Security, data protection and compliance

If you're completing a vendor review or security assessment, this article answers the questions we're asked most often. For the full picture, see our Security Statement.

Where is my data stored?

All data is stored on servers in Sydney, Australia, hosted in Equinix data centres. Your data stays onshore. We don't store data offshore, and we don't sell or share your account or contact data.

How is my data protected?

Data is encrypted in transit using TLS 1.2 or above, and encrypted at rest with 256-bit AES. Particularly sensitive details carry an additional layer of AES-256-GCM encryption on top. Accounts support two-factor authentication and individual logins for each team member, and staff access to production systems follows the principle of least privilege with mandatory multi-factor authentication.

Do you hold ISO 27001 or SOC 2 certification?

Mobile Message does not directly hold ISO 27001 certification. Our platform is hosted in Equinix data centres that are independently audited and certified against ISO 27001, SOC 1 and SOC 2 Type II, PCI DSS, ISO 22301 (business continuity) and ISO 50001. This gives the infrastructure our platform runs on a strong, externally verified security foundation.

Are you GDPR compliant? Do you offer a DPA?

Mobile Message is an Australian platform for sending SMS to Australian mobile numbers, so GDPR generally isn't relevant to the service. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). We do not offer a GDPR Data Processing Agreement. You can read the detail in our Privacy Policy.

What other compliance applies?

As an Australian messaging provider we operate under the Spam Act 2003 and work closely with the Australian Communications and Media Authority (ACMA). We're a certified participant in the ACMA SMS Sender ID Register and a member of the Telecommunications Industry Ombudsman (TIO) scheme.

Do you offer an uptime guarantee?

Yes. We guarantee at least 99.9% platform availability every calendar month, backed in writing by our Service Level Agreement. Current availability and planned maintenance are always visible on our status page.

How do I report a security concern?

Email hello@mobilemessage.com.au and mark it for our security team. We take every report seriously and will get back to you quickly.