Executive summary

PlanSuite is a web-based, AI-assisted statutory planning platform built for Victorian planning workflows. It provides mapping, planning advice, chat, document analysis and report generation for councils and planning professionals.

Our security position centres on Australian-hosted production infrastructure, encryption in transit and at rest, organisation-based access controls, restricted administration, monitored cloud services, managed backups, transparent subprocessor disclosure and human review of AI-assisted outputs.

Security at a glance

1. Service & security context

PlanSuite is delivered as Software as a Service through a web browser. The Council Starter Package is designed to operate alongside existing council systems without local installation or mandatory document-management integration. Council users save generated Word outputs into existing records systems through their normal processes.

• No PlanSuite software is installed on council endpoints or networks.
• Council access can be configured with optional SSO using the council's identity provider.
• Council users, modules, local planning resources and optional integrations are configured during onboarding.
• Uploaded plans and documents are used by PlanSuite report workflows and are never publicly accessible.
• AI-assisted outputs are preliminary and remain subject to planner verification and decision-making.

High-level architecture

2. Data handling & information lifecycle

Information categories

• Account information, including the user and organisation details required to provide access.
• Uploaded planning documents, plans and related materials supplied by users.
• Property and planning information obtained from official data sources.
• Usage and technical information used to operate and secure the service.
• Generated reports, letters and planning analysis produced through PlanSuite workflows.

Lifecycle controls

3. Infrastructure, encryption & platform security

Cloud infrastructure

PlanSuite is hosted on Amazon Web Services in the Sydney region (ap-southeast-2), using AWS ECS Fargate for the application runtime, AWS RDS for managed database infrastructure and AWS S3 for document storage.

• ECS Fargate provides a managed container runtime. Only our verified, containerised application code executes in production.
• AWS manages the underlying Fargate host operating system and host-level patching.
• AWS RDS provides managed database infrastructure with automated backups and point-in-time recovery.
• AWS S3 document storage has object versioning enabled in production, and public access is blocked at the bucket level so an object cannot be made publicly readable by misconfiguration.
• Production infrastructure is subject to continuous system monitoring.

Encryption

Secure application practices

• Automated deployments and version control.
• Regular automated software testing as part of the development lifecycle.
• Automated vulnerability scanning of application dependencies, which raises patch pull requests when a known vulnerability is published.
• Continuous deployment, so security fixes reach production quickly rather than waiting on a release window.
• No Flash, Java applets, web advertising, Office macros, ActiveX controls or PlanSuite executable installation is involved in ordinary platform use.

4. Identity, access & administrative security

• Authenticated user accounts are required for all protected platform information.
• Role-Based Access Control (RBAC) governs application permissions.
• Council users are restricted to data within their own organisation.
• Internal administrative access is restricted and designed around least privilege.
• AWS IAM policies restrict infrastructure access to the required permissions.
• Internal infrastructure access uses short-lived, role-based credentials issued through an identity provider that enforces MFA. The production account holds no long-lived IAM users and no root access keys.
• Centralised root access management is enabled across our AWS organisation. The production account holds no root user credentials and root password recovery is blocked, so there is no root sign-in path to production.
• Access keys and credentials are held in managed secret storage and are never committed to source code or customer outputs.
• Optional SSO connects PlanSuite to the council's existing identity provider, so the council controls staff authentication and MFA policy.
• SSO supports prompt deprovisioning when access is removed at the council identity provider.

5. AI security, transparency & human oversight

PlanSuite uses AI to analyse planning information and generate structured outputs. Relevant property data, planning scheme content and user inputs are sent to the AI service via API for processing.

• No AI training on council data: council and customer content is used to support the requested service, not to train public AI models.
• Where data is stored: all customer data is stored in Australia (AWS Sydney, ap-southeast-2). No customer data is persistently stored offshore.
• AI processing & data residency: AI processing is performed via Google Vertex AI. Request content sent for AI processing may be handled outside Australia on a transient basis. Under our terms with Google, this content is not used to train models. Councils with specific data-processing residency requirements should contact PlanSuite to discuss available configuration options.
• Enterprise API access: AI services are accessed through an enterprise API, not public consumer accounts.
• Output limitations: outputs may be probabilistic, depend on input quality and may contain inaccuracies.
• Planner verification: AI-assisted outputs are preliminary guidance. They must be independently reviewed by a suitably qualified planner and must not be the sole basis for a legal, regulatory or statutory decision.
• Authoritative sources: assessments read from official Victorian Government data and current planning scheme ordinances, with clause citations so outputs can be verified at a glance.

6. Privacy, data residency & data ownership

• Customer data is stored on AWS infrastructure in Sydney, Australia. Certain disclosed service providers process limited information in other jurisdictions for the applicable service function, as set out in section 7.
• Users retain ownership and control of uploaded data.
• Uploaded documents are never made publicly available and are accessible only to authorised users within the same organisation.
• We do not sell personal data.
• We minimise collection of personally identifiable information wherever possible.
• Personnel with access to customer data are subject to confidentiality obligations under our Data Processing Agreement.
• Our Privacy Policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
• Our security practices are informed by the Privacy and Data Protection Act 2014 (Vic) and the VPDSF. Additional contractual requirements may apply where PlanSuite supports a Victorian public-sector customer.

8. Monitoring, backups & resilience

• Continuous system monitoring is maintained across production infrastructure.
• Application error monitoring supports rapid detection and diagnosis of faults. Diagnostic session replay is captured only on error, with all text masked and all media blocked, so uploaded plans and applicant details are not captured.
• AWS RDS automated backups provide database recovery with point-in-time recovery.
• AWS S3 object versioning is enabled for document storage in production.
• Backups are encrypted at rest and held within AWS Sydney (ap-southeast-2).
• Production database deletion protection is enabled.
• PlanSuite aims for continuous availability. Our public Terms do not guarantee uninterrupted service.

A documented IT Disaster Recovery Plan and continuity arrangements set out our critical systems, recovery procedures for data loss, availability zone failure, application failure and credential compromise, and the arrangements covering key-person unavailability. Restore validation is performed on a recurring cadence: production data is restored into an isolated instance, restored record counts are verified against the live database, and the recovery time is recorded. Results and any findings are logged against the plan, which is reviewed annually. The plan is available to councils on request.

9. Incident response & data breach management

Our Data Processing Agreement commits PlanSuite to notifying affected customers within 72 hours of becoming aware of a confirmed data breach affecting customer data. Our incident process operationalises that commitment:

1. Detect and triage the suspected security or privacy incident.
2. Contain the incident and preserve relevant evidence.
3. Assess affected systems, information, customers and likely impact.
4. Eradicate the cause and remediate identified weaknesses.
5. Recover service and validate that controls are operating as expected.
6. Notify affected customers under contractual commitments and applicable law.
7. Complete a post-incident review and track corrective actions to completion.

10. Essential Eight alignment

The Essential Eight includes maturity levels that can be independently assessed where required. PlanSuite states alignment and does not claim an independently assessed maturity level. This pack does not assign PlanSuite Maturity Level 1, 2 or 3.

11. Assurance, certifications & audit status

12. Shared responsibility for council use