Data breach response

A data breach is any event where personal information NestWise holds is accessed, disclosed, or lost without authorisation. Examples:

• An attacker gets into our database or an admin’s laptop and can read profile data
• A subprocessor (Supabase, Stripe, Wych, Resend, Vercel, Anthropic) notifies us they’ve had a breach affecting our data
• A NestWise bug exposes one user’s data to another user (RLS regression)
• A physical device holding secrets is lost or stolen
• Someone tricks a staff member into handing over credentials (phishing)

The Australian Privacy Act ’s Notifiable Data Breach (NDB) scheme gives organisations up to 30 days to assess whether a suspected breach is likely to cause serious harm, then notify affected people + the OAIC. Our commitment is to move faster than the statutory ceiling:

• Within 24 hours of confirming a breach: internal incident channel spun up; scope contained (rotate keys, revoke tokens, freeze impacted systems)
• Within 72 hours: initial assessment of who is affected + what data is at risk
• Within 7 days: notify affected users by email with what happened, what data was involved, what we’re doing, what they should do
• Within 30 days: NDB report lodged with the Office of the Australian Information Commissioner (OAIC) where the breach meets the “likely to cause serious harm” threshold. Earlier if we can
• Within 60 days: public post-mortem published on the blog covering what happened, why it happened, and what we’ve changed to stop it happening again (redacted only for security-sensitive detail)

If the breach touches data received via the Consumer Data Right (bank connection data via Wych), CDR notification rules also apply. In addition to the NDB steps above, we’ll notify:

• The ACCC and the OAIC (joint CDR regulators)
• The CDR-registered data recipient (Wych) who helped facilitate the connection, so they can notify the source bank
• Affected consumers, with clear instructions on how to revoke consent + delete the affected data

See /consent/bank-connection for the full CDR consent + revocation flow.

Every affected-user notification is written in plain English and covers:

• What happened + when we detected it
• Which data types were affected (income, ATI, kids, care fees, etc.) — and which were NOT
• What we’re doing to contain + fix it
• What you should do (e.g. rotate any shared passwords, watch for phishing attempts)
• Where to go for more (this page + a real human at hello@nestwise.net.au)

Notifications go to the email on your NestWise account. If we don’t have a working email for you, we’ll notify by in-app banner instead.

The best defence against a breach is not to hold the data in the first place. NestWise deliberately DOESN’T store:

• Your Tax File Number (TFN)
• Your Medicare number
• Your Centrelink Reference Number (CRN)
• Your full credit card number (Stripe holds this, not us)
• Any government-issued identity document (passport, driver licence)

Any future feature that would need one of these will get its own consent screen + a specific breach-risk assessment first.

If you think NestWise has leaked or lost your data — even if you’re not sure — email hello@nestwise.net.au with “Suspected data incident” in the subject line. We treat every report seriously, respond within 24 hours (usually faster), and never retaliate against good-faith reports.

You can also complain directly to the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints.

The other side of “minimise breach damage” is: don’t keep data longer than you need it. Our retention rules by data type:

“Life of account” means: while your NestWise account is open, we keep it because you might come back to it. Delete your account (email hello@nestwise.net.au) and everything except audit + payment records is purged within 30 days.