Xap Security & Trust Centre

Data Sovereignty & Encryption

As a federally approved CCS software provider, Xap is required to meet strict criteria, including data sovereignty. This means all data is hosted within Australia and is fully encrypted. Depending on where your child attends care, information may be shared with State, Territory, or Local governments in accordance with legislation.

Infrastructure & Redundancy

Xap uses multiple redundant, industry-standard Amazon Web Services (AWS) data centres. If our primary AWS centre in Sydney experiences downtime, services automatically shift to one of two backup centres located in Sydney or Melbourne, ensuring minimal disruption.

Security Features

We leverage AWS features such as Web Application Firewall (WAF) to enhance protection.

Penetration Testing

Each year, Xap engages a third-party provider to conduct penetration testing, a simulated cyberattack designed to identify vulnerabilities and test breach resilience. We prioritise and implement recommendations from these reports in our development roadmap.

ISO Standards & Audits

While Xap is not ISO 27001 certified, we align our practices with its principles. We also participate in regular shared security audits with Australia’s largest care providers to maintain high standards across both product and process.

Payment Security

Xap does not store, process, or record credit card data. All payments are handled by our Tier 1 PCI DSS-compliant provider, PayChoice.

Further Reading

• Website Terms of Use

• Privacy Policy

• Terms and Conditions

• End User Licence Agreement