Security & Governance

Security by design

Security within SmartLink is implemented by design, not added later as an overlay. The platform is designed to minimise unnecessary exposure and reduce operational risk.

• Least-privilege access controls
• Encrypted data transmission between systems
• Logical segregation of tenant and claim data
• Controlled and approved integration endpoints
• Continuous auditability of data movement

SmartLink does not expose open or public APIs. All integrations are approved, configured, and governed.

Controlled access

Only approved organisations and systems are permitted to exchange data via SmartLink. Access is explicitly granted and limited to defined operational purposes.

• Unique identification and authentication of participants
• Access authorised per claim or workflow
• Role-based access to relevant data only
• Comprehensive access logging

Connection does not imply unrestricted access. Data availability is governed by claim context and party relationships.

Data ownership

SmartLink does not claim ownership of claim or repair data. Ownership remains with the originating party.

• Originators retain accountability
• Recipients manage data post-receipt
• SmartLink secures data in transit

Auditability

Every data exchange is designed to be traceable and auditable.

• Source and destination identification
• Timestamped transfer records
• Defined payload scope
• Error and exception logging

Privacy

SmartLink supports compliance with applicable privacy and data protection obligations, including the New Zealand Privacy Act 2020.

• Data minimisation
• Purpose limitation
• Secure handling of personal information
• Retention controlled by data owners