Security & Trust

Certifications

ISO/IEC 27001

Myaccountant Technology Pty Ltd, the operator of ATO Connect, is ISO/IEC 27001:2022 certified (QAS International, certificate AIT1007).

Standard

ISO/IEC 27001:2022 (Information Security Management System)

Certificate holder

Myaccountant Technology Pty Ltd

Certificate number

AIT1007

Certifying body

QAS International (opens in a new tab)

Scope

Designers and developers of accounting software accessed via Apps for smart devices as detailed in the Statement of Applicability, version 2, dated 28 March 2026.

Originally certified

14 May 2019

Current certificate issued

14 May 2026

Expires

14 May 2027 (audited annually)

Certificate available on request: support@myaccountant.com.au.

ATO Digital Service Provider

Myaccountant Technology Pty Ltd is registered with the ATO (Digital Service Provider programme). Software that connects to the ATO's digital services must meet the ATO's DSP Operational Security Framework, which sets requirements for encryption, authentication, data hosting, audit logging and supply chain security. ATO Connect is operated under those requirements.

ATO Connect is not affiliated with or endorsed by the Australian Taxation Office. Registration with the DSP programme is not an endorsement of our products.

Data residency

ATO Connect is hosted in Amazon Web Services region ap-southeast-2 (Sydney). Data you send through the platform is stored and processed in Australia and is not disclosed overseas.

Encryption

Stored data, including lodgment payloads and records, is encrypted at rest with AES-256.

Access control and MFA

• Portal users can protect their accounts with multi-factor authentication.
• Organisations control who has access, with separate owner and user roles.
• API access uses client credentials issued per environment. You can rotate them from the portal.

Environment separation

The Sandbox (the ATO's test environment) and Production (live lodgment) are kept separate. Each has its own credentials, so test traffic cannot reach the ATO's production systems by mistake. Production access is granted only after your integration has passed conformance and you have completed the Production readiness checklist.

Audit logs

Security-relevant actions, such as API token requests and the creation, rotation and revocation of credentials, are recorded in audit logs. Your organisation can review its audit history in the portal.

Incidents and notifiable data breaches

We maintain an incident response process. If we become aware of a suspected data breach, we contain it, assess it, and where it is likely to result in serious harm we notify affected organisations and individuals and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth) requires. Where the ATO's requirements for Digital Service Providers apply, we also notify the ATO.

Responsible vulnerability disclosure

If you believe you have found a security vulnerability in ATO Connect, please email support@myaccountant.com.au with a description, the steps to reproduce it and any proof of concept. Please:

• give us reasonable time to investigate and fix the issue before you disclose it publicly;
• only test against your own accounts and data, and never access or change other customers' data;
• avoid anything that degrades the service, such as denial-of-service testing or spam;
• never send test lodgments to the ATO's production environment.

We will acknowledge your report, keep you updated, and credit you if you would like us to.