Roundela — Security Overview
Last updated: 29 August 2026
Why this page exists
If you're a board member, funder, or insurer doing due diligence on Roundela, this is the page you're looking for. It describes how we protect the information organisations trust us with — including, in many cases, information about children.
We've written it plainly and we've included what we don't have as well as what we do.
What we hold
Roundela holds personal information on behalf of organisations, including names, contact details, addresses, dates of birth, emergency contacts, relationships between people, health and medical information, dietary and accessibility needs, background-check outcomes, signed waivers and consents, attendance records, volunteer hours, and payment references.
We treat health information, and any information about a person under 18, as our highest-sensitivity categories.
Encryption
- At rest: AES-256, applied to all stored data and files.
- In transit: TLS 1.2 or higher on our web and database connections; database connections require TLS.
- Keys are held and rotated by our infrastructure providers under managed key services, with access restricted by policy and logged.
Access control
- Each organisation's data is isolated. Every query is scoped to a single organisation. No organisation can see another's records.
- Authentication is handled by a specialist provider. Passwords are never stored in readable form by us, and we never see them.
- Within an organisation, access is controlled by role. The organisation decides who sees what.
- Sensitive fields — health information, dates of birth, and signed documents — are additionally gated by role rather than being visible to everyone with an account.
Our own access
We can access customer data, and we won't pretend otherwise. Access is limited to what is necessary to support you or to fix a fault, is subject to confidentiality obligations, and is logged.
Roundela is currently operated by one person. That means there is no team with standing access to your data — but it also means we do not have the separation of duties a larger organisation would. We'd rather state that than imply a structure we don't have.
Infrastructure and hosting
All infrastructure is in the United States — database and application hosting in Oregon, email delivery in Northern Virginia. Our providers are named on our sub-processors page along with what each one handles.
Region is fixed. Our database region cannot be changed after project creation, so data residency is guaranteed by the absence of any mechanism to move it, rather than by promise alone.
Backups and recovery
- Encrypted backups are maintained continuously by our database provider.
- Backups persist for up to 30 days before being purged.
- A short point-in-time recovery window allows recovery from recent errors.
What this means for deletion: when a record is deleted, it is removed from the live system immediately, but copies persist in encrypted backups for up to 30 days before they are purged. We do not use backups to reinstate individual records that have been deleted.
Tracking and analytics
Roundela runs no analytics, tracking, or advertising technology. No Google Analytics, no tracking pixels, no session recording, no behavioural profiling. Fonts are served from our own systems rather than fetched from a third party.
We use only strictly necessary cookies — authentication, session, and device-trust for volunteer clock-in. There is no cookie consent banner because there is nothing to consent to.
Artificial intelligence
AI features are optional and off unless an organisation enables them. Where they are used:
- We do not use customer or participant information to train, fine-tune, or improve any AI model, and we require the same of any AI provider we use.
- Our provider retains inputs only as long as needed to return a response.
- AI output is a draft, not a decision. Roundela makes no automated decisions about people — no scoring, ranking, profiling, or eligibility assessment.
Payments
Where an organisation takes payments through Roundela, card details are entered directly with the payment processor and never reach Roundela's systems. We hold transaction records and billing contact details only.
Incident response
If we become aware of a breach affecting your data, we will notify you within 48 hours of becoming aware, with what we know at that point, and keep you updated as we learn more.
Where a breach originates with one of our providers, we will notify you without undue delay after they notify us. We deliberately state these as two separate commitments: we can't promise a fixed timeframe for something we learn about second-hand.
Where notification to a regulator or to affected individuals is required, we will support you in meeting that obligation. Under the New Zealand Privacy Act 2020, notification of a breach likely to cause serious harm is mandatory.
Certifications
We do not hold a SOC 2 report or ISO 27001 certification. Roundela is early-stage and operated by one person; those audits assess organisational controls that assume a larger team.
Our infrastructure providers do hold them. Our database provider maintains SOC 2 Type II, SOC 3, ISO/IEC 27001 and 27701, with regular penetration testing. Our email provider maintains SOC 2 Type II and annual penetration testing. We can share what each provider permits us to share on request.
We would rather tell you this plainly than let you discover it during a procurement process.
What you're responsible for
Security is shared. Your organisation controls:
- who has an account, and what access each person has
- removing access when someone leaves or changes role
- keeping credentials private and not sharing logins
- what data you collect and whether you're entitled to hold it
- the settings on any cloud storage you connect — files we file there are governed by your permissions, not ours
Questions
support@roundela.com — we'd rather answer a specific question than have you guess.