ReFresh is built for psychosocial safety data, which is sensitive by definition. Security spans hosting, encryption, access control, authentication, monitoring, and certifications. SOC 2 Type I and Type II are live; ISO 27001, IRAP, and Essential Eight alignment are on the roadmap.
SOC 2 Type I and Type II certified
AES-256 encryption at rest, TLS 1.3 in transit
Row-level security at the database layer
Cloudflare WAF, DDoS protection, and rate limiting
FusionAuth handles authentication via OAuth 2.0 / OIDC with PKCE
Granular permissions across every feature area
System logs retained for a minimum of 12 months
Annual third-party audits
ISO 27001 / IRAP / Essential Eight (Roadmap)
Certifications
Certification | Status |
SOC 2 Type I | Live |
SOC 2 Type II | Live |
ISO 27001 | Roadmap |
IRAP | Roadmap |
Essential Eight alignment | Roadmap |
SOC 2 audit reports are available under NDA on request. For procurement or security review processes, contact your ReFresh account contact.
Encryption
At rest: AES-256 encryption across all customer data
In transit: TLS 1.3 between client browsers and ReFresh, and between ReFresh and sub-processors
Access control
Row-level security enforced at the database layer ensures one customer's data is cryptographically isolated from another's
Granular permissions control access to each feature area
Multi-factor authentication is available to all users (see "Multi-factor authentication", 2.7)
Vulnerability management
Annual third-party security audits: results available under NDA
Cloudflare web application firewall: blocks common web attacks
Cloudflare DDoS protection: defends against distributed denial-of-service attacks
Rate limiting: prevents brute-force attempts
Authentication
ReFresh uses FusionAuth for authentication:
OAuth 2.0 and OpenID Connect with PKCE flow
RS256 JWT tokens
Optional SSO via SAML 2.0 or OIDC for organisations using Google Workspace, Microsoft Entra ID, Okta, or other identity providers (see "Setting up SSO", 2.6)
Logging and retention
System logs: retained for a minimum of 12 months
Customer data: retention follows your contract terms (typically the duration of the subscription plus an offboarding window)
The audit trail (see "Using the audit trail", 6.11) is the customer-facing view of the system's logging.
Reporting a security concern
If you suspect a vulnerability, see "Reporting a security concern" (9.6).
Related articles
Where your data is hosted (data residency) (8.2)
Multi-factor authentication (2.7)
Setting up SSO (2.6)
Using the audit trail (6.11)
Reporting a security concern (9.6)