Security & trust
Your quotes, jobs, invoices and customers' details are the heart of your business. Here's how TradesM8 looks after them, in plain English.
Where your information lives
- Hosted on Microsoft Azure in Australian data centres.
- Backups are kept in a second, separate Australian region.
- M8, the built-in assistant, runs on Amazon's AI service in Australia.
Keeping every business separate
- Each business's information is walled off in the database itself, so one business can never see another's.
- Links you send customers are long and random, and we only keep a scrambled copy of them, so they can't be guessed.
- Changes to quotes, jobs and invoices are recorded in a history: who did what, and when.
Signing in
- There are no TradesM8 passwords to steal or forget. You sign in with Microsoft, Google, or a one-time code we email you.
- Signing in with Microsoft or Google uses that account's own protection, including two-step sign-in (MFA). We recommend turning it on.
- Emailed codes expire after 10 minutes, and repeated wrong tries are blocked.
- The owner decides who's on the team and what each person can do, and can switch someone off straight away.
How it's protected
- Everything is encrypted: on the way between your device and TradesM8, and where it's stored.
- The database isn't reachable from the internet, only from TradesM8 itself.
- Keys and passwords our systems use are kept in a secure vault, never in our code.
- Public pages have a check that you're a person, and limits that stop bots trying over and over.
- TradesM8 is monitored 24/7 by our Security Operations team, with automated alerts for threats and unusual activity.
Backups and your copy
- Your information is encrypted and backed up 24/7, and can be restored to an earlier point if something goes wrong.
- You can download all your information at any time from Settings. It's yours, and if you leave, you can take it with you.
Payments
Card payments are handled by Stripe, a PCI DSS Level 1 payment provider. Card numbers go straight to Stripe: TradesM8 never sees or stores them.
Built on Microsoft Azure
TradesM8 runs on Microsoft Azure. Microsoft's Azure services are independently certified to ISO/IEC 27001, 27017, 27018 and 27701 and audited under SOC 1, SOC 2 and SOC 3, and Azure's Australian regions have been assessed under the Australian Government's IRAP program. These are Microsoft's certifications for the platform TradesM8 runs on, not certifications of TradesM8 itself. You can read them on Microsoft's compliance pages.
Who we work with
To run TradesM8, some information passes through these providers:
- Microsoft Azure (Australia): where TradesM8 and your information are hosted.
- Amazon Web Services (Australia): sending email, and M8's AI.
- Stripe: card payments, if you turn them on.
- Twilio: text messages, if your plan includes them.
- Xero: invoices, if you connect it.
- Microsoft or Google: signing in, and your own mailbox if you connect it.
- Cloudflare: the "are you a person?" check on public pages.
Stripe, Twilio and Xero may handle information outside Australia.
Your privacy
We handle personal information under the Privacy Act 1988 (Cth). If a data breach is likely to cause serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the law requires. See our privacy policy.
Found a security problem?
Please email hello@tradesm8.au with "Security" in the subject. We'll look into it straight away.