User roles and permissions
Public documented controlEvidence available
The onCourse handbook documents individual users, roles and permissions.
Open sourceWhat to review
Map access to responsibilities and test least-privilege settings.
Assurance and evidence
Get the detail your team needs to assess onCourse.
Bring your security, privacy and IT questions into one conversation. Start with the public documentation below, then work with us to confirm the evidence and service arrangements your organisation needs.
Index reviewed 5 October 2026
Login protections
Public documented controlEvidence available
The handbook documents security settings and two-factor authentication for onCourse logins.
Open sourceWhat to review
Confirm the login and identity design for the proposed users, including any separately scoped SSO.
Audit activity
Public documented controlEvidence available
The handbook documents audit logging for reviewing who changed a record and when.
Open sourceWhat to review
Confirm relevant events, retention, access and investigation needs.
Payment assurance
Published evidenceEvidence available
ISH publishes a payment-security attestation for review. Its applicability depends on the payment flow and service boundary.
Open sourceWhat to review
Review the current document, providers, responsibilities and proposed payment flow. Do not treat it as a blanket certification claim.
Hosting and Australian data storage
Discuss for the proposed serviceEvidence available
ISH describes onCourse as operated on AWS with Australian data storage for the managed service context described on this site.
Open sourceWhat to review
Confirm data categories, flows, backups, subprocessors and any connected systems. This is not a claim that every connected copy of data remains in Australia.
Recovery and service commitments
Discuss for the proposed serviceEvidence available
Current recovery evidence and service commitments are reviewed for the proposed arrangement rather than asserted publicly here.
What to review
Request the applicable recovery approach, service commitments, escalation path and evidence.
Accessibility and consolidated services
Discuss for the proposed serviceEvidence available
Accessibility requirements and any cross-institution identity or consolidated reporting need validation against the intended scope.
What to review
Agree standards, test scenarios, responsibilities, data boundaries and acceptance evidence.