Security Statement

1. About this Security Statement

1.1 This Security Statement provides a summary of the technical and organisational measures Tradie View Pty Ltd (“TradieView”, “we”, “us” or “our”) uses to protect the Platform and Customer Data.

1.2 This Statement is intended as a public-facing overview. More detailed information may be provided to enterprise customers under appropriate confidentiality arrangements or via the Data Processing Addendum and Sub-Processor List.

1.3 This Security Statement is referenced by, and should be read alongside, the Data Processing Addendum and the Privacy Policy.

1.4 Capitalised terms not defined in this Statement have the meaning given in the Terms & Conditions or Privacy Policy.

2. Infrastructure and Hosting

2.1 TradieView is hosted on reputable cloud infrastructure, with a managed database service as the primary data store, and optional CDN, web application firewall, DDoS protection and SSL/TLS services from leading edge-security providers where applicable.

2.2 Production systems are designed with resilience, monitoring and backup capabilities appropriate to the nature of the service.

2.3 Specific infrastructure and sub-processor details are maintained in the Sub-Processor List at https://tradieview.com/legal/sub-processors.

2.4 TradieView maintains separate production and non-production (development, staging and testing) environments. Customer Data is not used in non-production environments except where reasonably necessary for support or troubleshooting a specific customer issue, and where used is subject to the same access restrictions described in Section 4.

3. Encryption

3.1 Data in transit is protected using TLS/HTTPS.

3.2 Customer Data stored in production data stores is encrypted at rest.

3.3 Encryption keys and secrets are managed using secure practices appropriate to the environment.

4. Access Control

4.1 Access to production systems and Customer Data is restricted on a least-privilege, need-to-know basis.

4.2 Multi-factor authentication (MFA) is enforced for administrative and privileged access where supported.

4.3 Role-based access controls are used to limit permissions within the Platform and internal systems.

4.4 Administrative access is logged and monitored.

4.5 Personnel with access to Customer Data are subject to confidentiality obligations and receive security awareness training appropriate to their role.

5. Application and Platform Security

5.1 TradieView applies secure development practices, including code review and vulnerability management processes appropriate to the stage of the business.

5.2 Security updates and patches are applied to infrastructure and dependencies in a timely manner.

5.3 Web application firewall and related controls are used where appropriate to protect against common web threats.

6. Monitoring, Logging and Incident Detection

6.1 TradieView maintains logging and monitoring of production systems for security and operational purposes.

6.2 Suspicious activity is investigated and escalated according to internal processes.

6.3 Security incidents are handled in accordance with the Privacy Policy, Data Processing Addendum and applicable law (including the Notifiable Data Breaches scheme).

7. Vulnerability Management and Testing

7.1 TradieView maintains processes for identifying, assessing and remediating security vulnerabilities.

7.2 Unauthorised testing, scanning or probing of the Platform by Customers or third parties is prohibited without prior written permission.

7.3 TradieView welcomes good-faith reports of security vulnerabilities. Researchers who discover a potential vulnerability should report it to support@tradieview.com with sufficient detail to reproduce the issue, and should not access, modify or exfiltrate Customer Data beyond what is strictly necessary to demonstrate the issue.

TradieView will acknowledge reports in a reasonable time and will not pursue legal action against a researcher who makes a good-faith report in accordance with this clause and does not publicly disclose the issue before it is resolved.

8. Data Breach Response

8.1 TradieView maintains processes to assess, contain and remediate suspected or actual security incidents affecting Customer Data.

8.2 Where required under the Notifiable Data Breaches scheme or another applicable law, TradieView will notify affected individuals, business customers and the Office of the Australian Information Commissioner as soon as practicable, consistent with the main Privacy Policy and the Data Processing Addendum.

8.3 Customers must promptly notify TradieView of any suspected unauthorised access to their Account, credentials or Customer Data at support@tradieview.com.

9. Backups and Recovery

9.1 Production Customer Data is backed up on a regular schedule.

9.2 Backup retention and recovery processes are designed to support business continuity and the post-termination export commitments described in the Terms & Conditions and Privacy Policy.

9.3 Residual data in backups is overwritten in the ordinary backup cycle.

10. Third-Party Providers

10.1 TradieView uses carefully selected third-party providers for hosting, security, communications, payments, AI and other services.

10.2 Material providers are listed in the Sub-Processor List. TradieView requires appropriate contractual and security commitments from providers that process Customer Data.

11. Certifications and Independent Assurance

11.1 As at the effective date of this Security Statement, TradieView does not yet hold independent security certification such as SOC 2 or ISO 27001.

TradieView maintains the technical and organisational measures described in this Statement and is evaluating formal certification as the business scales. Current certification status and any available reports can be requested from support@tradieview.com.

12. Customer Responsibilities

12.1 Customers remain responsible for:

• securing their own accounts, devices and credentials;
• managing User access and permissions;
• configuring integrations securely; and
• promptly notifying TradieView of suspected security issues.

12.2 TradieView is not responsible for security incidents caused by Customer failure to manage credentials, devices, Users or integrations appropriately.

13. Contact

Security-related enquiries and vulnerability reports should be directed to support@tradieview.com.

© 2026 Tradie View Pty Ltd. All rights reserved. These documents are governed by the laws of Queensland, Australia.