> ## Documentation Index
> Fetch the complete documentation index at: https://docs.supportwise.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security architecture and hosting

> Review SupportWise hosting, encryption, tenant separation, backups and security controls used to protect school information.

SupportWise uses managed cloud infrastructure and layered access controls to protect school information. Core application and database services are **hosted in Australia**, with documented subprocessors used for supporting functions.

## Hosting overview

> [card] Primary application data
>
> SupportWise uses Supabase for data hosting, authentication and backend services, with production infrastructure hosted in **AWS's Sydney region.**

> [card] Independent disaster recovery
>
> Separate disaster-recovery backups are stored securely in **Microsoft Azure's Australia East Region** to provide an independent recovery copy.

Other subprocessors may handle limited information for functions such as transactional email, network delivery and security. See [Subprocessors](https://docs.supportwise.app/assurance/subprocessors.md) for the current summary and the formal register.

## Encryption

* Customer connections to SupportWise use HTTPS/TLS.
* Primary database and managed backup storage use encryption at rest.
* Independent backup storage is encrypted at rest and in transit.
* Integration credentials should be stored and transmitted only through authorised configuration paths.

## Tenant and access separation

SupportWise is a multi-tenant service. Workspace membership, role-based access controls and data-scope checks are used to restrict access to authorised school information.

Administrative and support access is limited to authorised personnel and should follow least-privilege principles.

Upon request, SupportWise can be hosted separately for single tenant purposes.

## Security operations

Security controls include authentication, role-based permissions, audit history for key actions, managed cloud security controls, backup and recovery processes, and service monitoring.

> [!NOTE]
>
> Detailed internal security configurations are not published in public documentation. Additional assurance information can be provided to authorised reviewers where appropriate.

## Data residency

Core application and learner data is **hosted in Australia**. Some supporting subprocessors may process limited metadata or transactional information outside Australia, as documented in the current Subprocessor Register.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.