Data security

Inherit Australia takes its security obligations very seriously. We provide a platform for advisers and lawyers to capture and store highly sensitive personal and financial data. We understand the responsibility that this entails. Security is at the core of our technical and product architecture.

Data security in transit

All data transactions between users, servers and API partners occur over a secure transit layer (SSL). Login and registration information, documents and signatures are all secured. Browser cookies may be used on our public website and platform to support essential functionality, maintain secure sessions, remember user preferences and improve the user experience. We do not store sensitive client information, estate planning information or login passwords in cookies.

All transmissions across our data centre occur over a secure channel. Access to our data centre (for maintenance and upgrades) is restricted to physical access at our office in Melbourne.

Data security at rest

All data entry documents and files are encrypted at rest using AES-256 technology over SQL Server. File access is restricted via private keys, only to authorised users (as per internal security setup, see Access Control).

Our data centres utilise state-of-the-art digital surveillance and security equipment to prevent unauthorised access. We have a multi-layered access system, utilising Biometric access points, proximity card readers, 24-hour on-site security controls, integrated Building Management, Security and CCTV systems and perimeter security controls.

Where is your data stored?

Your data is stored at Microsoft Azure Australian-based data centre (Australia Southeast). To retrieve any meaningful information, bad actor would have to breach both the data centre and our internal data security controls. Data centre certificates: ISO 27001, ISO 27018, SOC 1, SOC 2, SOC3, FedRAMP, HITRUST, MTCS, IRAP and ENS.

Data backups

All data and meta-data points are backed up at a secondary database and file storage within Azure up to 8 times per 24 hours. Documents are also backed up in 'deep rest' data storage for at least 18 months, even after deletion.

Access control

Access control for Inherit Australia accounts ensures information is only available to authorised users:

Client information is contained within a client estate plan data storage.
Advisers establish access to new clients/users by creating a new user at Inherit Australia User dataset or gaining access with MFA to existing client accounts. For example, suppose an adviser requires access to an existing client account. In that case, the client must click a link in an email or SMS, Login into Inherit Australia account, and confirm access.
Lawyers gain access to client accounts only via accepted referral by Advisers or Individual clients (for client-driven estate plans).
Team members of an existing lawyer adviser may gain access to specific clients based on practice permission and internal structure (for example, junior advisers for data collections). Team user access is set up at a practice level.

Audit trail

All interactions of clients, advisers and lawyers are recorded in a granular level audit trail. This tool can be used to track down 'human-factored' data breaches. This tool is available to primary practice account holders and Inherit Australia support team to uncover data breaches.

Password strength

Inherit Australia enforces high password strength for all users. The minimal requirements for passwords are:

8 characters
Upper-case and Lower-case letters
Must contain a number or special character
Must be a non-common password (Checked with 500,000 common web passwords)

Multi-factor authentication (MFA)

Multi-factor authentication (MFA) adds an additional check of a user’s identity. It combines something you know (your username and password) with something you have (an authentication app on your smartphone or tablet). This second layer of security is designed to prevent unauthorised access to accounts even when a user password has been breached.

All Inherit Australia users are required to set up MFA with one of the following methods:

Google Authenticator App
A mobile phone capable of receiving SMS
A secondary email is used to send a one-time code.

Inherit Australia also uses thumbprint technology to detect suspicious user behaviour such as multiple sessions from different devices or jurisdictions. In those cases, users will be required to authenticate with MFA even if a 30 day rotation has been set.

Your responsibility

Data security is a joint effort between Inherit Australia, clients, referral partners and your team users. We continually invest to improve our data security; however hackers are always looking for the weak link in the chain. There are some steps you can take to improve security.
Tips for local data security:

Always sign out from Inherit Australia when not in use or at the end of the day.
Do not use a password also used in another site.
Use dedicated password storage applications, such as Last Pass, Keeper or Password Boss. Do not store passwords in a browser's in-built system.
Change your password regularly.
Ensure your internal systems, such as operating systems and virus and spyware software, are up to date.
Avoid downloading unauthorised applications.
Clean-up your downloads and recycle bin folders on a regular basis.
Contact us if an MFA device has been lost or stolen.