Security and data
Where your data lives, what we hold, who touches it, and how to get rid of it.
Last updated 7 September 2026. The Privacy Policy is the governing document; this page is the technical summary.
In one paragraph. The database is in Sydney, Australia. It holds practice and client names, pay-run dates and super guarantee totals — no tax file numbers and no employee records. Each practice can only read its own rows, enforced in the database. Everything is encrypted in transit and at rest, backed up daily, and can be deleted on request.
Where data lives
The database and authentication service run on Supabase in the Sydney region (AWS ap-southeast-2). That is the only place customer data is stored. The website itself is static files on a CDN and stores nothing.
What is stored
| Account | Email address, password hash (we cannot read the password), practice name, time zone, plan. |
|---|---|
| Clients | Business name, ABN, state, payroll platform, pay cycle, super payment channel, clearing-house lead time, your notes. |
| Pay runs | Pay date, period, and the run's total ordinary time earnings and super guarantee amount. |
| Alerts | Which reminders were scheduled and sent, and where. |
| Billing | Plan, status, renewal date and Stripe's customer reference. Never card numbers. |
Not stored, by design: tax file numbers, employee names or contact details, individual salaries or contributions, fund member numbers, bank or card details. SuperDue works on a date and a total; it never needs to know who anyone is.
Who can see what
Every table that holds customer data has row-level security switched on in PostgreSQL. A signed-in user can only read or change rows that belong to their own practice; the rule is enforced by the database, not by the application, so a bug in the web app cannot expose another practice's data. Anonymous visitors can read nothing from those tables. The public-holiday and rule tables are reference data and are readable by anyone.
The free deadline checker's reminder list is stricter still. Row-level security is on with no policies at all, which means no anonymous or signed-in caller can read or write it — not even with the publishable key that is in the page source by design. Every sign-up, confirmation and unsubscribe goes through a small server-side function that holds the only credential able to touch it, and that function stores nothing but the address and the deadline you asked about.
Who processes data for us
| Supabase | Database, authentication. Sydney, Australia (data); US company. |
|---|---|
| Netlify | Hosts the website. Serves pages only; no customer data. US company, global CDN. |
| Stripe | Billing only, when you subscribe. Holds your name, email and card details; we never see the card. US company. |
| Resend | Transactional email — sign-in, password reset, and deadline alerts, which are on by default to the address you signed up with, and the free deadline checker's confirmation and reminder emails if you ask for those. Sees the address and the message. Every alert and every reminder carries a one-click unsubscribe and you can switch email off in Settings at any time. US company; our sending region is Tokyo, Japan (AWS ap-northeast-1). |
| Slack, Microsoft or Discord | Only if you paste one of their incoming-webhook URLs into Settings. Alert text is then posted to that channel and passes through that vendor's servers, outside Australia. Only those three hosts are accepted and the URL is never followed through a redirect. |
| Google Workspace | Support mail to hello@superdue.com.au. Anything you email us is stored there. US company. |
| Telegram | Only if you opt in to Telegram alerts. The service is provided by Telegram Messenger Inc., whose parent Telegram Group Inc. is registered in the British Virgin Islands and whose group includes Telegram FZ-LLC in Dubai. Alert text passes through Telegram's servers, which are outside Australia. |
No analytics, advertising or tracking providers. A page on this site makes no third-party requests at all: every script, stylesheet and typeface is served from superdue.com.au itself (the fonts moved off Google's font service on 7 September 2026), and the content security policy allows no other script, style or font origin. The only other host your browser talks to is our database provider in Sydney (listed above) — for the verified public-holiday calendar the free checker reads, and for your own data once you sign in.
Encryption
All traffic uses HTTPS (TLS). The database storage and its backups are encrypted at rest by the provider. Passwords are stored as hashes and checked against known-breached password lists at sign-up.
Backups
The database is backed up daily by Supabase and retained for seven days — the retention on our current Supabase plan. Backups live in the same Sydney region. Deleting your data removes it from the live database immediately; it ages out of the backups within that window.
If there is a breach
If a data breach is likely to result in serious harm we will notify affected practices directly and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and we will say plainly what happened. Because we do not hold TFNs, employee data or payment details, the categories that make a breach severe are not in the system to lose.
Deleting your account and data
Email hello@superdue.com.au from your account address. Your practice, clients, pay runs, alerts and activity log stay available for export for 30 days after the account closes, as Terms §12 promises — so you always have time to take your records with you. After that we delete them, along with the billing record and the login itself, except anything we are legally required to keep (for example invoices). If you would rather it all went sooner, say so and we will delete it as soon as you have your export.
Who operates SuperDue
SuperDue, a registered Australian business name (ABN 91 346 778 459), Perth, Western Australia. Security questions or reports: hello@superdue.com.au. If you find a vulnerability, tell us before you tell anyone else and we will fix it and thank you.