How Dispatch is built and tested

Your records, uploaded files and logins are stored in Sydney, Australia (Supabase), and the servers that run Dispatch are in Sydney too (Vercel). Everything travels encrypted (HTTPS) and is encrypted where it’s stored.

Encrypted backup copies are kept off-site with a different provider (GitHub), so a problem at our main provider doesn’t take the backups with it. GitHub may store those encrypted copies outside Australia. The other services that handle some data overseas are listed in our Privacy Policy.

Every table that holds a business’s records has a strict database rule that only lets a signed-in person see their own business’s rows. The database enforces it on every query, not just our code, and an automatic check of the live database confirms the rule is on every such table each morning. Each business’s files sit in storage folders of their own.

Inside your business, roles separate owners, admins and staff, and staff see only what their role needs. The founder can reach the system for support and running the service, and uses it for nothing else.

Dispatch has 100 automatic checks that read the code for known kinds of mistake, and 1,711 test files that check it does what it should. The tests that cover a change run before it ships, and the full set runs every week. These checks read every change before it ships:

• A new database query that could reach another business’s records is refused until it’s limited to one business, or reviewed and the reason written down.
• Every admin action checks the person’s role, not just that they’re signed in.
• Nothing a person types is spliced into a database query.
• Secret keys are compared in a way that doesn’t leak them.
• Every scheduled job is watched, and a failure alerts us.

And every morning, against the live database:

• Every table that holds a business’s records has the rule that keeps it separate.
• Every table and column that holds personal details can be exported and erased.

Counted from the code on 8 November 2026 (version e06bc246).

Our security reviews try to prove each finding wrong before it counts. Our pre-launch review, on 31 July 2026, found two serious issues. Both were fixed and checked closed that day. For one, we re-ran the actual attack against the live system, and it was refused.

This was our own review, not an outside audit. No outside security firm has tested Dispatch yet.

• A full snapshot of the database every day, kept for 7 days.
• An encrypted copy of the whole database, off-site, every week, kept for 12 weeks.
• An encrypted off-site copy of new and changed job photos and files, every day.

We don’t yet run second-by-second recovery, so the newest snapshot can be up to a day old.

An admin can download your business records from Settings › Your data, on every plan: a full copy as one file (clients, jobs, quotes, invoices, timesheets, staff and more), and your clients, jobs, invoices and quotes as spreadsheets. Uploaded photos and documents aren’t in that file; they’re kept in storage and backed up separately.

If a free trial ends without a card, the workspace pauses and everything in it is kept. A paused or cancelled workspace is locked, but an admin with access to Settings can still download both from Settings › Billing.

If Extrua ever stops trading: our policy is to give every business at least 30 days’ notice by email, so you have time to download your records before the service ends.

• Card details are handled by Stripe and never touch our servers.
• Keys for connected services (accounting, Google, Meta, phone) are encrypted with AES-256-GCM before they’re stored, and are only unlocked on our servers at the moment they’re used. They never reach a browser.
• Messages from connected services (Stripe, Xero, phone, email) are checked for a valid signature before we act on them, and our own secrets live in managed settings, never in the code.

We keep an incident plan: contain (revoke and replace affected keys), work out which businesses and what data were affected, fix it, and tell you. If a breach affects your data we’ll tell you without undue delay, with what we know and what we’re doing about it, and we follow the Australian Notifiable Data Breaches scheme where it applies.

Found a vulnerability? Please email hello@extrua.com.au with enough detail to reproduce it. We’ll acknowledge it, keep you updated, and won’t act against good-faith research that avoids other customers’ data and doesn’t disrupt the service.