RHIXO

RHIXO Security and Customer Responsibilities

Shared security responsibilities for RHIXO customers and services.

This document forms part of the RHIXO controlled legal framework and applies as described below. It operates together with the RHIXO Customer Agreement, RHIXO Product and Service Schedule, accepted order and other incorporated documents where relevant.

1. Shared responsibility

Security is shared. We secure the platform components we operate; customers secure their users, devices, permissions, data-entry practices and external systems.

2. Baseline controls

Depending on the Service, controls may include authenticated access, least-privilege permissions, tenant isolation, encryption in transit, encrypted provider storage where supported, logging, backups, vulnerability management, secure deployment practices and incident response. We do not represent a control as implemented unless it is actually deployed and verified for the relevant Service.

3. Customer responsibilities

• protect credentials and authentication factors;
• use unique authorised user accounts where supported;
• remove former users promptly;
• configure roles and permissions appropriately;
• maintain supported devices, operating systems and browsers;
• avoid uploading unnecessary highly sensitive information;
• report suspected compromise promptly;
• maintain independent copies of information where the Customer considers continuity critical and the Product Schedule recommends it.

4. Vulnerability and incident handling

We may investigate vulnerabilities, suspicious activity and security events. Customers must not publicly disclose exploitable details before allowing reasonable coordination where disclosure could materially increase risk. Confirmed incidents are handled under the DPA, Privacy Policy and incident-response procedures.

5. Backups and recovery

Backup frequency, recovery objectives and customer restore options vary by Product Schedule. A backup is not represented as effective merely because a file exists; operational verification may include restoration tests appropriate to the Service.

6. Third parties

Cloud, payment, communications, app-store, identity and other providers form part of the delivery chain. We assess and manage suppliers proportionately but cannot eliminate third-party risk.

7. No absolute security guarantee

No internet-connected system can be guaranteed completely secure or continuously available. This statement does not reduce any security obligation imposed by law or an express contract.

8. Reporting security issues

Security reports should be submitted by emailing team@rhixo.com.au and marked SECURITY. Urgent incidents may use any emergency channel identified in the relevant Product Schedule.