Security & Compliance

HuGo is purpose built for NDIS Providers, where participant confidentiality, secure record keeping and regulatory alignment are critical.

Our platform is designed with layered security controls and governance practices to support Providers operating in highly regulated environments.

Secure Hosting Infrastructure

HuGo is hosted on secure Australian cloud infrastructure via Amazon Web Services (AWS), a global cloud provider with internationally recognised security certifications including ISO 27001 and SOC frameworks.

While AWS maintains independent certifications, Ability Tech does not represent itself as independently certified under these frameworks.

All infrastructure is configured and managed in accordance with industry best practices for cloud-hosted SaaS platforms.

Data Protection Controls

HuGo incorporates multiple technical and operational safeguards, including:

Encryption in transit (HTTPS/TLS)
Encryption at rest using AWS-managed encryption keys
Secure user authentication
Optional two-factor authentication
Structured role-based access controls
Controlled access for authorised Ability Tech personnel
Activity logging and system monitoring

Access to participant and operational data is restricted based on user roles within each Provider organisation.

Privacy & Regulatory Alignment

HuGo is designed to support Provider obligations under:

The Australian Privacy Act 1988 (Cth)
The Australian Privacy Principles (APPs)
The NDIS Code of Conduct
The NDIS Practice Standards

HuGo assists Providers with secure documentation, record keeping and operational oversight. However, Providers remain responsible for their own regulatory compliance, safeguarding obligations and clinical decision-making.

Data Ownership

All data entered into HuGo remains the property of the Provider.

Ability Tech does not claim ownership over Provider or participant data.

Backup & Business Continuity

Automated secure backups are conducted within the AWS environment to support data integrity and availability.

Ability Tech maintains business continuity and disaster recovery procedures designed to minimise disruption in the event of a system outage or security incident.

Security Incident Management

Ability Tech maintains a defined incident response process covering identification, escalation, investigation, containment and remediation.

In the event of a confirmed security incident:

Investigation commences promptly
Impacted Providers are notified as required
Containment and remediation measures are implemented
Regulatory obligations are followed where applicable

Continuous Improvement

As HuGo grows, we continue strengthening our security posture, governance controls and compliance alignment.

We are progressing toward formal cybersecurity certification benchmarks as part of our long-term platform roadmap.

Further Information

For procurement documentation or additional security information, please contact:
support@hugoaustralia.com.au