Security and your data — HarvestFlow

Cloud Infrastructure & Hosting

Harvest Flow is hosted on the Google Cloud Platform (GCP), one of the world's most secure cloud environments. To guarantee data sovereignty and optimal performance for our local users, all primary databases and application servers are hosted in Sydney, Australia. We leverage scalable, serverless technologies to ensure the system remains stable even during peak usage periods.

Data Encryption

• In Transit All data transmitted between your devices (mobile phones, web browsers) and our servers is encrypted using industry-standard TLS/HTTPS protocols.
• At Rest All data stored within our databases is encrypted at rest using advanced encryption algorithms (e.g., AES-256), meaning your sensitive notes and contact details are shielded from unauthorized access.

Access Control & Authentication

• Role-Based Access Control Harvest Flow employs strict role-based access controls. Your organization's administrators have full authority to grant or revoke system access for their team, ensuring each member only sees the information necessary for their specific role.
• System Integrity We operate on a principle of least privilege. Our own engineering team does not have direct access to your organization's raw data unless explicitly granted temporary permission by you for troubleshooting purposes.

Backups and Reliability

We understand that losing follow-up data is not an option. Our systems perform automated, routine backups of your database. In the unlikely event of a hardware failure or disruption, our disaster recovery protocols allow us to restore services and data quickly, minimizing any impact on your day-to-day workflow.

Application Security

The Harvest Flow application is built using modern, secure development frameworks. We continuously monitor our infrastructure for vulnerabilities and apply the latest security patches to our cloud environments to defend against emerging threats.

Incident Response

While no system is completely immune to security incidents, we have protocols in place to detect and respond to anomalies rapidly. In the event of a confirmed data breach that compromises your information, we commit to notifying your designated account administrators promptly, outlining the nature of the breach and the steps we are taking to mitigate it, in full compliance with the Notifiable Data Breaches (NDB) scheme in Australia.

On the NDIS digital platform rules.

From 1 July 2026 the NDIS Commission registers “digital platforms” as a class of support. That class covers systems that sit between participants and workers and move plan funds through themselves. HarvestFlow does neither — we're provider-side operations software. We don't match participants to workers, and your invoices go from you to your client or their plan manager, and are paid to your bank account, not ours.