Security Overview
Plus Ultra Innovations Pty Ltd Wellbeing Dashboard Platform
Version: 2.2 Last updated: 3 September 2026
About this document
Plus Ultra is a pilot-stage company. This overview describes the security controls that are in place today, and — separately and clearly — the controls we plan to add as we grow. We describe only what is true now. Where a control is planned rather than in place, it appears under Roadmap and nowhere else.
We would rather under-state our security than over-state it. Precision is the point.
1. Security today
1.1 Data architecture
The platform stores its data in a PostgreSQL database provided by Supabase, which also handles authentication and hosting. Supabase is our sole sub-processor of substance for platform data.
1.2 The control that matters most: a minimum group of 10
Individual responses are never exposed to an employer. Team-level reporting is gated at a minimum group size of 10, the same in every region. This is our own design choice — not a statutory minimum. The floor cannot be reconfigured: there is no admin setting, environment variable, feature flag or per-organisation field that can lower it for any customer. It is enforced across the aggregation surfaces, not left to the interface where it could be bypassed. Below the threshold, no team-level metric is shown.
The one place a number below 10 appears is the anonymous batch feedback channel, and only because its privacy model is structurally different: no author identity is recorded at submission, comments are shuffled, and results are reported at the organisation level only, never by team. It releases at 5 comments in organisations under 50 people, and 3 in larger organisations. Team-level reporting is always 10.
Named feedback is a separate channel and a separate property. It is confidential rather than anonymous, and disclosure is consent-driven. A worker's private feedback stays private: no administrator view, export or report resolves it to its author, and Plus Ultra does not read it — the first is architecture, the second is policy, and we state the two halves separately because they are not the same kind of guarantee. A worker may choose to share a line with a named reader they explicitly select; that line, and only that line, is delivered to that reader word for word. A record links an author to their own submission — that is what lets them read it back and withdraw it — so "anonymous" would be the wrong word.
This is the security property we most want a buyer to test, and the one we are most confident in.
1.3 Encryption
- In transit: connections are encrypted with TLS.
- At rest: data is encrypted with AES-256, managed by Supabase.
1.4 Data residency
Australian data is hosted in the Supabase Sydney region (ap-southeast-2), with backups held in the same region.
1.5 Access and authentication
- Authentication is provided by Supabase Auth.
- Multi-factor authentication (MFA) is enabled.
- Access is role-based and follows least-privilege principles, with row-level security ensuring a user reaches only the data they are entitled to see.
1.6 Infrastructure certification (inherited)
The platform runs on SOC 2 Type II-certified infrastructure (Supabase). To be precise: that is our infrastructure provider's certification, not ours. Plus Ultra does not itself hold SOC 2 today (see Roadmap).
1.7 Regulatory alignment
The platform is built in alignment with the Australian Privacy Act 1988 and, for Singapore, the Personal Data Protection Act (PDPA). We say "aligned with", not "compliant": alignment is something we design for; a compliance verdict is not ours to issue.
2. Roadmap — planned as we scale
The following are planned, not in place today. We will not describe them as current until they are:
- Formal SOC 2 Type II certification for the platform itself (not only the infrastructure).
- ISO 27001 certification.
- Independent third-party penetration testing.
- A formalised internal security programme — documented policies, staff training, and an incident response plan.
No dates are attached to these deliberately; we would rather commit to them when they are real.
3. How to assess us
We are a pilot-stage company, and at this stage an honest technical conversation tells you more than a paper certificate would. We welcome a walkthrough with your IT or security team — the data architecture, the minimum group of 10 and how it is enforced, data residency, and our use of Supabase — so you can judge the platform on what it actually does.
To arrange one, get in touch through the contact form on our website.
This overview reflects our security posture as of 5 August 2026 and describes only controls that are in place today. Planned controls appear under Roadmap.