Security & trust
Evidence you can trace, on a platform you can trust
RTOCentral is built around tenant isolation, role-based access, audit history, and human review, so you get records you can stand behind, and AI that stays a source-linked assistant.
Tenant isolation and access
- Every tenant's data is isolated at the database level, enforced by row-level security.
- Role-based access across owners, compliance, administrators, trainers, and consultants.
- Multi-factor sign-in with an authenticator app or SMS; single sign-on and hardware security keys on the Enterprise plan.
- Audit logs over records, reviewer decisions, and sign-offs.
How we handle evidence
- Source files stay linked to the review findings they support.
- Review history is preserved, so prior decisions stay inspectable.
- AI-assisted suggestions stay separate from human sign-off.
- Corrective actions are tracked through to closure.
Where AI stops and people start
- AI-assisted suggestions cover mapping, evidence summarisation, risk flags, draft findings, and marking drafts.
- A human reviewer approves every output before it enters a record or a review pack.
- Source links make every AI-assisted suggestion reviewable against the evidence behind it.
- RTOCentral does not claim regulatory or audit-success outcomes, and does not give legal advice.
Data protection and continuity
- Encrypted secure upload and storage of source evidence files.
- Regular backups with tested restore and disaster-recovery procedures.
- Data retention controls aligned to RTO record-keeping obligations.
- Australian privacy-conscious design.
Traceability, in practice
Every AI-assisted suggestion stays linked to the evidence it came from, and waits on a human reviewer to accept, check, override, or sign off. The reviewer's decision and the source link travel with the finding into the review pack.
- Source-linked AI-assisted suggestions, not autonomous decisions.
- Human sign-off recorded against every finding before it enters a review pack.
- Review history preserved so prior reviewer decisions stay inspectable.
About this site
- This public marketing site does not store customer data.
- The contact form uses server-side validation and spam controls.
- The demo login is kept separate from public pages and gated by invitation.
Want the detail? Talk to us about how RTOCentral handles your data, where AI stops, and how audit history is kept.