{"id":12,"date":"2026-03-05T21:53:29","date_gmt":"2026-03-05T10:53:29","guid":{"rendered":"http:\/\/localhost:10013\/?page_id=7"},"modified":"2026-08-17T04:34:14","modified_gmt":"2026-08-17T04:34:14","slug":"trust-center","status":"publish","type":"page","link":"https:\/\/trustmibowork.o.thrivex.io\/","title":{"rendered":"Trust Center"},"content":{"rendered":"\n\n\n\n
\n\n\n\n
\n
\"\"<\/figure>\n\n\n\n
MIBO TRUST CENTRE<\/h6>\n\n\n\n

Security you can see<\/span><\/h2>\n\n\n\n
\n

Mibo is ISO 27001:2022 certified. Our platform is built on Microsoft Azure Australia with enterprise-grade encryption, access controls, and continuous compliance monitoring.<\/p>\n<\/div>\n\n\n\n

\n
\n

\ud83d\udee1\ufe0f<\/p>\n\n\n\n

\n

ISO 27001:2022<\/p>\n\n\n\n

Certified<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

\u2601\ufe0f<\/p>\n\n\n\n

\n

Azure Australia<\/p>\n\n\n\n

Data Sovereignty<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

\ud83d\udd10<\/p>\n\n\n\n

\n

AES-256<\/p>\n\n\n\n

Encryption<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

\ud83d\udc65<\/p>\n\n\n\n

\n

MFA Enforced<\/p>\n\n\n\n

All Users<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

\ud83d\udcca<\/p>\n\n\n\n

\n

Min Group 8<\/p>\n\n\n\n

Aggregation<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n
\n
Compliance<\/a><\/div>\n\n\n\n
Controls<\/a><\/div>\n\n\n\n
Data Collected<\/a><\/div>\n\n\n\n
Subprocessors<\/a><\/div>\n\n\n\n
Resources<\/a><\/div>\n\n\n\n
FAQ<\/a><\/div>\n<\/div>\n\n\n\n
\n

01 – Compliance Frameworks<\/p>\n\n\n\n

Trusted by design<\/strong><\/h2>\n\n\n\n
\n

Our compliance program is built into operational workflows – not bolted on. Evidence is generated automatically as a byproduct of daily operations.<\/p>\n<\/div>\n\n\n\n

\n
\n

\ud83c\udfc5<\/p>\n\n\n\n

ISO 27001:2022<\/p>\n\n\n\n

Certified<\/p>\n<\/div>\n\n\n\n

\n

\ud83d\udccb<\/p>\n\n\n\n

SOC 2 Type II<\/p>\n\n\n\n

In Progress<\/p>\n<\/div>\n\n\n\n

\n

\ud83c\uddea\ud83c\uddfa<\/p>\n\n\n\n

GDPR<\/p>\n\n\n\n

Readiness<\/p>\n<\/div>\n\n\n\n

\n

\ud83c\udde6\ud83c\uddfa<\/p>\n\n\n\n

Privacy Act 1988<\/p>\n\n\n\n

Complete<\/p>\n<\/div>\n<\/div>\n\n\n

\n

Detailed Status<\/h2>\n
\n
\n

SOC 2 Observation<\/p>\n

Started Feb 2026<\/p>\n

GDPR Gap Closure<\/p>\n

78% Complete<\/p>\n <\/div>\n

\n

Target Audit Date<\/p>\n

Q4 2026<\/p>\n

Next ISO Surveillance<\/p>\n

August 2026<\/p>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n\n\n

\n

02 – Security Controls<\/p>\n\n\n\n

Defence in depth<\/strong><\/h2>\n\n\n\n

Our security controls span 10 domains aligned to ISO 27001 Annex A and SOC 2 Trust Services Criteria.<\/p>\n\n\n\n

Access Security<\/summary>\n

Role-based access control (RBAC)<\/p>\n\n\n\n

Multi-factor authentication (MFA)<\/p>\n\n\n\n

Session management and timeout<\/p>\n\n\n\n

Principle of least privilege<\/p>\n\n\n\n

Access review processes<\/p>\n<\/details>\n\n\n\n

Encryption<\/summary>\n

AES-256 encryption at rest<\/p>\n\n\n\n

TLS 1.2+ in transit<\/p>\n\n\n\n

Key management via Azure Key Vault<\/p>\n\n\n\n

Database encryption (TDE)<\/p>\n<\/details>\n\n\n\n

Network Security<\/summary>\n

Web Application Firewall (WAF)<\/p>\n\n\n\n

DDoS protection (Cloudflare)<\/p>\n\n\n\n

Network segmentation<\/p>\n\n\n\n

Intrusion detection<\/p>\n<\/details>\n\n\n\n

Vulnerability Management<\/summary>\n

Annual penetration testing<\/p>\n\n\n\n

Dependency scanning<\/p>\n\n\n\n

Patch management process<\/p>\n\n\n\n

Vulnerability remediation SLAs<\/p>\n<\/details>\n\n\n\n

Incident Response<\/summary>\n

Documented incident response plan<\/p>\n\n\n\n

24-hour client notification SLA<\/p>\n\n\n\n

72-hour GDPR supervisory authority notification<\/p>\n\n\n\n

Post-incident review process<\/p>\n<\/details>\n\n\n\n

Change Management<\/summary>\n

Formal change approval process<\/p>\n\n\n\n

Impact assessment requirements<\/p>\n\n\n\n

Rollback procedures<\/p>\n\n\n\n

Release documentation<\/p>\n<\/details>\n\n\n\n

Business Continuity<\/summary>\n

Disaster recovery plan<\/p>\n\n\n\n

Quarterly DR testing<\/p>\n\n\n\n

RTO\/RPO defined<\/p>\n\n\n\n

Geographic redundancy<\/p>\n<\/details>\n\n\n\n

Monitoring & Logging<\/summary>\n

Centralised log management<\/p>\n\n\n\n

Security event monitoring<\/p>\n\n\n\n

Audit trail retention<\/p>\n\n\n\n

Alerting and escalation<\/p>\n<\/details>\n\n\n\n

Organisational Security<\/summary>\n

Security awareness training<\/p>\n\n\n\n

Background checks<\/p>\n\n\n\n

Acceptable use policies<\/p>\n\n\n\n

Annual policy review<\/p>\n<\/details>\n\n\n\n

Vendor Management<\/summary>\n

Vendor security assessments<\/p>\n\n\n\n

DPA requirements<\/p>\n\n\n\n

Sub-processor monitoring<\/p>\n\n\n\n

Annual vendor reviews<\/p>\n<\/details>\n<\/div>\n\n\n\n

\n

03 – Data Transparency<\/p>\n\n\n\n

What we collect<\/strong><\/h2>\n\n\n\n

Transparency about the data our platform processes, organised by user type. Mibo acts as a data processor \u2014 our clients are the data controllers.<\/p>\n\n\n\n

\n
\n
\n

Portal Users<\/strong><\/p>\n\n\n\n

PERSONAL<\/p>\n<\/div>\n\n\n\n

\n

Data fields<\/strong>:<\/p>\n\n\n\n

First name \u00b7 Last name \u00b7 Email address<\/p>\n<\/div>\n\n\n\n

\n

Purpose:<\/p>\n\n\n\n

Platform authentication and administration<\/p>\n<\/div>\n\n\n\n

\n

Lawful basis:<\/p>\n\n\n\n

Contractual necessity (GDPR Art. 6(1)(b))<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

Survey Confidential Users<\/strong><\/p>\n\n\n\n

PERSONAL + SENSITIVE<\/p>\n<\/div>\n\n\n\n

\n

Data field<\/strong>s:<\/p>\n\n\n\n

Name \u00b7 Email \u00b7 Job role \u00b7 Department \u00b7 Tenure \u00b7 Manager \u00b7 Location \u00b7 Survey responses (may include psychological and wellbeing data)<\/p>\n<\/div>\n\n\n\n

\n

Purpose:<\/p>\n\n\n\n

Psychosocial risk assessment and wellbeing monitoring<\/p>\n<\/div>\n\n\n\n

\n

Lawful basis:<\/p>\n\n\n\n

Consent + Explicit consent for Art. 9 data<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

Survey Anonymous Users<\/strong><\/p>\n\n\n\n

NON-PERSONAL<\/p>\n<\/div>\n\n\n\n

\n

Data field<\/strong>s:<\/p>\n\n\n\n

No identifying information collected \u00b7 Aggregated responses only \u00b7 Minimum group size of 8<\/p>\n<\/div>\n\n\n\n

\n

Purpose:<\/p>\n\n\n\n

Anonymous wellbeing assessment<\/p>\n<\/div>\n\n\n\n

\n

Lawful basis:<\/p>\n\n\n\n

Outside GDPR scope – no personal data<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n

04 – Sub-processors<\/p>\n\n\n\n

Our trusted partners<\/strong><\/h2>\n\n\n\n

We maintain a minimal sub-processor footprint. All data processing occurs on Australian infrastructure by default.<\/p>\n\n\n\n

\n
\n
\n

Microsoft Azure<\/strong><\/p>\n<\/div>\n\n\n\n

\n

Cloud hosting, compute, storage, database services<\/p>\n\n\n\nDPA Active<\/span>\n<\/div>\n\n\n\n

\n

\ud83d\udccd Australia East (Sydney)<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

Cloudflare<\/strong><\/p>\n<\/div>\n\n\n\n

\n

CDN, DDoS protection, DNS, WAF<\/p>\n\n\n\nDPA Active<\/span>\n<\/div>\n\n\n\n

\n

\ud83d\udccd Global (nearest PoP)<\/p>\n<\/div>\n<\/div>\n\n\n

\n \n
\n

Subprocessor Change Notifications<\/h2>\n

Receive 30-day advance notice when subprocessors are added, removed, or changed.<\/p>\n <\/div>\n