Skip to content
ARK360

Security and compliance

What is enforced, and what is only intended.

A conservative buyer asks this before anything else, and the useful answer separates the controls that block a build today from the targets still being worked towards. Both are on this page, labelled.

Conformance targets

The four standards ARK360 is built against.

Targets, not certifications. No third party has assessed ARK360 against any of them, which is stated again at the foot of this page because it is the sentence most worth not missing.

OWASP ASVS v5.0.0, Level 1
The application security verification standard ARK360 is built against. Level 1 is the baseline tier, and it is named rather than rounded up.
ASD Essential Eight, Maturity Level 1
The Australian Signals Directorate's mitigation strategies, at the first of three maturity levels.
Privacy Act 1988 (Cth), APP 1, 5 and 11
Open and transparent management of personal information, notification of collection, and security of personal information.
WCAG 2.2 Level AA
The accessibility conformance target for the operator console, the resident app and this site.

In the build pipeline

Controls that stop a release, and controls that do not yet.

A control that warns is a control that gets ignored. These are separated by whether they block.

Blocking today

A failure here fails the build, and no release proceeds past it.

  • Dependency vulnerability scanning, as a blocking build gate
  • CycloneDX software bill of materials generation, as a blocking build gate
  • Every operational entity scoped by site in the application layer
  • Destructive actions through the governed tool surface require explicit confirmation
  • Fail-closed authorisation: a decision that cannot be evaluated is refused, not allowed

Not blocking yet

Tracked and scheduled. Listed here so their absence is not read as their presence.

  • Static application security testing
  • A minimum test coverage floor
  • Automated accessibility checks that block a release rather than report
  • Structural site scoping through ORM-level filters and database row-level security, which is enforced in the application layer today
  • An audit record of agent tool invocations, without which the agent layer is role-bounded and confirmation-gated rather than auditable end to end

How it is bounded

Properties of the build, not assurances about it.

Each of these is a decision written into the code and checkable in it, rather than a policy that depends on everyone remembering.

Site scoping does not leak existence
A request for a site the caller does not hold returns the same 404 as a site that does not exist. A 403 would confirm the site is real, which tells one operator something about another.
An agent cannot raise its own authority
Each caller acts under a fixed role ceiling it cannot exceed, and no action escalates the role that took it. The ceiling is enforced at the tool surface, before the action is reached.
Cardholder data is never held
Payments run a card-present-never model: no card details are stored, only provider references. Webhooks are exactly-once and transition-safe, and refunds are atomic.
Client systems stay the record
Property management, access control and finance systems remain authoritative. ARK360 reads context, coordinates work and writes back what a person authorises, which keeps the blast radius of a fault inside ARK360.
Nothing outbound is autonomous
Messages to residents, suppliers and prospects are drafted and held. A person releases them. This is a property of the build, not a setting an administrator can turn off.

What is not claimed

No certification, and no assessment.

The most common way a security page misleads is by listing standards until a reader assumes an auditor was involved.

  • No SOC 2 report, and no ISO 27001 certification
  • No third-party penetration test has been commissioned or published
  • No independent audit against ASVS, the Essential Eight or WCAG has been carried out
  • No accreditation, government approval or vendor tier of any kind is held

A founding pilot is the point at which this stops being a page and becomes a review. An operator’s own security team is welcome to assess the platform against their standard, and that assessment is part of what the programme is for.

Apply for the Founding Pilot Programme