Data Security & Compliance Policy

CALCPAD ACCOUNTING AND CONSULTING PROPRIETARY LIMITED ABN 23 646 714 810 Trading as CALCPAD calcpad.com.au

Policy status: Initial / Placeholder Effective date: 13 August 2026 Policy owner: CALCPAD Management Review frequency: At least annually and following material security or technology changes

1. Purpose

CALCPAD recognises that clients may entrust the business with commercially sensitive, financial, operational and personal information.

This Policy establishes the principles CALCPAD applies to protecting information and managing technology, privacy and compliance risks associated with the CALCPAD Platform and related professional services.

The Policy is intended to develop with the CALCPAD technology environment and risk profile.

2. Security objectives

CALCPAD's information-security framework is based on protecting:

Confidentiality — information is accessible only to authorised persons.

Integrity — information and calculations are protected against unauthorised or inappropriate modification.

Availability — systems and information remain reasonably available when required.

Accountability — material access and system activities can, where appropriate, be traced to authorised users.

Resilience — important information and systems can be restored following failure or disruption.

3. Risk-based security

CALCPAD will apply information-security controls having regard to:

the sensitivity of information;
foreseeable threats;
business impact;
Platform architecture;
legal and contractual obligations;
available security technology; and
proportionality of the control to the relevant risk.

Security controls will be periodically reassessed as the Platform develops.

4. Access control

Access to CALCPAD systems should follow the principles of least privilege and need to know.

CALCPAD will seek to ensure that:

each user has an individual account where appropriate;
administrative access is restricted;
access rights reflect the user's role;
obsolete access is removed;
privileged access receives additional protection;
client users cannot access information belonging to other clients unless expressly authorised; and
access permissions can be reviewed and changed when circumstances require.

5. Authentication

CALCPAD will maintain appropriate authentication controls for systems containing confidential or sensitive information.

Controls may include:

secure password requirements;
cryptographically protected password storage;
account lockout or rate limiting;
session controls;
multi-factor authentication where appropriate; and
additional authentication for administrative functions.

Passwords must not knowingly be stored in readable plain text.

6. Client data segregation

CALCPAD systems should be designed so that client information is logically separated from information belonging to other clients.

Authorisation controls must prevent a user from accessing another client's records merely by manipulating URLs, identifiers or other request parameters.

Data segregation and authorisation are treated as fundamental Platform controls.

7. Encryption

Where reasonably appropriate to the risk:

communications containing sensitive information should be encrypted in transit using contemporary encryption protocols;
stored information should receive encryption or equivalent infrastructure protection;
passwords must be cryptographically hashed using an appropriate password-hashing method; and
encryption keys and credentials should be appropriately controlled.

8. Backups and recovery

Important CALCPAD information and systems will be backed up at intervals appropriate to their importance and rate of change.

Backup arrangements should address:

automated or controlled backup processes;
protection against unauthorised access;
separation from primary production data where practicable;
retention of appropriate historical recovery points; and
periodic confirmation that important information can be restored.

Backup existence alone is not regarded as sufficient unless restoration is reasonably achievable.

9. Audit logging

CALCPAD will maintain appropriate audit records for material Platform activities.

Depending upon the system, logs may include:

authentication events;
account creation and modification;
security and permission changes;
client creation, amendment, archival or deletion;
significant data changes;
administrative activity;
report generation; and
suspected security events.

Logs will be protected against inappropriate alteration and retained for a period appropriate to their purpose.

10. Software and vulnerability management

CALCPAD will seek to maintain supported software and address known security vulnerabilities according to the risk they present.

Practices may include:

software dependency management;
operating-system and application patching;
removal of unsupported components;
vulnerability scanning;
code review;
security testing; and
remediation of identified weaknesses.

Changes to production systems should be appropriately controlled and tested.

11. Secure development

Security and privacy considerations should form part of Platform design rather than being considered only after deployment.

Development principles include:

validating user input;
appropriate server-side authorisation;
protection against common web application vulnerabilities;
separation of development and production environments where appropriate;
protection of credentials and secrets;
testing material changes before deployment;
controlled database changes; and
preservation of appropriate backup and rollback capability.

12. Service providers

Third-party technology providers may create information-security dependencies.

Before material confidential information is entrusted to a service provider, CALCPAD should consider matters including:

reputation and reliability;
security practices;
privacy terms;
data location;
authentication capability;
backup arrangements;
incident notification obligations;
subcontracting arrangements;
data portability; and
termination and deletion procedures.

The level of due diligence should be proportionate to the information and service involved.

13. Artificial intelligence

Use of external artificial intelligence services creates specific confidentiality, privacy, intellectual-property and accuracy risks.

CALCPAD personnel must consider these risks before providing client information to an AI service.

Where practical:

information should be minimised or de-identified;
confidential information should not be submitted unnecessarily;
provider data-use terms should be assessed;
material AI-generated outputs should be reviewed by a human before reliance; and
AI-generated information should not automatically be regarded as authoritative.

CALCPAD will not intentionally use confidential client information to train publicly accessible AI models without appropriate authority.

14. Privacy compliance

CALCPAD will manage personal information consistently with its Privacy Policy and applicable privacy laws.

Privacy considerations will include:

collecting only information reasonably required;
restricting use and disclosure;
maintaining appropriate security;
providing mechanisms for access and correction where applicable;
considering privacy when selecting service providers;
securely disposing of unnecessary information; and
responding appropriately to data breaches.

15. Regulatory and professional compliance

CALCPAD will identify legal, regulatory, contractual and professional obligations applicable to the services it actually provides.

Nothing in the availability of a CALCPAD calculator, model or workflow should be interpreted as representing that CALCPAD holds a regulatory licence or professional authorisation unless expressly stated.

Where a service requires a particular licence, registration, professional authority or engagement framework, CALCPAD will not represent that the service is being provided in that regulated capacity unless the relevant requirements have been satisfied.

16. Information classification

CALCPAD may classify information according to sensitivity.

A developing classification framework may include:

Public — information approved for public distribution.

Internal — operational information intended for CALCPAD personnel.

Confidential — client, financial, commercial or personal information requiring restricted access.

Highly Confidential / Restricted — information requiring enhanced protection because unauthorised disclosure could cause significant harm.

Controls should reflect the classification and risk of the information involved.

17. Data minimisation

CALCPAD will seek to collect and retain only information reasonably necessary for the relevant service or legitimate business purpose.

Users should avoid entering identifiable personal information into calculators where aggregated, anonymised or de-identified information will achieve the same purpose.

18. Security incidents

A security incident may include:

unauthorised access;
compromised credentials;
malware;
ransomware;
loss or theft of information;
unauthorised disclosure;
significant system vulnerability;
accidental destruction of information; or
inappropriate access to another client's information.

Suspected incidents should be promptly escalated and assessed.

19. Incident response

CALCPAD's response to a material security or data incident will generally involve:

Identification and containment — identify the incident and prevent further compromise.
Assessment — determine affected systems, information, users and consequences.
Preservation — preserve relevant logs and evidence where appropriate.
Remediation — remove or mitigate the cause and restore secure operation.
Notification — determine whether clients, insurers, regulators, individuals or other parties must or should be notified.
Recovery — restore affected systems and verify appropriate operation.
Review — identify lessons and implement appropriate improvements.

20. Data breach notification

Where applicable, suspected breaches involving personal information will be assessed under the Australian Notifiable Data Breaches framework and other relevant legal or contractual notification requirements.

CALCPAD will document the assessment and actions taken in relation to material incidents.

21. Business continuity

CALCPAD will consider reasonable arrangements for continuity and recovery of critical Platform and advisory-service functions.

These arrangements may address:

backup restoration;
loss of hosting services;
system failure;
loss of internet or communications;
cyber incidents;
loss of key equipment; and
loss of access to critical third-party services.

22. Personnel responsibilities

Anyone with authorised access to CALCPAD information or systems must:

protect authentication credentials;
access information only for legitimate purposes;
maintain confidentiality;
follow applicable security procedures;
promptly report suspected incidents; and
not deliberately bypass security controls.

23. Continuous improvement

Information security is an ongoing risk-management process.

CALCPAD will progressively review controls against recognised Australian cyber-security guidance, including relevant aspects of the Australian Signals Directorate's cyber-security guidance and Essential Eight, where appropriate to CALCPAD's environment and risk profile.

Reference to these frameworks does not represent that CALCPAD is certified or has achieved a particular maturity level.

24. Compliance representations

CALCPAD will not claim certification or compliance with a particular security standard unless that status has been objectively established.

In particular, publication of this Policy does not by itself represent:

ISO 27001 certification;
SOC 2 certification;
Essential Eight maturity accreditation;
PCI DSS compliance; or
certification under any other information-security framework.

Any future certification or independently assessed compliance status will be separately identified.

25. Policy review

This Policy will be reviewed:

at least annually;
following a material security incident;
following significant Platform architectural changes;
when CALCPAD begins handling materially different categories of information; or
when material legal or regulatory requirements change.

26. Contact

Security or compliance enquiries may be directed to:

CALCPAD ACCOUNTING AND CONSULTING PROPRIETARY LIMITED ABN 23 646 714 810 Trading as CALCPAD Website: calcpad.com.au Email: info@calcpad.com.au

Suspected security vulnerabilities should be reported privately and should not include unnecessary disclosure of client information.