Data Security

Australian TCM practitioners trust Daobook with confidential patient records. This page describes the technical and operational measures we use to keep that data safe — what is in place today, not aspirational claims.

Where your data lives

Daobook runs entirely on Amazon Web Services infrastructure in the Sydney region (ap-southeast-2). Application servers, the production database, the cache layer, and file storage are all hosted in Australia, which keeps clinic and patient data within Australian jurisdiction.

• Application servers run on EC2 instances inside a private VPC
• The production database (PostgreSQL on Amazon RDS) sits on a private subnet and is only reachable from the application and background-job servers
• File uploads (consent forms, attachments, etc.) are stored in an Amazon S3 bucket with all public access blocked
• Background-job state and caching use Amazon ElastiCache (Redis), also on a private subnet

Encryption

Data is encrypted both in transit and at rest:

• In transit: HTTPS is enforced for all browser traffic. TLS termination happens at an AWS Application Load Balancer using a certificate managed by AWS Certificate Manager.
• At rest — database: RDS storage encryption is enabled, so the underlying volumes and automated snapshots are encrypted at the disk level (AES-256, AWS-managed).
• At rest — files: S3 server-side encryption is enabled on the storage bucket using AWS KMS, with object versioning turned on.
• At rest — cache: ElastiCache supports both at-rest and in-transit encryption, with an auth token required for connections.
• Sensitive third-party tokens (such as Square OAuth tokens used by clinics that take card payments) are additionally encrypted at the application level before being written to the database.
• Encryption keys are held in AWS KMS with automatic key rotation enabled.

Backups and recovery

• Daily backups of both the production database and the file-storage bucket, retained for 35 days, plus a monthly backup retained for 12 months
• Backups are immutable. They are held in an AWS Backup vault under Vault Lock in compliance mode, secured by its own separate encryption key. Once a backup is written it cannot be deleted, nor its retention shortened — not by us, not by anyone holding our administrator credentials, and not by AWS support. This is deliberate: it is what stops a ransomware attacker, or a compromised account, from destroying the backups along with the live data.
• Restores are tested, not assumed. In our most recent test (July 2026) the production database was restored to a separate instance and verified in about eight minutes, with record counts reconciled table by table against the live database.
• The database has deletion protection enabled and a final snapshot is taken on any decommissioning event
• S3 file storage uses object versioning, so deleted or overwritten files can be recovered
• PostgreSQL audit logs are streamed to CloudWatch Logs

The production database runs across two Availability Zones — Amazon RDS keeps a standby in a second zone and fails over to it automatically if the primary becomes unavailable. Our application and background-job servers are a different story: they run as single instances in one Availability Zone, which keeps the platform affordable for a small TCM clinic. So a database failure is handled for you automatically, while a serious failure of the application servers means a rebuild rather than an instant cutover. In a genuine disaster scenario, recovery of data is from the most recent backup, so up to a day of recent data could be lost. We would rather state that plainly than imply a redundancy we don't have.

Account access controls

Inside Daobook itself:

• Two-factor authentication (TOTP via authenticator app, with one-time backup codes) is available for every practitioner account
• Passkey / WebAuthn sign-in is supported for password-less, phishing-resistant login
• Role-based access control — every staff member has a role (owner, admin, practitioner, receptionist, bookkeeper) and Daobook checks permissions before showing or letting anyone change clinical records
• Each clinic is fully isolated from every other clinic at the data layer

What you can do to protect your account

The strongest password and the most modern infrastructure don't help if an account is shared or left open on an unattended computer. We recommend:

• Turning on two-factor authentication or registering a passkey for every practitioner and admin account
• Using a unique, strong password — a password manager is the easiest way to do this
• Giving each staff member their own login with the smallest role they need (don't share the owner login)
• Logging out on shared or public computers
• Keeping the operating system and browser you use to access Daobook up to date
• Avoiding unfamiliar public Wi-Fi for sensitive clinical work

Data ownership, export, and retention

The clinical and business records you keep in Daobook belong to you. While you have an active subscription, you can export your data at any time using the built-in CSV exports for clients, consultations, prescriptions, appointments, invoices, communications, formulas, herbs, contacts, products, and provider numbers.

When a subscription ends, your data is not immediately deleted. It moves into a structured retention lifecycle (active → grace period → optional paid retention → scheduled deletion) so you have time to reactivate, export, or migrate before anything is permanently removed. The retention period is also designed to support the long record-keeping obligations TCM practitioners have under Australian health records legislation.

Reporting a security issue

If you believe you've found a security vulnerability or suspect that an account has been compromised, please email admin@daobook.com.au straight away. We take reports seriously and will investigate promptly.

We maintain a written incident response plan aligned to the Notifiable Data Breaches scheme under the Privacy Act 1988. It sets out how we classify and contain an incident, how we assess whether personal information has been affected, and how and when we notify the Office of the Australian Information Commissioner, affected clinics, and affected individuals.

Limitations

No system is immune to every threat. Daobook is built and operated by a small Australian team, and we focus on the security measures that meaningfully protect a small clinic — strong defaults, encryption, modern authentication, isolated tenancy, and careful access control. We do not currently advertise SOC 2 or ISO 27001 certification, and we don't have a formal third-party penetration-testing program.

For more detail on how we handle personal information and meet our obligations under Australian privacy law, see our Privacy Policy, Australian Privacy Principles, and Healthcare Compliance pages.