Security Overview
Plus Ultra Innovations Pty Ltd Wellbeing Dashboard Platform
Version: 2.0 Date: July 2026
About this document
Plus Ultra is a pilot-stage company. This overview describes the security controls that are in place today, and — separately and clearly — the controls we plan to add as we grow. We describe only what is true now. Where a control is planned rather than in place, it appears under Roadmap and nowhere else.
We would rather under-state our security than over-state it. Precision is the point.
1. Security today
1.1 Data architecture
The platform stores its data in a PostgreSQL database provided by Supabase, which also handles authentication and hosting. Supabase is our sole sub-processor of substance for platform data.
1.2 The control that matters most: aggregation enforced in the database
Individual responses are never exposed to an employer. Team-level reporting is gated at a minimum group size of 10, the same in every region. This is our own design choice — not a statutory minimum — and it is enforced by row-level security in the database itself, not in the interface where it could be bypassed; no configuration lowers it for any customer. Below the threshold, no team-level metric is shown.
The one place a number below 10 appears is the anonymous batch feedback channel, and only because its privacy model is structurally different: no author identity is recorded at submission, comments are shuffled, and results are reported at the organisation level only, never by team. It releases at 5 comments in organisations under 50 people, and 3 in larger organisations. Team-level reporting is always 10.
This is the security property we most want a buyer to test, and the one we are most confident in.
1.3 Encryption
- In transit: connections are encrypted with TLS.
- At rest: data is encrypted with AES-256, managed by Supabase.
1.4 Data residency
Australian data is hosted in the Supabase Sydney region (ap-southeast-2), with backups held in the same region.
1.5 Access and authentication
- Authentication is provided by Supabase Auth.
- Multi-factor authentication (MFA) is enabled.
- Access is role-based and follows least-privilege principles, with row-level security ensuring a user reaches only the data they are entitled to see.
1.6 Infrastructure certification (inherited)
The platform runs on SOC 2 Type II-certified infrastructure (Supabase). To be precise: that is our infrastructure provider's certification, not ours. Plus Ultra does not itself hold SOC 2 today (see Roadmap).
1.7 Regulatory alignment
The platform is built in alignment with the Australian Privacy Act 1988 and, for Singapore, the Personal Data Protection Act (PDPA). We say "aligned with", not "compliant": alignment is something we design for; a compliance verdict is not ours to issue.
2. Roadmap — planned as we scale
The following are planned, not in place today. We will not describe them as current until they are:
- Formal SOC 2 Type II certification for the platform itself (not only the infrastructure).
- ISO 27001 certification.
- Independent third-party penetration testing.
- A formalised internal security programme — documented policies, staff training, and an incident response plan.
No dates are attached to these deliberately; we would rather commit to them when they are real.
3. How to assess us
We are a pilot-stage company, and at this stage an honest technical conversation tells you more than a paper certificate would. We welcome a walkthrough with your IT or security team — the data architecture, the minimum-group-of-10 database control, data residency, and our use of Supabase — so you can judge the platform on what it actually does.
To arrange one, get in touch through the contact form on our website.
This overview reflects our security posture as of July 2026 and describes only controls that are in place today. Planned controls appear under Roadmap.