aurii
Log in Request a walkthrough Start free trial

Certifications, sub-processors and governance

SMB1001:2026 Gold (Level 3) is held by Black Shard Pty Ltd. The IRAP assessment, ISO 27001 and SOC 2 are Microsoft's, at the Azure platform level.

Start the 14-day free trial

Certifications and frameworks

  • Australian data residency Sydney primary, Melbourne backups
    Platform control · Aurii Pty Ltd

    Patient records, files and backups are stored in Microsoft Azure Australia East, in Sydney, with backups in Australia Southeast, in Melbourne.

    Data residency
  • AES-256 at rest · TLS 1.2+ in transit Encryption
    Platform control · Aurii Pty Ltd

    Every database and file store holding clinical data is encrypted at rest with AES-256. Connections accept TLS 1.2 and 1.3, and older versions are refused.

    Encryption and keys
  • Multi-factor authentication on every account Passkeys
    Platform control · Aurii Pty Ltd

    A second factor is required before any clinical screen loads: a passkey over WebAuthn, or a one-time code.

    Access and authentication
  • Australian Privacy Principles Privacy Act 1988 (Cth)
    Compliance · Aurii Pty Ltd

    Personal and health information is handled under the 13 Australian Privacy Principles in the Privacy Act 1988 (Cth).

    Principle by principle
  • Notifiable Data Breaches scheme ready Privacy Act 1988 (Cth), Part IIIC
    Compliance · Aurii Pty Ltd

    Breaches are handled under Part IIIC of the Privacy Act 1988 (Cth): escalation within 30 minutes, assessment within 30 days, notification where serious harm is likely.

    Data breaches
  • HIPAA compliant BAA available on request
    Compliance · Aurii Pty Ltd

    Meets the HIPAA Security Rule and the business associate requirements: a named security official, risk analysis, incident and breach notice procedures, contingency plan, unique user identity, multi-factor sign-in, session expiry, audit controls, integrity checks and encryption. The business associate agreement is provided on request.

    Request the BAA
  • GDPR compliant Data processing agreement available on request
    Compliance · Aurii Pty Ltd

    Personal data is processed under GDPR Articles 5, 25, 28 and 32. The data processing agreement is provided on request.

    Request the agreement
  • NZ Health Information Privacy Code 2020 New Zealand
    Compliance · Aurii Pty Ltd

    Health information is handled under the 13 rules of the Health Information Privacy Code 2020 (New Zealand).

  • SMB1001:2026 Gold Black Shard Pty Ltd · Certified by CyberCert
    Held by Black Shard Pty Ltd

    Black Shard Pty Ltd, which builds, hosts and secures aurii, is certified to SMB1001:2026 Gold (Level 3) by CyberCert, valid to June 2027.

    View on Black Shard
  • Essential Eight Maturity Level 3 Black Shard Pty Ltd
    Held by Black Shard Pty Ltd

    Black Shard Pty Ltd, which builds and hosts aurii, runs its own systems at Essential Eight Maturity Level 3, assessed September 2026.

    View on Black Shard
  • Hosted on Microsoft Azure IRAP PROTECTED, ISO/IEC 27001, SOC 2 · held by Microsoft
    Held by Microsoft

    Microsoft Azure, aurii's hosting platform, holds IRAP assessment to PROTECTED, ISO/IEC 27001, 27017 and 27018, SOC 1, 2 and 3, and CSA STAR. Held by Microsoft.

    Microsoft's IRAP assessment
  • Medical Objects secure messaging HL7 v2 over mutual TLS
    Live integration

    Signed letters reach the recipient's clinical software as HL7 v2 over mutual TLS, and the delivery acknowledgement returns to the letter in aurii.

    Integrations

Compliance reviewed October 2026.

Sub-processors

Microsoft Azure Hosting, storage, encrypted backups, Key Vault, speech-to-text, and the text recognition applied to photographed and uploaded clinical documents. Australia East is the primary region; Australia Southeast holds the geo-redundant backups.
Enterprise AI provider Turns the consult transcript into the draft note, letters and discharge summary, and receives each photographed or uploaded clinical document attached to the encounter on each note generation. Engaged under commercial terms and a data processing agreement, with no training on your content.
Medical Objects Carries signed correspondence to the recipient's clinical software as HL7 v2 over mutual TLS, and returns the delivery acknowledgement. Operated in Australia.
Notifyre Carries the rendered PDF of a signed letter, discharge summary or order to the fax line the clinician addressed it to, and returns the delivery receipt.
Twilio Carries a short text message with a notice and either a secure link or a one-time code, for handover access codes, secure-portal share codes, patient order links and prescription tokens. The recipient's mobile number, including a patient's, is disclosed to it. No clinical content is carried in the message body.
Microsoft 365 Carries account and notification email, and any letter a clinician addresses to a plain email recipient, from no-reply@aurii.com.au through aurii's own Australian Microsoft 365 tenant. Delivery failure notices return on the same path.
Apple, Google and Microsoft sign-in Where a clinician signs in to the aurii application with an Apple, Google or Microsoft account, that provider authenticates the sign-in and returns the account identifier and email address aurii matches to the user.
Apple and browser push services Deliver a notification to the aurii iOS app, or to a browser on which a clinician has allowed notifications, through the device or browser vendor's push service.
Cloudflare Sits in front of the aurii website and the aurii application as the network edge, terminates the encrypted connection there and passes the request through.
Stripe Processes subscription payments on an Australian account, charged in Australian dollars. Card details are entered with Stripe and never held by aurii. No clinical information is disclosed to Stripe.
Google Analytics Records page views, clicks on telephone and email links, and form submissions on this marketing website. Advertising storage, advertising user data and advertising personalisation are denied on every page load.
Cloudflare Web Analytics Records page views on this marketing website without cookies and without cross-site tracking.
LinkedIn Measures whether a visitor who arrived from an aurii advertisement on LinkedIn went on to start a trial. It runs on this marketing website only, for a visit that arrived on a LinkedIn link or channel tag and for a later visit from the same browser while the 30-day channel cookie lasts.
GlitchTip aurii's own error tracker, run by Black Shard Pty Ltd on its own server in Australia. It receives a report when a script on this marketing website fails in a visitor's browser, with no form contents and no IP address.
Black Shard Analytics aurii's own page-view measurement, run by Black Shard Pty Ltd on its own servers in Azure Australia East. It runs on this marketing website and inside the aurii application, where every address is rewritten to a route template before a measurement is sent, so no record identifier reaches it.

Named in writing before you sign.

No analytics service receives clinical information.

Companies and ABNs

Clinical board

The board's practising specialists review every specialty template, the clinical safeguards and every material change to the documentation system before it reaches a ward.

Hospital evaluation pack: hospital overview, security architecture, Australian Privacy Principles mapping, clinical safety position, data processing agreement and audit trail walkthrough.

Start the free trial

Start the 14-day free trial
Get aurii on Google Play

hello@aurii.com.au