Security
Security and accreditation
This section answers the questions an assessor, a Security Contact or a board member asks, in the order they usually ask them: where accreditation stands, what is actually built, who can see your data, and where it is kept. Evidence first, not a badge.
Workstride is being built for accreditation by DEWR as a Third Party Employment System. It is not yet accredited.
Where accreditation stands
DEWR sets the pace of accreditation, so we do not publish dates. This is every gate between Workstride and your participants, in brief.
| Gate | Who decides | State | Last changed |
|---|---|---|---|
| The company that operates Workstride is formed | Us | Not started | Not yet |
| DEWR engaged | Us | Not started | Not yet |
| An information security management system, scoped and independently assessed | Us, then an independent assessor | Not started | Not yet |
| DEWR accreditation of the Workstride system | DEWR | Decided by DEWR | Not yet |
| A current Third Party IT Vendor Deed | DEWR | Decided by DEWR | Not yet |
| Your organisation's written approval from the Department | The Department | Not started | Not yet |
| Your organisation's advice to DEWR | Your organisation | Not started | Not yet |
| Approval for any use of AI with participant data | The Department and DEWR | Not started | Not yet |
| Live Department extracts and web services | DEWR | Decided by DEWR | Not yet |
States, not dates: Not started, In progress, Done on a date, or Decided by DEWR, which means the step is DEWR's to take, in its own order and time. Last reviewed 17/09/2026.
What Workstride does not claim
- Accreditation. Workstride is being built for accreditation by DEWR as a Third Party Employment System. It is not yet accredited.
- Security certification. Workstride holds no ISO/IEC 27001 or other security certification.
- Customers or results. No provider uses Workstride yet, so there are no customers, results or time savings to point to.
- To replace ESS Web. ESS Web stays the Department's system of record.
- Dates. DEWR sets the pace of accreditation, so we do not publish dates.
Controls in the build today
Plain, checkable sentences. Nothing here is a certification: see the full list of security controls.
Each provider's records sit in their own database, reached through a database account that has no access to any other provider's database. In the build
Automated tests create separate provider databases and check that records, files, queues, caches, sessions, email and SMS senders and API tokens cannot cross from one provider to another. In the build
Staff sign in through your Microsoft 365 or Google Workspace, so your multi-factor authentication and access policies apply. In the build
Staff never get a Workstride password. They sign in with the Microsoft 365 or Google Workspace account they already use. In the build
Your Security Contact decides who gets access and to which sites. Nothing is granted by default, and nobody's access starts until their Department privacy training is recorded (Part A 6.13). In the build
Support access inside Workstride needs your Security Contact's approval, is limited to the hours and role requested, and every step appears in your access log. In the build
A file only counts as evidence after it passes a malware scan. Infected files are quarantined, and the attempt stays visible on the record. In the build
Access decisions go into a log that cannot be edited in Workstride, which your Security Contact can export. Changes to records and settings keep their before and after values. In the build
Who can see your data, and where it is kept
-
Who can see your data
Four layers, from separate databases you can check today to ownership questions still to be settled.
-
Where your data is kept
Our onshore rule, the boundary between Workstride and your own systems, and a register of confirmed locations.
What stays your responsibility
-
Your workspace's sign-in and multi-factor policies
Workstride relies on your Microsoft 365 or Google Workspace directory for sign-in, so the policies your IT team sets there, including multi-factor authentication, apply to Workstride too.
-
Your Security Contact's decisions
Who gets access, to which sites, and whether to approve a vendor support access request are decisions your organisation's Security Contact makes, not Workstride.
-
Your shared site computer procedures
Workstride issues a single-use code for a shared computer, but the procedure around it, such as who hands it out and when, is yours to set.
-
The Department's written approval
Your organisation seeks the Department's written approval before using Workstride with participant data (Part A 7.2.2).
-
Advising DEWR
Your organisation advises DEWR that it is using a Third Party Employment System before doing so (Deed 42.3(a)).
The assistant's guardrails
The optional assistant is switched off by default. Any feature that reads participant data stays locked until your organisation records the Department's written approval, and a person checks every draft it produces.
In the build Waiting on approval
Accessibility
Participant screens are designed to meet WCAG 2.2 AA, using Atkinson Hyperlegible. An independent review is planned before we say more than that.
How Workstride is built for accessibility
This website's accessibility statement
Everything in this section
-
Accreditation
Where Workstride stands, gate by gate.
-
Security
The controls built today, in plain sentences.
-
Who can see your data
Separate databases and support access, layer by layer.
-
Where your data is kept
Our onshore rule, and your own services.
-
Guides for Security Contacts
Access decisions and the annual self-audit.
-
Accessibility in Workstride
How the product is built for accessibility.
Ask a security or accreditation question
Email [email protected] and say what you need. A person reads and answers every message.
Last reviewed 18/09/2026.
See it on sample data, with the people building it.
A walkthrough covers the parts of Workstride your teams would use, the status of each one, and the approval steps your organisation takes.
Using Workstride with participant data first needs DEWR to accredit the Workstride system and us to hold a Third Party IT Vendor Deed, then your organisation's written approval from the Department (IEA Guidelines Part A 7.2.2).
Workstride is new, and we are inviting Inclusive Employment Australia providers to help shape it before launch. Help shape Workstride.
Tell us who is coming
Send the form with the roles you want to bring and the parts you want to see.
We reply to set a time
We suggest times that suit your team and confirm what the session will cover.
The walkthrough
Sample data only, with the status of every part said out loud. Nothing about your participants is asked or needed.