Worker profiles, identity documents, licences and training records are stored in Australia (AWS Sydney) using Supabase for authentication, database and private file storage.

Expiry reminders and invites are sent by email through Resend. Message content and delivery logs are stored by Resend in the United States. Reminder emails never include document files or images.

Organisation administrators can delete a worker record. Files are removed and personal details are anonymised. Audit and access logs are kept in anonymised form so the organisation can still see that an action occurred.

Document views and downloads are logged against the signed-in user.