Trust Centre
Our clients trust us with sensitive systems and data. This page explains how we earn and keep that trust.
How Lew Innovation protects client and patient data: ISO 27001 certification, SOC 2 Type II, secure development, access control and incident response.
Last updated: October 2026
Certifications and assurance
ISO 27001
Independently certified information security management system (ISO/IEC 27001:2022).
- Registration number
- IC-IS-2604118
- Certifying body
- INTERCERT Inc (InterCert)
- Initial certification
- 9 April 2026
- Surveillance valid through
- 8 April 2027
Scope: The Information Security Management System at Lew Innovation Pty Ltd applies to the organisation's consulting, software engineering, project management, quality assurance, development, design, and related services delivered to clients, together with the systems, processes, and support functions required to protect client information and ensure secure delivery. It covers the IT, Human Resources, and Legal support functions that contribute to maintaining the confidentiality, integrity, and availability of information.
SOC 2 Type II
- Audit period
- 1 September 2025 to 28 February 2026
- Independent service auditor
- Percilchofe CPA LLC
- Trust services criteria
- Security, Confidentiality and Availability
Report available under NDA on request.
How we protect your data
- Least-privilege access, multi-factor authentication and managed devices for all staff.
- Client data and repositories held in client-owned accounts wherever possible.
- No production or patient data in development or test environments.
- Encryption in transit and at rest.
- Secure development lifecycle with peer review and QA on all code, including AI-assisted code.
- Controls on AI coding tools so proprietary code and client IP do not leave controlled environments.
- Vendor and sub-processor review. Website sub-processors: Cloudflare (hosting, CDN, Turnstile bot protection), AWS Sydney (form processing), Salesflare (CRM), Mixpanel EU (analytics, with session replays fully masked).
- Documented incident response and breach notification process aligned to the Notifiable Data Breaches scheme.
Responsible disclosure
Found a vulnerability in one of our systems? Email security@lewinnovation.com. See our security.txt.