Security and privacy are part of how MEMBER is built.
Organisations trust MEMBER with information about real people and real relationships. Access, permissions and data handling are designed into the platform from the beginning.
The right information for the right people.
MEMBER is designed around organisation-aware access. A user can only work within the organisations, roles and areas they have been authorised to access.
Access is controlled
MEMBER limits access according to the organisation, role and scope a user has been authorised to work with.
Organisation information stays separated
A user may belong to more than one organisation, but access is resolved within the active organisation and its authorised scope.
Members see what is intended for them
Member-facing experiences are separated from internal organisational information such as private notes, internal workflows and user-only context.
Secure authentication
MEMBER uses managed authentication infrastructure to verify identity and maintain authenticated sessions.
Encryption in transit and at rest
MEMBER uses infrastructure that protects data using encryption while it is being transmitted and while it is stored.
Australian primary infrastructure
MEMBER's primary application compute and database infrastructure are currently configured in Sydney, Australia.
MEMBER's principal security controls have been reviewed.
An internal application security review was completed across MEMBER's current pilot environment, with the principal access, privacy and privileged-operation controls examined directly in the application and supporting infrastructure.
- Review date
- 29 September 2026
- Review type
- Internal application security review
- Status
- Principal pilot-environment controls reviewed
Review scope
The review covered the areas most relevant to protecting organisation and member information in MEMBER:
- Authentication and authenticated-session handling
- Organisation-aware access and role-based permissions
- Row Level Security across MEMBER's public database tables
- Member identity binding and member-facing access boundaries
- Private messages, message participation and attachment access
- Invitation and account-activation security flows
- Server-side handling of privileged credentials and secrets
- MRIE authentication, person access and matter access controls
- Storage access controls for private MEMBER files
- Read-state and member notification isolation
This review is an internal technical assessment of MEMBER's current controls. It is not an independent penetration test, external certification or guarantee that security incidents cannot occur.
Controls that protect MEMBER today.
The review focused on how MEMBER limits access, handles privileged operations and protects information across organisation and member experiences.
Database access controls
MEMBER uses Row Level Security and organisation-aware application logic to restrict access to information according to the authenticated user, organisation and authorised scope.
Private communications
Private message access is tied to the authenticated member or authorised organisation user. Attachment access is checked before temporary access is granted.
Privileged operations
Privileged server credentials are kept out of the browser. Sensitive operations are performed server-side after the relevant user and organisation access checks.
MRIE access controls
MRIE requests require an authenticated user and are checked against the person or matter being analysed before an AI request is made.
Invitation security
Invitation flows use time-limited verification mechanisms and server-side checks before access is activated or privileged authentication functions are used.
Session and abuse protection
MEMBER uses managed authentication controls including access-token expiry, refresh-token protection and configured authentication rate limits.
Intelligence operates inside MEMBER's permission model.
MRIE, the Member Relationship Intelligence Engine, helps authorised users understand information, identify what may need attention and prepare for the next interaction.
MRIE does not give a user access to information they would not otherwise be authorised to see inside MEMBER.
Where MEMBER uses external AI services, information is sent only when required to perform the relevant function. Current MEMBER AI requests are configured not to create stored Responses API application state.
Your information is not there for everyone to see.
MEMBER helps your organisation maintain information about its relationship with you. That may include your contact details, communications, interactions, follow-ups and other information relevant to that relationship.
Your information is only available to people who have been given the appropriate access within your organisation.
Some information recorded by an organisation is internal, such as private notes or internal workflow information, and is not displayed in the member experience.
For more detail about how MEMBER collects, uses and protects personal information, read our Privacy Policy.
Security review does not stop at launch.
MEMBER is still progressing through its pilot stage. The security review also identified controls that will be strengthened as the platform moves toward broader production use.
Automated database backups
Scheduled database backups are not currently included in the pilot environment. Daily managed backups are planned when MEMBER moves to the appropriate production infrastructure tier.
Point-in-time recovery
Point-in-time database recovery is not currently enabled. It remains a production resilience option as MEMBER's operating requirements grow.
Mandatory MFA
Multi-factor authentication capability is available, but it is not currently mandatory for every organisation user.
Additional file-type restriction
One evidence-storage area currently relies on access controls and upload-size limits without a dedicated MIME-type allowlist. Further restriction is planned as part of ongoing hardening.
Review status
The principal security controls supporting MEMBER's current pilot environment have been reviewed. Security review remains an ongoing part of product development as MEMBER moves toward broader production use.
Specialist infrastructure supports MEMBER.
MEMBER uses established technology providers for core infrastructure and selected services.
Supabase
Database, authentication and application data services.
Vercel
Application hosting and delivery infrastructure.
OpenAI
Selected MRIE intelligence and language-processing functions.
Resend
Transactional email such as invitations and service messages.
MEMBER's primary application compute and database infrastructure are currently configured in Sydney, Australia. Some supporting services may process information outside Australia where required to provide their service.
Relationship information deserves careful handling.
MEMBER is designed to help organisations understand and support their people while maintaining clear boundaries between member information, internal organisational information and user access.