How we protect this website

Staff accounts sign in with a password and a second step: a passkey or an authenticator app.
Every action is checked against one authorisation policy on the server.
Important events are written to an audit log sealed in a chain, so changes to it can be detected.
Pages are served with a strict content security policy, and requests are rate limited.
Files sent to us are checked for malware before anyone opens them.
Backups are encrypted, kept as two separate copies, and restores are tested.
Dependencies are checked for known vulnerabilities before every release.

Reporting a vulnerability

If you believe you have found a security vulnerability in this website or a system we run, please tell us. Email info@kvctech.com.au with the subject "Security report" or use the contact form and choose "A security report". Include what you found, where, and how to reproduce it.

We will acknowledge your report within five business days, keep you informed, and credit you if you wish once the issue is fixed. Please do not access or change other people's data, disrupt the service, or publish details before we have had a reasonable time to fix the issue.

Our security.txt file gives the same contact for automated tools.

Last reviewed: 26-10-2026.