Centra Limited Contact us

Standards and security.

The standards we build to on every project, and how we meet them. If you need more detail for an evaluation or a risk assessment, ask and we'll walk you through it.

Accessibility

WCAG 2.2 AA

We design and build to WCAG 2.2 Level AA, the level the NZ Government Web Accessibility Standard requires, from the first screen rather than as a fix at the end.

In practice

  • Semantic structure that works with screen readers
  • Every action reachable by keyboard, with visible focus
  • Colour contrast that meets AA
  • Motion that respects reduced-motion settings

Also

Security

Independently tested

We use the NZ Information Security Manual (NZISM) as our reference when designing security controls, and every system we build has an independent penetration test before it goes live.

In practice

  • Encryption in transit and at rest
  • Least-privilege access, with row-level security where data is shared
  • Independent penetration testing before go-live

Once live

  • Security patching and dependency updates
  • Monitoring and backups
  • A security contact published at /.well-known/security.txt
Privacy

Privacy Act 2020

We build privacy in from discovery. Systems collect only what they need, and we support your privacy impact assessment with the detail you need about how information flows.

In practice

  • Data minimisation from the first design
  • Clear purposes for every piece of personal information
  • Support for access and correction requests

For your assessment

  • Data flow descriptions
  • Where information is stored and who can see it
  • Retention and deletion approach
Data and hosting

Hosting agreed with you

Our own platform stores customer data in Sydney, encrypted at rest and backed up daily. For your system, we agree where it runs with you, based on your data classification and cloud risk assessment.

Artificial intelligence

Human approval, always

A person approves every action an AI proposes, and irreversible actions stay human-only. We design with the Public Service AI Framework's principles in mind, including transparency and accountability.

How we use AI responsibly

Ownership

Your code, your data

The code, data and documentation we create for you belong to you. We'll hand everything over whenever you ask, so you're never locked in to us.

Where to next.