Security
How onestepright protects your data
We hold as little as we can, in one place, and we can show you the controls. A check asks for your answers and a few facts about you and your business. At the end it asks for an email address to send the report to. Those items are the whole target. This page says where it lives, how it is protected and who to call if something looks wrong.
Little held
Answers, a few facts, an email if you want the report
One place
One database, in Sydney, Australia
Nothing to sign in to
Your report opens from a private link
What we collect
Your email address
Asked for at the end of a check to send you your report. If you tick the box, we also use it for one reminder to take the check again after ninety days. Nothing else we hold identifies you.
A few facts about you and your business
Country, industry, revenue band and employee band, plus your level and your function. Never the company name.
Your answers
Which sentence you picked for each practice, and any sentence you chose to write in your own words. We read written answers and show them back to you. They are never shown to anyone else and never used in a benchmark.
A help request
Only if you press "I need some help" on your report.
Ordinary web logs
Kept briefly to keep the site working and to spot abuse.
We do not collect names, passwords, payment details or anything from your devices beyond the ordinary web log. You have nothing to sign in to. When a paid service exists, the payment provider will handle payment, and we will never store it.
Where it lives
One database, in Sydney, Australia, run for us by Supabase. The website runs on Vercel, with its server functions also in Sydney.
Resend sends report emails from its Tokyo region. The email carries your address and your private report link. It does not carry your answers. Help requests and contact messages land in our own mailbox, on Microsoft 365.
If you are in the United Kingdom, the European Union, Canada or the United States, your data is stored in Australia. The privacy notice at /privacy sets out the transfer basis for each.
How it is protected
Encrypted in transit and at rest
Every page is served over HTTPS with strict transport security. The database is encrypted on disk.
Row-level security on every table
The database itself refuses to hand one respondent's data to anyone else's session. The public website key cannot read respondents, answers or written text at all. Answers reach the database only through our server.
No passwords to steal
The site has no accounts and no sign-in. A link opens your report. The link is long, random and unguessable. It does not expire, and it stops working when your results are deleted. We store only a hash of it, so even our own database does not hold the working link.
No third-party scripts where you answer or read your report
The check pages and the report pages load nothing from anyone else: no advertising tags, no analytics, no chat widget. A content security policy, enforced on those pages, blocks scripts from any other domain. A check runs after every deployment to prove the policy is still there.
Google's analytics and advertising tags run on the other pages of the site, such as the home page, the theme pages and the articles. They show us which pages bring people in. They never load on a check, a report or a poll, and the policy there is unchanged.
In the United Kingdom, the European Economic Area, Canada, or wherever we cannot tell where you are, nothing loads until you choose "Allow the tags". "No thanks" keeps them off. Elsewhere they load without a question. Anyone can turn them off with "Tag choices" in the footer. Your choice is kept for six months in our own cookie. - Minimise, and delete on your word. A check that is started and abandoned is deleted after thirty days. A completed check stays live while you use it.
Twenty-four months after a report's last visit, we de-identify it. Its report link, anything you wrote and the record of changes are removed. Once none of your reports is live, your email goes too. Where a group of similar businesses is small, your business facts are then made less specific. We review this rule every year.
Written answers never join any benchmark pool. You can ask for everything we hold about you, or ask us to delete it, from day one. Ask by email if you gave us one. Otherwise use your report link, which carries a delete control and is the only key to your record. - Administrator access behind multi-factor sign-in. Every account that can reach the database console belongs to a named person and needs a second factor. No login is shared. The provider logs database activity. It is reviewed at every release. - Secrets stay on the server. The keys that can read the database exist only as server environment variables, separately for testing and production. Every change to the code is scanned for leaked secrets before it can be deployed. - Dependencies locked and watched. The software components we build on are pinned to exact versions and checked against published vulnerabilities at every release. - Daily backups, taken by the database provider.
These are tests the build has to pass, not intentions. The list of tests and what each one proves is written down and re-run at every release.
Who else touches it
We use five service providers. Each is independently audited and publishes its own security documentation.
SupabaseDatabase
Sydney, Australia
SOC 2 Type II, HIPAA available. Trust page: supabase.com/security
VercelWebsite hosting and server functions
Sydney, Australia, with a global edge network for static pages
SOC 2 Type II, ISO 27001. Trust page: vercel.com/security
ResendSending your report email
Tokyo, Japan. Resend has no Australian region. The email holds your address and your report link, never your answers
SOC 2 Type II. Trust page: resend.com/security
Microsoft 365Our mailbox
Australia
SOC 2, ISO 27001 and others. Trust page: microsoft.com/trust-center
GoogleAnalytics and advertising tags on the public pages, and counting completed checks
Google's data centres worldwide. It never receives your answers
ISO 27001 for the systems behind Google Analytics. Trust page: safety.google
No other company receives your answers. We do not sell respondent data. We hand it to an adviser only if you have pressed "I need some help" and asked to be referred.
Google receives data from the public pages, through Google Analytics and the Google Ads tag. It gets what such tags collect: the pages you visit, a cookie identifier and your browser type. The cookies are _ga, a second ga cookie for our site, and _gcl_au. Where we ask first, nothing goes to Google until you allow the tags.
When you complete a check, our server tells Google Analytics that a check in a theme was completed, and when. It adds the cookie identifiers the tags set in your browser, so the completion is counted against the visit that brought you. Nothing else goes: no answers, no score, no email address, no name, no IP address and nothing about your business. It is sent only if your choice allows the tags, and never for an answer to a team poll.
Your rights
Ask us and we will send you everything we hold about you, correct it, or delete it, wherever you are.
Your results are not shown to anyone else, with one exception. In a team poll with individual answers visible, the organiser sees your answers against your level and function, and can open your report. You are told so before your first question. A poll that shows totals only gives the organiser the spread of answers at the close, never who said what. Otherwise nobody sees your report unless you send it to them.
Benchmarks are anonymised aggregates only, shown once enough comparable firms are in a cut. Each shows a band such as 30+ in place of the exact count. A band reveals less about a cut than a count would. Before a benchmark is first shown, we test that it cannot single out a business or a person, for example by comparing two overlapping cuts.
Independent assurance
We will list each item here once it has happened.
Penetration test
Not yet done. Before team polls opened in September 2026 we ran a lighter security scan of our own. It used automated checks and a manual pass on report and poll links. That scan is not a penetration test. An independent penetration test is to be commissioned before the first paid tier.
SOC 2
When a customer contract requires it. We inherit our providers' SOC 2 and ISO 27001 controls for infrastructure. We say so here, and we do not claim them as our own.
Cyber insurance
From first revenue.
Vendor questionnaire
If your procurement team has a standard security questionnaire, we have answered the usual forty-five questions once. Ask at contact@onestepright.com and we send it as an attachment.
Team polls
Team polls are live. Whoever sets up a poll chooses before it starts whether it shows individual answers or totals only. Everyone invited is told which in one sentence before their first question, and a poll with individual answers visible says so in its invitation too.
Individual answers visible is the default. You are not asked for your name. The organiser sees each of your answers against your level and your function, and can open your report. Their results page updates as each person finishes. They can also download the answers as a spreadsheet.
That is not anonymity, and we do not call it that. In a small team, or in a role one person holds, a level and a function can be enough to work out who someone is. You read that before your first question. So whether to answer is your choice, made with the facts in hand. If you would rather not be identified, tell whoever sent you the link.
In a poll that shows totals only, the organiser sees nothing about the answers while the poll is open. When it closes, they see how answers spread across each question, if at least five people have answered by then. They never see who said what, and they cannot open anyone's report. Results appear once, at the close, so nobody's answers can be picked out by comparing the page before and after a response. For the same reason, a totals-only poll cannot report as it goes.
Totals only stops anyone reading one person's answers from a single poll. It cannot stop an organiser who runs two polls on nearly the same people from comparing them.
Your email address is not part of a poll, and neither is your name. The invitation is a single link shared with everyone. So we hold no list of who was invited, and we cannot chase anyone.
You are asked for an email only at the end, and only if you want a copy of your own report. The organiser never sees it. A name is not asked for at any point, and none is stored.
A poll ends, but your answers do not go with it. A poll closes within ninety days. Ninety days after it closes, the organiser's results page stops working, and we erase their email address and the organisation's name. Your answers are kept, and so are your report and your control to delete it.
Nothing in a poll is ever shown outside that organisation. Poll answers join the public benchmarks only as anonymised aggregates, once a cut has enough comparable firms.
Report a problem
Email security@onestepright.com. A person reads it. You should hear back within two business days.
If you have found a weakness, tell us what you saw and how to reproduce it. Please do not access or alter anyone else's data while proving it. We will not take action against good-faith reports.
If personal data we hold is lost or exposed, we act under the Australian Notifiable Data Breaches scheme. We assess within thirty days whether serious harm is likely. If it is, we notify the people affected and the regulator, and we say what happened in plain words.
This page describes the controls in place at the current release. It is reviewed each release, and the version and date change when it does.