Data Handling and Security Statement

Purpose

This statement summarises the Service's intended data-handling and security approach for users and prospective organisational review. It is not a certification, security guarantee or representation that Main Roads has approved the Service.

Data ownership and purpose limitation

• Main Roads retains ownership and control of Main Roads operational data.
• The Service fee relates to software, automation, infrastructure and support, not the sale of data.
• Operational data is used only to support authorised duties, account administration, security, reliability and lawful obligations.

Access controls

• Authenticated user accounts.
• User ownership and record-level filtering designed to restrict users to their own authorised work orders.
• Administrative access controls and account expiry/deactivation.
• Audit and operational logs for key imports, uploads, downloads and failures.

Security and reliability practices

• Protected secrets and credentials, not intentionally displayed to end users.
• Sanitised user-facing errors, with detailed diagnostics restricted to administrative channels.
• Backups, monitoring, recovery procedures and scheduled health checks.
• Validation and staged processing intended to reduce accidental or incomplete submissions.
• Testing of important data-separation and workflow behaviour.

Third-party platforms

The Service relies on platforms that may include Google/AppSheet, Microsoft/Dynamics 365, Stripe, email and hosting providers. Each platform remains subject to its own terms, security model and availability. A formal Main Roads deployment may require approved accounts, service identities, hosting, retention settings and security review.

Incident reporting

Suspected unauthorised access, incorrect cross-user visibility, lost devices, credential compromise or disclosure should be reported immediately to timelleston@gmail.com. We will investigate, contain, preserve relevant records and make notifications where required.

Data minimisation and lifecycle

The Service should collect and retain only information reasonably needed for authorised operational workflows. Retention periods and deletion processes should be reviewed with Main Roads as part of any formal enterprise arrangement.