document records need an extra permission, and family members only see what you allow for each contact.
How are backups handled?
The design is nightly database backups, encrypted before upload, kept daily for 35 days, monthly for 13 months and yearly for 7 years, with a restore check and quarterly restore drills.
How do you handle a data breach?
Under the Notifiable Data Breaches scheme in the Privacy Act 1988, an organisation that suspects an eligible data breach must assess it within 30 days. If serious harm is likely, it must notify the people affected and the Office of the Australian Information Commissioner as soon as practicable.
Is our data kept apart from other organisations?
Yes. Every request is limited to your organisation's records. Before release this was tested with a scan of all 830 routes and 1,168 requests that tried to reach another organisation's records.
What do notifications and text messages show?
Push notifications on a locked phone and text messages never name a participant or show their details. They say something needs attention and open the app or portal for the rest.
How are files and public forms protected?
Files such as message attachments and payslips open through signed links that expire. Public forms, such as referrals and applications to use Autonomy Care, use Cloudflare Turnstile to stop automated submissions without a puzzle.
What we can and can't say yet
It does
- Encrypts sensitive fields with AES-256-GCM, using a separate key
- Keeps activity logs that can't be edited, hash-chained and checked every night, for 7 years
- Supports two-step sign-in and single sign-on with OpenID Connect (Microsoft Entra ID, Google Workspace)
- Lets you define roles with permissions for each module
- Keeps each organisation's records apart
It doesn't
- Doesn't support SAML single sign-on
- Doesn't yet hold certifications such as ISO 27001
- Doesn't yet guarantee where data is hosted
How it supports your NDIS obligations
Autonomy Care supports these obligations. It doesn't make your organisation compliant on its own, and it isn't certified or endorsed by the NDIS Commission.
Reportable incidents
The 24-hour and 5-business-day deadlines are counted in business days, skipping public holidays, with alerts before and after.
Incidents and complaintsComplaints
Complaints follow your timeframes, and the person who raised one can see its status. Families can complain from the Family portal.
Family portalRisks and corrective actions
Risks are kept in a risk register, and corrective actions from incidents, complaints, risks and audits are tracked to closure, with reminders when one is overdue.
Incidents and complaintsWorker screening
A missing, expired or unverified NDIS Worker Screening check blocks rostering.
Training and competenciesCredentials
Workers are reminded 30, 14 and 7 days before a credential expires, and on the day.
Policies and records
71 form templates that reference the NDIS Practice Standards, with review dates, approvals and signatures.
Document Centre
More for IT and security teams
Enterprise and multi-site
Single sign-on, the two-step policy, roles, module licensing and a controls table
About Autonomy Care for larger providersTrust centre
Security, privacy, AI and accessibility in plain words, and what isn't decided yet
Visit the Trust centrePublic API and webhooks
Scoped keys stored as a hash, and signed webhooks
About the API
Frequently asked questions
Where is our data stored?
Don't publish a location until it is in place.
Can staff sign in with Microsoft or Google?
Yes. Single sign-on works with Microsoft Entra ID and Google Workspace using OpenID Connect. Your organisation can require it for admins or for all staff. The mobile app doesn't support single sign-on; workers sign in with a password, plus two-step sign-in if your organisation requires it or the worker turns it on.
Do you support two-step sign-in?
Yes. Staff can use an authenticator app with one-time recovery codes. Your organisation can make it optional, required for admins, or required for everyone.
Can we see who accessed or changed a record?
Yes. Activity logs record who did what and when, and can be exported. Document records also log every view and export. Logs can't be edited or deleted, and are hash-chained so tampering can be detected.
Do you use AI on our participants' information?
Signals and the note coach follow fixed, written rules and don't use AI. There is one optional add-on, AI note summaries, and it is off by default: it isn't one of the standard modules, and an admin must also switch it on. When it's on, a staff member can ask for a suggested summary of a progress note. The note's text is sent to OpenAI and processed outside Australia, with participants' names replaced first, and Autonomy Care doesn't store the text it sends.
Can we get our data out if we leave?
Yes. Most registers and records can be exported as CSV or PDF while you are a customer, and an admin can export everything held about one participant or staff member in a single download. Form records are kept for at least 7 years while you use Autonomy Care.
If your subscription ends, you keep read-only access for 30 days so you can export what you need, and if you ask during that time we'll send you a copy of your data in common formats, such as CSV and PDF. We then delete your organisation's data within 90 days, unless the law requires us to keep something longer. There's no fee to leave or to take your data with you.
You stay responsible for keeping your own NDIS records for as long as the rules require, such as 7 years for incident and complaint records, so export them before you go. Our terms of use summarise these terms, and your customer agreement with us governs.
See it with your own rosters and plans
Get started, or book a demo and we will walk you through it with your questions.