ClientSupplyTrust and legal
Data Security Summary
This summary covers the ClientSupply marketing website and live JobDesk application. It describes controls and boundaries, not a formal certification or promise that internet systems are risk-free. ClientSupply is operated by Leveriano Habiyambere, ABN 99 286 419 439.
Two separate surfaces
The marketing site provides product information and email contact links. It does not create accounts, accept payments or expose internal administration. Customers sign in to the separate application at app.clientsupply.com.au. Access is arranged directly; application account handling and workspace entitlement are distinct.
Application authentication and access
The application uses server-side customer authentication and expiring sessions. Passwords and session, reset, verification and invitation tokens are stored as one-way hashes. State-changing requests use request-integrity and permission checks.
Business membership, role and resource ownership are checked on the server. Database row-level security and forced row-level security on hardened tables provide additional protection. Privileged backend operations must still enforce business and user authority. Internal administration is separate from customer authentication and is not a customer product feature.
Secrets and connected email
Privileged application credentials remain server-side, not in public website assets. Connected mailbox refresh credentials use protected server-side secret storage. Customer-visible histories must not include tokens or provider client secrets.
Enabled customer email requires an authorised person to review and explicitly send. Documents are resolved from the same business’s records, not arbitrary attachment URLs. Google/Gmail activation remains subject to provider consent, configuration and controlled rollout; the sending workflow does not require general inbox-reading access.
Financial boundaries
Invoices, externally received payments and receipts use application-side record authority, including numbering and remaining balances. ClientSupply does not currently process card/bank payments or collect customer funds. No public checkout is provided. Do not enter raw card numbers, CVVs or bank-login credentials.
Transport, monitoring and published surface
Published services use HTTPS. Application security/audit events and health monitoring support investigation of access issues and outages. The marketing release has an explicit allowlist; retired campaigns, application account forms and internal tools are not published on this domain. Operational monitoring functions are separate from customer account flows.
Limits and recovery
Security depends on implementation, configuration, provider controls and ongoing maintenance. This summary does not claim certification, enterprise compliance, guaranteed uptime, a paid recovery tier, point-in-time recovery or a fixed recovery time. Current plan/recovery arrangements should be discussed before adopting the service for workloads with specific requirements.
Keep your own required business records and review suitability. No automatic deletion deadline, unlimited retention or protection against every outage is promised.
Report a concern
Email leveriano@clientsupply.com.au. Send a description, not passwords, session links, provider secrets or customer-data dumps. See the Privacy Policy for information handling.