Trust and security

Who runs it

SMSF Cockpit is a registered business name of Warwick Aubin, ABN 64 799 581 029, an Australian sole trader. Warwick is an SMSF trustee himself and uses SMSF Cockpit to run his own fund, so he has the same interest in its records being safe as you do. More about Warwick.

We completed a full internal security review on 6 October 2026, covering the code and the live site, and found no exploitable issues.

Where your data lives

• The app and its database both run on servers in Australia (hosted by Vercel and Neon).
• Every connection is encrypted (HTTPS), and browsers are told never to connect any other way.
• Emails such as reminders and invitations are sent through Resend, which may process them outside Australia, and Google handles your sign-in if you choose “Continue with Google”. The privacy policy lists every service that handles your information.

Who can see your fund

• Only the people the fund’s owner invites, or whose request for view-only access the owner approves. Each person is a co-trustee (can view and edit) or an accountant / adviser (can view and download, but can’t change anything).
• Those rules are checked by the server on every page, change and download, not just by hiding buttons. Automated tests check, on every change to the app, that people can’t open a fund they don’t belong to.
• Invitation links work once, expire after 7 days, and only work for the email address that was invited.
• An accountant can ask a client for view-only access, but only the client can grant it, choosing which of the funds they own to share. Nothing is visible until they approve, and a request lapses after 7 days.
• The owner can change someone’s access or remove it at any time, and removal takes effect immediately.
• A trustee can make a read-only link for the fund’s auditor that opens one year’s auditor pack and nothing else, without an account. It expires after 7, 14 or 30 days, can be withdrawn at any time (and stops working at once), and is shown only once: we keep a scrambled copy of it, not the link itself. A view-only accountant can’t make one.
• As the operator, Warwick can reach the database for support and maintenance. The app itself has no screen for browsing funds’ records.

Signing in

• Passwords are stored hashed (bcrypt), so nobody, including us, can read them back.
• A new account’s email address is confirmed before it can join someone else’s fund.
• Repeated failed attempts are slowed down, and every sign-in attempt is logged for 90 days.
• You can turn on two-step sign-in from your account page: after your password, the app asks for a 6-digit code from an authenticator app on your phone. Each code works once, wrong codes are limited, and you get ten single-use recovery codes in case you lose the phone. It’s optional, and we recommend it.
• Or you can sign in with Google instead of a password, which uses whatever two-step verification you have on your Google account.
• You can sign out of every other device at once from your account page.

Records the app won’t let you rewrite

In the app, a trustee minute and each entry in the investment strategy sign-off log can’t be edited or deleted. The strategy statement itself (objectives, targets and so on) can be edited, and each change appears in the Change History.

Changes people make to a fund’s records are recorded automatically in the Change History: who made the change, when, and each field’s old and new value. The app has no way to edit or delete these entries, and everyone with access to the fund, including a view-only accountant, can read them. An entry is written just after the change, so if recording ever failed, that change would have no entry. If a whole fund is deleted, its minutes and history are deleted with it.

A fund’s owner can delete the fund. That removes everything in it, including its minutes, sign-offs, acknowledgements, notes and change history, straight away. It can’t be undone, and the deletion isn’t recorded in the fund’s history. Backups taken before the deletion are kept for roughly two weeks, then expire. Closing an account also deletes any fund that person owned alone. Resetting a practice fund clears its records too.

Backups

• The database provider keeps its own continuous backup, which can restore the database to any moment in the last 6 hours.
• Separately, a complete copy of the database is taken every day, encrypted (AES-256), stored with a different provider from the database itself. The 14 most recent daily copies are kept, roughly two weeks. A problem with one provider doesn’t also take out the backups.
• Both kinds of restore have been tested for real, not just set up.

What we don’t collect

• No tax file numbers, identity documents or card numbers. The app has no fields for them.
• Bank accounts in the succession plan are recorded by bank, purpose and the last 4 digits only, and a HIN by its last 4 characters.
• No passwords, PINs, seed phrases or recovery codes: the succession plan records only where they are kept.
• No advertising or tracking cookies. The public website counts visits anonymously (no cookie, nothing that identifies you), and nothing you do inside your fund is sent to any analytics tool.

Your data is yours

• Anyone with access to a fund, including a view-only accountant, can download all of it at any time, from Settings, with no request to make and no fee.
• The complete export pack is one .zip holding an Excel workbook, a CSV file for every tracker, the same data as JSON for other software, a README explaining every file and column, and checksums that prove nothing has changed since the export. Nothing in it needs SMSF Cockpit to open.
• You can delete your account yourself, and a fund’s owner can delete the fund. We don’t delete a fund’s records just because nobody has signed in for a while, because trustees have to keep records for years.

If SMSF Cockpit ever stops

SMSF Cockpit is a young business run by one person today, so it’s fair to ask what happens if it closes. This is the owner’s commitment:

1. At least 90 days’ notice. The owner will email everyone with an account at least 90 days before the service stops. Everything keeps working as normal during that time.
2. Your export stays available. While the service is running, including throughout the notice period, anyone with access to a fund can download the complete export pack (described above).

If something outside our control, such as insolvency, stops us keeping any of this, we’ll still do everything we reasonably can to let you export your records first.

The best protection doesn’t depend on any promise: download the complete export pack (an Excel workbook, CSV and JSON files and a README, described above) after each year’s audit and keep it with the fund’s other records. Then you always hold your own copy.

What isn’t done yet

We’d rather you hear these from us:

• Two-step sign-in is optional. It isn’t yet required for anyone.
• SMSF Cockpit doesn’t store documents. It records where each one is kept.

Reporting a problem

If you think you’ve found a security problem, or you’re worried about your account, email hello@smsfcockpit.com.au. We’ll reply as soon as we can, and we’ll tell you what we find. No system is completely secure: if a breach is ever likely to cause serious harm, we’ll tell the people affected, as the privacy policy explains.

What SMSF Cockpit is, and isn’t

It keeps an SMSF’s compliance tasks, deadlines and records in one place. It is general information only: it’s not financial, tax or legal advice, and it doesn’t replace your accountant or auditor. It doesn’t lodge anything with the ATO, and it doesn’t track your investments, prices or cash balances.