Security and trust
Last reviewed: November 2026
We look after devices, licences and accounts for Australian businesses, so we hold ourselves to the standard we recommend to our customers. This page explains how we protect your information and how to report a security concern.
Signing in
- Our staff sign in to our systems with their Microsoft work accounts, and each person only has the access their role needs.
- Access to the customer portal is by invitation. Your organisation's account owner decides who can see your devices, licences, invoices and support history.
- Sign-in attempts and sensitive requests are rate limited to slow down password guessing and abuse.
Protecting your information
- Every page of our website and portal is served over HTTPS, and browsers are told to use only secure connections.
- Your data is held with established cloud providers that encrypt it at rest.
- Card payments are processed by Stripe. We never see or store your full card number.
- We use your information only to provide our services, as set out in our Privacy Policy. Our supplier costs and pricing arrangements are kept out of the portal.
How we build and change our systems
- Changes to our website and portal are tested on a separate staging site before they go live.
- A person reviews and approves every change before release, including changes prepared with the help of AI tools.
- We review our systems for security weaknesses and fix what we find.
If something goes wrong
If an incident affects your information, we will tell you promptly, explain what happened and what we are doing about it, and notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.
Report a security issue
If you think you have found a security vulnerability in our website, portal or services, please email support@tnd.com.au with "Security report" in the subject. Include what you found and how to reproduce it. We aim to reply within two business days.
Please give us reasonable time to fix the issue before sharing it publicly, and don't access, change or delete other people's data while investigating.