Compliance & security
Designed around the obligations that matter
SFP Online is built for Australian WHS from the ground up — the statutory workflows, the privacy expectations and the audit trail are part of the product, not an afterthought.
Regulatory & governance
Notifiable-incident workflow
The system decides whether an incident is notifiable — fatality, serious-injury and dangerous-incident triggers — and starts a written-report deadline from when you became aware. The reporter can't switch it off, and overdue reports are chased.
Jurisdiction-aware content
Industry content packs preload the form templates, procedures and terminology for your state and trade, so the language on screen matches the way your team already works.
Append-only audit log
Every consequential change is recorded organisation-wide and can't be quietly rewritten — the trail you need for an audit or an investigation is always there.
Retention & legal hold
Records follow statutory retention policies, and legal hold prevents deletion of documents that must be kept — including the long-dated WHS holds.
Signatures that hold up
Drawn signatures for SWMS sign-on, toolbox talks and site inductions; stamped who-and-when sign-offs for verifications and approvals. Both are recorded per version, so an edit re-requires sign-off.
Need-to-know privacy
Medical details — allergies, conditions, notes — are visible only to the member and to people with profile-management permission. Even the change history is redacted the same way.
Victorian health information
Health-monitoring results, injury details and medical fields are handled to the Health Privacy Principles under the Health Records Act 2001 (Vic), which applies to organisations of any size — not only those the Privacy Act covers.
Platform & access control
Per-organisation roles
15 default roles across around 90 fine-grained capabilities, and every organisation can remap what each role may do. Duties are separated by design — the doer of an action is never its verifier.
Multi-tenant isolation
Everything lives inside an organisation. One account can belong to several, and data never crosses the boundary between them.
Modern sign-in
Email and password, Apple and Google for existing accounts, or passkeys with Face ID / Touch ID. The mobile app adds a biometric app-lock.
Locked-down front end
A restrictive content-security policy limits scripts, connections, frames and form targets to the product's own origin, with no third-party trackers or embeds.
Questions about compliance for your industry?
Tell us about your organisation and jurisdiction — we'll show you exactly how SFP Online maps to your obligations.