Security and your data
Providers hold some of the most sensitive personal information there is. This page sets out, in plain terms, how Cura handles it.
Where your data lives
Section titled “Where your data lives”- Cura is hosted in Sydney, Australia, on Amazon Web Services. Your database is also in Sydney. Data is not moved offshore to run the service.
- Each organisation runs as its own instance with its own database. There is no shared table of clients across providers.
- Backups are taken every night, encrypted, and kept on a rolling schedule. A separate backup is taken before any change to a database’s structure.
Who can see what
Section titled “Who can see what”- Access is by named user accounts with a password. Password resets go to the user’s email address.
- Every account has a role: Administrator, Provider Admin or Staff Member. A Staff Member sees only their own shifts, their own pay-related entries and the forms assigned to them. Who sees what has the full matrix.
- Administrators can create custom roles that switch off whole modules for a person.
- Emailed links for client onboarding, worker onboarding and shift completion are unique, single-purpose and can be reissued from the office. They never expose anything beyond that one person’s own items.
What protects it
Section titled “What protects it”- All traffic is encrypted in transit (HTTPS only, with modern security headers).
- Access rules are enforced in the database itself, per organisation and per role, not only in the screens. A request that tries to read another organisation’s records is refused at the database.
- Particularly sensitive fields are encrypted at rest with a key unique to your instance.
- Input is validated on the server; forms protect against cross-site request forgery; sign-in and token endpoints are rate limited.
- Independent security reviews were carried out in June and August 2026 and all findings were closed.
The audit log
Section titled “The audit log”Every meaningful action in Cura, such as creating a client, approving a shift or changing a rate, is recorded with who did it and when. Administrators and Provider Admins can search the log on Compliance > Audit log. The log cannot be edited from the app.
Compliance features built in
Section titled “Compliance features built in”- SIRS: reportable incidents are recorded in the Quality module with the fields the scheme requires.
- Support at Home: quarterly budgets, claims, Payment IDs, participant contributions, statements and reconciliation follow the program rules.
- Quarterly Financial Report: the QFR tab in Reports draws from the same approved records as billing.
- Document compliance: required documents for clients and workers are tracked with expiry, and a worker cannot be rostered until their required credentials are verified.
Your responsibilities
Section titled “Your responsibilities”- Give each person their own login. Do not share accounts.
- Remove people from Settings > Team the day they leave.
- Use the Staff Member role for frontline workers and reserve Administrator for the people who need it.
- Report anything that looks wrong to support straight away.
Questions
Section titled “Questions”If you need the detail for a tender, an accreditation audit or your own privacy policy, email support@norai.com.au and we will provide it.