How your data is looked after.

The database that holds entries, results and accounts runs in the Sydney region, and uploaded media is stored in the Asia-Pacific region. The application itself runs at the edge, close to whoever is reading it, and reads from that same database.

Connections to AnyRun are encrypted in transit, and the database and the media store are encrypted at rest. On top of that, the fields that identify a person, such as a phone number, a date of birth and an emergency contact, are encrypted again by the application before they are written, so they are not readable from the database alone.

Access is decided in the database itself as well as in the application: every read and write is checked against the person making it, so a request that goes around the interface is refused in the same place. Inside an organisation, access follows the role you were given: an accountant sees the finance pages, and a volunteer sees their own shifts. Administration of the platform requires a second factor.

The database is backed up daily, and the backups are held separately from the running system.

If a breach of personal information is likely to cause serious harm, we tell the people affected and notify the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. Organisers whose entrants are involved are told directly, with what we know at the time.

Payments, email and file storage are handled by named providers, and every one of them is listed with what it receives, why, and where it runs.

If you have found something, write to support@anyrun.net. We will acknowledge it, and we will not pursue anyone who reports a genuine finding in good faith. Our disclosure policy is published at /.well-known/security.txt.