Trust and compliance

Compliance you can show an auditor

Privacy, NDIS Practice Standards and security, with the documents to prove it.

NDIS providers are expected to protect participants’ personal information and to show, with evidence, that supports meet the Practice Standards. CompanionAxis makes both part of the daily work, so an audit, a Commission request or a participant’s question never turns into a scramble.

Request compliance documents How we secure data

Quality and compliance manager reviewing an audit pack with a colleague, calm office, natural light

Data residency

Hosted in AustraliaEncrypted in transit and at rest

Privacy Act 1988

Built for the Australian Privacy Principles

[Privacy policy version · DPA reference]

CompanionAxis handles participant and worker information on your behalf as a service provider, under a data processing agreement, with data hosted in Australia. You stay in control of your participants’ information; we give you the tools to show how it is collected, used and protected under the Australian Privacy Principles and the Notifiable Data Breaches scheme.

Consent, service agreements and signed forms kept with the participant record
Role-based access, so support workers see only the participants and records their shifts need
Audit log of who viewed, created, changed or exported a record, and when
Participant and worker data hosted in Australia
Prompt notice to you of any incident affecting your data, to support your Notifiable Data Breaches assessment
ISO 27001 and SOC 2 certificationSoon

How we protect participant information →Request our data processing agreement

NDIS Practice Standards

Evidence for the NDIS Commission

[Practice Standards evidence map version]

CompanionAxis is software, not a registered NDIS provider. It helps your organisation run supports the way the NDIS Practice Standards expect and keeps the evidence your auditor and the NDIS Quality and Safeguards Commission will ask for: incidents, restrictive practices, worker screening, complaints and risk.

Practice Standards evidence mapped to the records your team already keeps
Reportable incidents flagged, with the 24-hour and 5-business-day notification timeframes tracked
Regulated restrictive practices recorded against the authorisation and behaviour support plan, ready for monthly reporting
Worker Screening Checks, WWCC and qualifications tracked, with expiry alerts before rostering
Complaints, risk register and medication records kept with a full audit trail
Direct verification of Worker Screening ChecksSoon

How CompanionAxis supports NDIS compliance →Ask about NDIS compliance

Peace of mind, built in. The safeguards behind every participant record.

Encrypted everywhere

TLS between devices and the cloud and encryption for stored data, so records can’t be read in transit or at rest.

Daily, tested backups

Backups are kept apart from the main database and recovery is tested, so a bad day never means lost shift notes or claims.

Access by role

Support workers, team leaders, coordinators and finance staff each see only the participants, houses and records their role allows.

Full audit log

Every view, edit and export is logged with the user and the time, so you can answer a complaint, an auditor or the Commission with evidence.

Data hosted in Australia

Participant and worker information is stored in Australian data centres.

Breach notification

If something goes wrong we tell you without delay, so you can assess it and notify the OAIC and affected people under the Notifiable Data Breaches scheme where required.

Who does what

Your organisation holds the NDIS registration and is responsible for participants’ information under the Privacy Act. CompanionAxis is your software and service provider. Compliance is shared, and here is the split.

CompanionAxis takes care of

Host your data in Australia, encrypted and backed up
Platform security, access controls and the audit log
Tools that record consent, incidents, restrictive practices and worker screening
A data processing agreement for your files
Prompt notice of any incident affecting your data

Your organisation takes care of

Hold and maintain your NDIS registration and meet the Practice Standards
Notify reportable incidents and report restrictive practices to the NDIS Commission
Decide who gets which role, and remove leavers the same day
Collect consent and answer participants’ requests to access or correct their information
Assess suspected data breaches and notify the OAIC where required

The paperwork, ready for your file. Ask for any of these before you sign.

Request documents

Data processing agreementSecurity overviewPrivacy policyPractice Standards evidence map

Compliance questions

Is CompanionAxis a registered NDIS provider?

No. CompanionAxis is software. Your organisation holds the NDIS registration and remains responsible for meeting the Practice Standards and notifying the NDIS Commission. CompanionAxis helps you do that work and keep the evidence.

Where is our data stored?

In Australia. Participant and worker information is hosted in Australian data centres, encrypted in transit and at rest, with daily backups kept apart from the main database.

What happens if there is a data breach?

We notify you without delay with what we know and what we are doing about it, so you can assess the breach and notify the OAIC and affected people under the Notifiable Data Breaches scheme where required.

Are you ISO 27001 or SOC 2 certified?

Not yet. ISO 27001 and SOC 2 certification are in progress. [ISO 27001 certificate — in progress] In the meantime we share our security overview and answer your security questionnaire.

Can we see the paperwork before we sign?

Yes. Request our data processing agreement, security overview, privacy policy and Practice Standards evidence map, and we will send them for your review.