Trust
Trust & data handling
How we collect data lawfully, how we look after it, which providers we use and where data is stored. Last reviewed November 2026.
Lawful collection
- We confirm in writing that you have the right to use each source, or that the source permits the use, before any collection starts.
- We read and follow each website's terms of use and access rules. We do not bypass logins, paywalls, CAPTCHAs, rate limits or other technical protections.
- We prefer official APIs and published bulk files over page collection wherever they exist.
- We collect at a polite pace and identify our requests where a source asks us to.
- We do not collect personal information without a lawful basis, and we minimise it where it is needed. We consider the Privacy Act 1988 (Cth) and the Australian Privacy Principles at the scoping stage.
- If a requested source cannot be used properly, we say so and suggest lawful alternatives.
How we handle client data
- Client data is used only for the agreed purpose and kept only for the agreed period. At the end of an engagement we return or delete it, as agreed in writing.
- Raw source files are kept unchanged and fingerprinted (SHA-256) so every output can be traced back to what was collected.
- Access to client data is limited to the people working on the engagement.
- Credentials you give us are kept in a dedicated credential vault, never in source code, documents or email.
- We do not sell data, and we do not reuse one client's data for another client.
- Where you need data kept in Australia, we agree the tools and storage locations with you before work starts.
Providers and where data is stored
We use a small number of established providers to run this website and our business email. Each is headquartered in the United States. Where a provider offers a Sydney region, we use it, but some processing (for example email delivery, logs and support) may take place outside Australia. We do not claim that all data stays in Australia.
| Provider | Headquarters | Used for | Where data is stored or processed |
|---|---|---|---|
| Vercel Inc. | United States | Website hosting and the enquiry form's server code | Pages are served from Vercel's global edge network. The enquiry form's server code is set to run in Vercel's Sydney region (syd1). Vercel may process logs and metadata outside Australia. |
| Neon (Databricks, Inc.) | United States | Database that stores website enquiries | Hosted on Amazon Web Services in the Sydney region (ap-southeast-2). |
| Resend, Inc. | United States | Delivering enquiry notification and acknowledgement emails | Email content passes through Resend's infrastructure, which may be outside Australia. |
| Google LLC (Google Workspace) | United States | Business email and documents | Stored in Google's data centres, which may be outside Australia. |
For client engagements, the tools and storage locations are agreed in writing for each project. See our Privacy Policy for how we handle personal information sent through this website.
Security practices
- HTTPS on every page, with HTTP Strict Transport Security and security headers, including a Content Security Policy.
- Website enquiries are stored in a database hosted on Amazon Web Services in Sydney, encrypted at rest (AES-256) and reached only over encrypted (TLS) connections.
- Our database provider maintains encrypted backups and point-in-time restore for the enquiry database.
- The enquiry form is rate-limited, and only a one-way keyed hash of a visitor's IP address is stored.
- Credentials are kept in a dedicated credential vault and in our providers' secret settings, with separate credentials for each service, never in source code.
- We apply software and operating system security updates promptly.
- We are implementing multi-factor authentication across all business accounts.
Essential Eight: self-assessment
This is a self-assessment, not a certification or audit. Titan Analytica has reviewed its own practices against the Australian Signals Directorate's Essential Eight mitigation strategies, aiming for Maturity Level One. Several controls are still being implemented, and we say so below. It has not been independently audited or assessed, and it is not certified, IRAP-assessed or endorsed by the Australian Signals Directorate. Self-assessed November 2026.
| Strategy | Where we are (self-assessed) |
|---|---|
| Patch applications | We apply application security updates promptly on work devices. |
| Patch operating systems | We apply operating system security updates promptly and keep work devices on supported versions. |
| Multi-factor authentication | We are implementing multi-factor authentication on email, hosting, database, code and credential-vault accounts. |
| Restrict administrative privileges | We are implementing separate standard and administrator accounts, with admin access used only when needed. |
| Application control | We are implementing an approved-software list for work devices. |
| Restrict Microsoft Office macros | Our delivery work does not use Microsoft Office macros; our pipelines are written as code. |
| User application hardening | We apply browser updates promptly and are implementing hardened browser settings. |
| Regular backups | Our hosted database has provider-managed backups and point-in-time restore. We are implementing regular, tested backups of project files. |
Certifications we do not hold are not claimed here. If your organisation needs a particular standard or an independent assessment, tell us at the start and we will be clear about what we can and cannot provide.
Questions or concerns
Email hello@titananalytica.com with any question about how we handle data, or to report a security concern.