Privacy policy

The short version

• Anything you paste into the free checker at /check never reaches our servers. The check runs in your browser, and an automated test in our release process fails if any of it tries to leave the page.
• Full bank account numbers are never stored. What we keep is a one-way cryptographic fingerprint plus a masked form (BSB and last digits) for display.
• Data is hosted in Sydney, Australia, and organisations are isolated from each other in the database itself.
• We use no advertising or analytics cookies — only the session cookie that keeps you signed in.
• We sell nothing about you to anyone.

Who we are

ProofRelay (proofrelay.com.au) is an Australian software service that helps businesses verify supplier payment-detail changes before paying. For anything in this policy, contact hello@proofrelay.com.au.

What we collect

Your account: name, email address and a password hash, handled by our authentication provider.

What your organisation enters to use the product: supplier business details (names, ABN, approved email domains), trusted contact names and phone numbers, the payment instructions you log for checking (sender addresses, pasted email excerpts, amounts, references), and the verification and approval decisions your team records.

The audit trail: a tamper-evident, hash-chained record of every workflow action, with who did it and when. This exists so your team can prove what was checked — it is the product, not a by-product.

Bank account numbers — the special case

Full account numbers are not stored. When payment details are recorded, the system keeps a keyed one-way fingerprint (used to compare accounts without holding them) and a masked display form. A breach of the database alone would not yield account numbers. Recovering a number would additionally require the separate operator-held key — we state it this way because it is the exact truth, and a stronger claim would not be.

The free checker collects nothing

The invoice and email checker at /check runs entirely on your device. No upload, no server call, no logging of what you paste. You can load the page, disconnect from the internet, and it still works. This is deliberate: the documents people most need to check are the ones they are least willing to send to a stranger.

Where data lives, and who else touches it

The application and database are hosted in Sydney (Vercel and Supabase, both pinned to Australian regions), so ordinary operation keeps your data in Australia. We use a small number of service providers, each seeing only what its job requires:

• Supabase — database and sign-in hosting (all stored data).
• Vercel — application hosting (request logs and IP addresses).
• Resend — notification email, if enabled. Notifications are built to carry no amounts, no account details and no supplier names — only that something needs your attention, and a link.
• Australian Business Register — when an ABN is checked against the register, the ABN is sent. Nothing else is.
• rdap.org — when a sender domain's age is checked, the domain is sent. Nothing else is.

Organisations cannot see each other

Isolation between organisations is enforced by row-level security inside the database itself, not by application code, and our test suite includes dedicated tests that attempt to cross it.

Cookies

One kind: the session cookie that keeps you signed in. No advertising cookies, no third-party analytics cookies. If that ever changes, this page will say so before it does.

Access, export, correction and deletion

You can see and correct your organisation's data in the product. For a full export (spreadsheet-friendly, one file per record type), email us and we will provide it.

An organisation owner can request deletion of their organisation. We honour it — with one honest caveat: the audit trail is deliberately tamper-evident, which is incompatible with quiet removal, so deletion is performed as a recorded administrative action rather than a silent one. Where law or a live dispute requires records to be kept for a period, we will say so rather than pretend otherwise.

Security

Workflow rules are enforced on the server in single transactions, the audit trail is hash-chained, and the codebase carries an automated test suite and documented security reviews. No one can honestly promise a breach is impossible; we promise instead that the design assumes hostile input, stores the minimum, and that we will tell you promptly if something affecting you goes wrong.

Complaints

Raise anything with hello@proofrelay.com.au and we will respond. If you are in Australia and unsatisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).