Supplier & trust
Procurement teams ask the same questions. Here are our answers, in their order: who we are, what data we hold, our modern slavery position, supplier-code alignment, Chain of Responsibility, security, and certifications.
HypaBase is an Australian proprietary company. We operate a closed, invite-only B2B SaaS: an intelligence system that finds and ranks Australian companies likely to have freight demand, built from company-level public data, with a CRM for the sales teams that act on it.
Just as important for your checklist is what we are not. Most supplier-onboarding questions assume a supplier that handles goods, premises or consumers. We do none of that, and every answer below flows from this:
PII - personally identifiable information - is anything that can identify a living person: a name, an email address, a phone number, a photo. Australian law calls it personal information, and it is broader than most people expect: a business contact’s name and work email count.
So yes - like every CRM, we handle a small amount of personal information, and we handle it the compliant way: collected only from publicly available websites and official registers, handled to Australian Privacy Principles standards, never sold, deletable on request. The full picture is layered, so we give it in three tiers rather than a slogan.
The bulk of the product: company names, ABN and ACN, industry, websites, and public register records. Information about a company is not personal information under section 6(1) of the Privacy Act 1988 (Cth).
Names, roles, and work email addresses of people at companies, drawn from public sources only. This is personal information and we handle it to Australian Privacy Principles standards.
The account details of the people who use HypaBase: name, work email, and workspace settings.
Sole traders: where a business is a sole trader, its business details can also be personal information about the individual. We treat those records as Tier 2, with the same rights and the same opt-out.
We do not rely on the small-business exemption in the Privacy Act. We handle personal information to Australian Privacy Principles standards voluntarily, and our compliance page maps each principle to the mechanism that enforces it.
The mechanisms behind these commitments live on our compliance page, and the exercise paths are one click away: data request and opt out.
We are not a mandatory reporting entity under the Modern Slavery Act 2018 (Cth); our revenue is far below the AU$100 million threshold. This statement is voluntary, and it follows the structure section 16 requires of mandatory statements so you can read it against your checklist. We also know the register from the inside: our product indexes the federal Modern Slavery Register as a statutory data source.
An Australian proprietary company delivering desk-based software services. No manufacturing, no raw materials, no labour hire, no offshore facilities.
Short and fully mapped: cloud infrastructure, SaaS tooling, payment processing, and professional services. Each major vendor is a large technology company that publishes its own modern slavery statement.
Risk in our direct operations is very low: a small professional team in Australia. We acknowledge the inherited risk in the hardware and data-centre tiers beneath our cloud vendors, a risk common to every software business.
We prefer vendors that are mandatory reporters with published statements, we pay no recruitment fees, we retain no worker documents, and we commit to investigate and remediate any issue raised with us.
We review our vendor list annually and re-issue this statement annually.
The founder and director is accountable for this statement and the actions in it.
Supplier codes across industries ask for the same commitments. Our answers fall into three classes, and every clause you send us lands in one of them.
The shape of the business makes non-compliance impossible.
Australian law already binds us to the standard your code asks for.
Commitments we back with running mechanisms you can probe.
No, and here is the test rather than a bare assertion. Under section 5 of the Heavy Vehicle National Law, Chain of Responsibility status follows function, not industry. A party is in the chain only if it performs one of ten defined functions:
We perform none of them. We do not consign, receive, pack, load, schedule or operate anything that moves; our product ends at a ranked list of companies and the evidence behind each ranking. Nothing in it instructs, schedules or pressures any transport activity.
We acknowledge the framework and our customers’ obligations under it. If the scope of any engagement ever came to include one of the listed functions, we would reassess our status before proceeding.
Every control below is running in the shipped product today. None of them is a roadmap item.
Every query is scoped to the requesting tenant at the database layer, not just in application code.
Server-side fetches leave through a single audited egress path that can only reach approved public destinations.
Our crawler names itself HypaBaseBot and enforces robots.txt with a fail-closed RFC 9309 engine: when a robots file cannot be read, we do not crawl. It reads only pages a company has published publicly.
Builds are scanned for leaked credentials, and a hit fails the build outright.
Design, architecture and test gates run on every commit - 1,600+ automated tests today - and a regression blocks the deploy.
Sensitive actions and data exposure are recorded in an audit log.
Personal information is stripped before any text is sent to an AI model.
Model weights are versioned, every promotion is a human decision recorded against a named person, and until a human promotes, the layer changes nothing - the platform ranks on pure deterministic rules.
Today: none. We would rather tell you that plainly than stretch a claim. What we have instead is a right-sized ladder, climbed in order, with each rung earned before it is claimed.
The free small-business cyber safety programme backed by the Australian Government.
No certification body exists for the Essential Eight, so self-assessed is the only honest term. Treat any claim of an Essential Eight certificate, from anyone, as a red flag.
A self-attested annual cyber-security certification designed for smaller suppliers.
Multi-month, audit-backed programmes. We will invest when an enterprise agreement justifies them, and this page will say so the day it changes.
Email [email protected]. We respond to supplier questionnaires, self-assessments and audit requests, and the same address handles data requests, corrections and opt-outs.
This page is provided for information and does not constitute legal advice. It is written to be checked: every mechanism named here exists in the shipped product, and we would rather you probe it than take it on faith.