Built for data you are accountable for
Community housing providers hold sensitive personal data on behalf of vulnerable people. Every design decision in Chenashe starts from that responsibility.
Hosted in Australia
All data is stored in Sydney-region infrastructure. Your tenant records, financial data, and documents never leave Australian jurisdiction.
Mandatory two-factor authentication
Every staff and admin account is required to set up MFA before accessing the system. This is enforced at the database level, not just the application — it cannot be bypassed.
Row-level data isolation
Data isolation is enforced in the database itself using PostgreSQL Row Level Security policies, not just application logic. Every table carries RESTRICTIVE policies that scope all reads and writes to the caller’s organisation. Even if the application layer had a bug, the database would not expose another organisation’s data.
Deploy-time safety assertion
A database migration runs on every deploy that checks every table has the required security policies. If a developer adds a new table without the correct isolation guards, the deploy fails automatically. No table can silently skip security.
Full audit log
Every change — who did what, when, and what the previous value was — is recorded in an immutable audit log. Admins can review the full change history from the app. Impersonation actions (platform support accessing your account) are logged separately with their own audit trail.
Offline data encrypted & wiped
When staff use the app offline in the field (inspections, wellbeing checks), data is encrypted on-device. When they sign out, local data is wiped. A lost phone does not mean lost tenant data.
Payments handled by Stripe
Card payment processing is handled entirely by Stripe, a PCI Level 1 certified provider. Card numbers are never transmitted to, processed by, or stored on Chenashe servers. Your organisation’s PCI scope stays minimal.
Security controls mapped to standards
Security controls are mapped to ISO/IEC 27001:2022 Annex A and SOC 2 Trust Services Criteria, with a maintained evidence register. This is an active readiness posture — controls are documented, tested, and maintained against these frameworks.
AI drafts. People decide.
Chenashe includes AI-assisted drafting for inspection summaries, notices, and VCAT applications. Here is how we keep it safe:
- Every AI output is clearly labelled “SUGGESTION ONLY”
- Nothing is ever sent automatically — a staff member must review, edit, and explicitly approve every draft
- AI drafting is only available for tenants who have consented to it (the tenant controls this from their portal privacy settings)
- No content reaches a tenant or a tribunal without a human approving it first
Questions about security?
We are happy to walk your board or IT team through our security posture. Contact us at hello@chenashe.au to arrange a security briefing.