Walk out of every audit. Sleep through ASIC scrutiny. 100+ hours per month back to your clients. Meeting prep in minutes, not hours. Portfolio rebalancing in days, not two weeks. You don’t migrate off anything. Surity360 sits above your existing stack and proves your advice from the systems you already run.
Arkie does the admin — safely. Grounded in dated, sourced evidence; the advice stays the licensed adviser’s. Meet Arkie →
Australian advice practices don’t have a demand problem.
They have a capacity problem.
A 60-minute advice meeting carries 8–13 hours of work around it — before and after, across the whole advice journey. Arkie gets Discuss → Assemble → Prepare into pre-final shape before the meeting; then after it, files the outcome and prepares the implementation paperwork — so the paraplanner and adviser finalise and deliver the advice instead of assembling it from scratch. We prep. We don’t advise. Click any card.
Arkie is the conversational surface for the four-step adviser workflow — Discuss → Assemble → Prepare → Deliver. Advisers ask Arkie in plain English; Surity360 assembles the answer from the governed data layer. Arkie never advises. Arkie never decides. Arkie surfaces what the adviser needs to walk in ready.
Capital-backed consolidators are aggressive buyers of Australian advice practices in 2026. Whether you are five years from an exit or fifteen, the dynamic is the same: the multiple they pay is set by what they have to fix after they buy you. A fragmented book is a discount. A practice with a unified client record and an auditable evidence chain is a premium. This is not a retirement question. It is a capital question — and the answer is the same at every stage of a practice’s life.
Four workflows that consume capacity in every advice practice. Four problems Surity360 closes.
The adviser opens one screen. Fact find, life plan goals, current portfolio, performance against benchmark and goals, strategy options scored against the client’s circumstances, retirement projections, key SharePoint documents — all dated, all sourced, all in one view.
Before a review meeting, an adviser typically pulls from five separate systems: XPlan or CRM for fact find, risk profile and goals, several platform portals for holdings with sparse performance data (some like industry super require a statement request), a separate tool for projections. The assembly takes 30–90 minutes per client. It is also where errors enter — the goals and facts in XPlan have not been reconciled with the online fact find update the client submitted before the meeting.
With Surity360, prep for a clean file takes under ten minutes. The life plan and fact find are current and in sync. The portfolio view is live. The strategy options are already scored. The meeting starts with the client, not the data.
The review meeting ends. The advice development begins.
Between the client meeting and the SOA presentation, the adviser builds the recommendation: what to propose, what alternatives were considered, and why each was ruled out. That reasoning — invisible to the client — is what §961B(2)(e) requires to be on the file.
In most practices, that process is fragmented. Fact find and risk profile are in XPlan. The current portfolio is across platform portals. The strategy analysis happens in the adviser’s head or in a Word document. Alternatives are summarised in boilerplate rather than scored against the client’s actual circumstances. The SOA is drafted from notes, not from structured data.
The Strategy Explorer draws on the canonical client record — current fact find, risk profile, goals, and portfolio — and scores strategy options against the client’s specific circumstances, objectives, preferences, and time horizon. The ADW captures the reasoning as the advice is developed: what was recommended, what was considered, and why each alternative was ruled out — structured, dated, attached to the SOA. The BID evidence chain is built during advice development, not reconstructed afterwards.
For a Hold No Change or minor further advice ROA, the same infrastructure produces the evidence with materially less effort — the prior strategy is already on record and the scoring is already done.
The adviser decides to move all Growth clients from VGS to VGAD to add currency hedging, or shift surplus cash into an Enhanced Income product across the book. The decision takes five minutes. Everything else is handled.
For a single-line rebalance — currency hedge adjustment, cash yield optimisation, ETF substitution — the advisory work is straightforward. The administration is not. A book-wide switch can require 100–200 ROAs per adviser: each one drafted, sent to the client for consent, and filed to the client record. Every step runs through a different system, and none of them talk to each other. At that volume, the paperwork takes days.
Surity360 identifies the affected clients from the HUB24 alignment dashboard, pre-populates the rebalance rationale for each ROA, sends them to clients for consent, and files each response to the client record automatically. The adviser makes the call. The platform does the rest.
Outsourcing the rebalancing to an SMA manager removes one operational problem. It creates three compliance ones.
Performance monitoring. The SMA manager reports against their own chosen benchmark. The adviser’s obligation is different: to monitor whether the product continues to serve each client’s specific objectives, risk profile, and time horizon — not whether it is performing well in the abstract.
Cost justification. At every review, §961B(2)(e) requires the adviser to demonstrate that the SMA’s additional cost over a low-cost alternative — a direct ETF, a model portfolio — is justified by a quantifiable benefit. Diversification, factor exposure, active return, drawdown management: whatever the claim is, it needs to be specific to this client’s circumstances and on the file. A boilerplate paragraph stating the product is suitable is not an evidence chain. ASIC has reviewed this and said so explicitly.
Conflicts of interest. Where the licensee or practice receives rebates or volume payments from SMA providers, every recommendation of that product carries a conflict. The file needs to show the recommendation was made in the client’s interest despite the conflict — not because of it.
Surity360 monitors each SMA across 1D, 4W, 3M, YTD, FY, 1Y, and 3Y horizons, benchmarked against the indexes and peer funds the adviser selects. The ADW captures the cost justification as structured fields — concentration, correlation, factor exposure against the low-cost alternative — and generates a BID-ready file note paragraph tied to the client’s specific circumstances. Conflict arrangements are flagged at the point of recommendation and tracked through to disclosure.
The adviser still makes every call. The file now shows why.
From NJBFS Financial Services — Hobart, AFSL-licensed, the pilot tenant since 2025.
“Meeting prep used to mean asking offshore support to log into XPlan, build a client review pack, pull the wrap statement, find the MyProsperity fact find. Hours of team time, and I still walked in feeling I had missed something. Now I ask Arkie. Ten to fifteen minutes. I walk in ready.”
“The team’s workload runs from one screen. Data stays in sync across every platform we use. Quality exceptions surface before the adviser sees them. Turnaround times are measured continuously, not retrospectively. Stuck jobs go to the Hit Squad. Nothing falls through the seam between systems any more.”
“I now build the ADW with every potential strategy scored against the client’s goals, persona and mindset — before I draft a word of the SOA. The rationale is right first time. The SOA writes itself: concise, tailored to the client’s needs, objectives and preferences, defensible against any review. Hours of XPlan library editing and consistency checks have come back.”
If you run an advice practice in Australia, you recognise these. The compliance gaps are the legal symptom. The capacity gap is the management problem.
Key takeaway. Each system operates in isolation. The exceptions — a one-way under-20-field push from XPlan into Worksorted, an XPlan ↔ MyProsperity two-way fact-find sync, and a storage-only link between SharePoint and MyProsperity — prove the gap; they don't close it. The compliance evidence chain still breaks at every seam.
When the SOA is written, every system is in sync. Drift starts the moment an interim change hits the platform — a model upgrade, an ROA, an adviser-initiated rebalance — without simultaneous edits to four other system fields. The static risk-profile records in XPlan, Worksorted and MyProsperity sit untouched until next year’s review. For up to twelve months the firm has a HUB24 implementation that disagrees with three of its own records of who the client is.
Historically, advisers shrugged at this — the CRM was a contact database, not the source of truth. Now the CRM is the firm’s compliance monitoring tool and the audit-evidence system of record. When ops staff need to act on a client — process a withdrawal, vary a fee, update a beneficiary — they hit four different stated risk profiles and cannot tell which is correct. Every contradiction slows the team down.
Worksorted holds the renewal date. Nothing holds the running narrative — what is outstanding, who owns the next step, why the meeting keeps slipping, how close the AAA clock is. Each handover (research → ADW → paraplanner draft → adviser sign-off → client meeting) lives in someone’s inbox or head. The partner finds out at the next pipeline meeting, or at renewal.
Below-the-line drag eats 8–12 hours per week per adviser, even with offshore paraplanning. That is roughly $115,000 per year of lost client-facing time.
Probably not without weeks of file-rummaging. The temporal-compliance bar is not new — what was known about the client at the time, the specific alternatives considered (not a generic boilerplate list), and a file-note evidence chain that hangs together end to end. A signed ATP or a disclosure paragraph in the SOA was never enough on its own.
In the paper era it was carried by handwritten fact-find notes and diary entries from phone calls. In a modern team practice — multiple advisers, paraplanners, offshore implementation, support — that evidence is supposed to live in XPlan or Worksorted file notes. Often it does not. Even when it does, surfacing it for one client at one moment in time, months later, is a coordination problem fragmented stacks were never built to solve. Fact finds full of numbers and broad goals miss the qualitative texture (preferences, options ruled out, why) that BID actually wants. ASIC’s October 2025 offshore review and BID intensification raised the cost of getting it wrong, not the bar.
Each new client multiplies documents, renewals, signatures, and follow-ups. Manual oversight does not scale — and a fragmented book is what costs you one to two turns of multiple when it is time to sell or transition.
Compliance lawyers now treat $50/year as the BID materiality threshold for product cost comparisons. Every SMA in every review must show that the fee differential over a cheaper alternative is offset by quantifiable diversification benefit and satisfies the other key BID criteria — return objectives, time horizon, tax/CGT position, liquidity, turnover suitability, ESG preferences, client familiarity. Spreadsheets cover the cost half. Nobody has the rest — and certainly not in a paragraph the BID file note can use.
Surity360 sits above your planning software, any CRM, any wrap platform, any digital fact find and your document store — and gives you four things those systems individually cannot:
It reads from each system, reconciles contradictions on a per-field basis, and writes back where the source-of-truth says it should. Ontology-first, not warehouse-first — a typed object model the AI was always meant to operate on, not a dashboard layered on the data you already have.
The adviser’s job hasn’t changed. What’s changed is which half of it the platform handles. The firms that win operate above the line — they know the client, the family, the goals, the anxieties. Surity360 automates below the line so your advisers have the bandwidth to get there.
Six capabilities — the answers Arkie surfaces when an adviser asks, and the work Discuss → Assemble → Prepare runs upstream of every advice conversation. One platform. No stack migration required.
Compliance health, portfolio state, life-plan context, fee status, recent activity — one screen, one source. An adviser typically pulls from five separate systems before a review: CRM for fact find and goals, platform portals for holdings, a separate tool for projections. The assembly takes 30–90 minutes per client and is where errors enter.
With Surity360, prep for a clean file takes under ten minutes. The life plan and fact find are current and in sync. The portfolio view is live. The meeting starts with the client, not the data. Tab-switching across seven systems goes away.
Three different problems, one system. AAAs and fee consents have deadlines — every expiring one surfaces before it becomes the silent enforcement event. BID does not have a deadline: it is the standard the advice must meet under §961B every time personal advice is given.
Surity360 Guardian closes the loop: a deterministic rules engine that evaluates all your licensee’s or your own audit scorecard questions per client, nightly, and emits a per-client compliance posture report with severity flags, evidence citations, and plain-English remediation hints. When the auditors walk in, the answers are already on the screen.
When the investment committee changes a fund — VGS to VGAD, STW to AAA — Surity360 identifies every affected client, generates personalised ROAs, captures BID consent, and tracks execution across HUB24 and North. A workflow that previously required an adviser to process each client individually becomes a supervised batch operation.
Fifty clients in days, not weeks — with every ROA personalised, every BID consent recorded, and every execution tracked.
Surity360 extracts an eight-dimension life-wellbeing map — money confidence, work and purpose, health, family, environment — directly from your existing MyProsperity fact finds. No second subscription, no double data entry.
The above-the-line life-plan conversation, on the data you already collect. The structured extraction feeds the Client 360 view and forms the evidential basis for goals-based advice under RG 175.
When a senior adviser leaves, the relationship knowledge stays. When ASIC asks, the evidence chain is one click away. Every field change, every source, every timestamp — across every system. Bronze, Silver, Gold data lineage.
Immutable. Exportable. ASIC-ready. The audit trail is not a retrospective exercise — it is built continuously as the advice operates.
At review time, “it’s gone up” is no longer enough. Most advisers see one of two things: client account performance after the fact, or Morningstar articles about the asset class — not your model. Surity360 sits in the middle, monitoring your model portfolios across 1D, 4W, 3M, YTD, FY, 1Y, and 3Y horizons, benchmarked against the indexes and peer funds you choose.
Drift, drawdown, and relative return surface on the adviser’s screen before the investment-committee call and the client review — review-time evidence the BID file note can rest on.
Same ontology-first data architecture as Palantir’s government and enterprise platforms.
Every platform promises to fix the fragmentation. Most add to it. Surity360 was designed from the compliance outcome backwards — the evidence chain an ASIC review requires, then the architecture to produce it continuously across every system you already run. That is what agent-native means: not AI layered on a data warehouse, but operations that execute against a live ontology. AI on clean, governed data beats AI on fragmented tables. Every time.
Every concept in Surity360 — a client, an SOA, a fee consent, a portfolio drift event, a BID obligation — is modelled as a typed object with its own state machine, sources, and obligations. Not a row in a CRM. Not a screen. A real-world object the system understands. Bronze, Silver, Gold lineage. Every field carries source, date verified, and conflict status. When a compliance auditor asks "was the risk profile current when you issued the SOA?", the answer is a query against versioned objects — not a forensic exercise across three systems.
Every client gets a synthesised brief refreshed nightly — summary, recent activity, open commitments, tensions, and sources. One page, not three systems. Read in two minutes before the meeting. This is not retrieval-augmented chat over scattered documents. It is a structured per-client file tree where every claim cites its source, enforced by a 98% citation-rate gate at write time. Conflicts are pre-resolved by a documented order. Stale facts are flagged before the adviser sees them.
Every field change — every value mutation, every source-of-truth shift, every override — is logged with old value, new value, source, and trigger. When ASIC asks what you knew, when, and how you knew it, the answer is a query, not a fortnight of file-rummaging. A 365-day rolling change log today. A 7-year statutory evidence chain on the roadmap. The architecture that makes both possible is already live.
XPlan, Plutosoft, AdviserLogic, Worksorted and Practifi are excellent at what they do. They are also built on traditional CRUD databases — rows, columns, tables. That architecture is right for storage and reporting. It is the wrong architecture for AI to reason over reliably, or for a defensible BID evidence chain to reconstruct what was true at a specific moment in the past.
Surity360 is built the way Palantir built its government and enterprise platforms. Every concept — a client, an SOA, a fee consent, a BID obligation, a portfolio drift event — is a typed object with sources, state and history, not a row in a table. The AI operates on objects with provenance, not strings with hopes. The audit trail can reconstruct any moment because the objects know their own past. An agent can take a defensible action because the object model knows what is allowed, by whom, and on what evidence.
Adding a data warehouse or BI layer does not solve this. A data warehouse can query your existing systems faster — it is a better search engine over a folder of linked spreadsheets where someone has been adding columns for years without a changelog. It inherits whatever each source says is currently true. It cannot resolve the conflicts between them. It cannot reconstruct what the fact find said on the day the advice was given. It cannot file the note, flag the expiry, or execute the compliance action. A data warehouse is a read layer built on broken inputs. Surity360 fixes the inputs.
That is what “Palantir-grade” means on an Australian advice file. Not the brand — the architecture.
Modelled to the regulated reality. The objects in the system are Fact Find, SOA, ROA, AAA, Fee Consent, BID Consent, Strategy Matrix — the things on the file. Not generic CRM rows. The language in the code is the language ASIC, AFCA and your licensee already use.
Every regulated fact lives in one place. “Risk profile”, “AAA period”, “in-scope advice”, “active client” each have one canonical definition, resolved from the Gold layer, never re-implemented per feature. The platforms and CRMs you already run are sources, not truths.
The model grows without breaking. A new attribute, a new relationship, a new object type — these extend the schema. The Ontology Manager refuses to deploy a breaking change against records that have not been migrated. The system evolves at the pace of regulation without rewriting itself every quarter.
Ingest is wide; consumers are narrow. Source systems deliver whatever they deliver — raw, verbatim, immutable. The Practice Brain, the Guardian rules engine and the Strategy Matrix read against a narrowed, validated, citation-gated structure. Swap a source system (a different CRM, a different wrap platform) and no downstream consumer breaks.
Software engineers will recognise these as Domain-Driven Design, DRY with the Rule of Three, Open/Closed, and Producer-Extends / Consumer-Super — the canon Palantir's government and enterprise platforms are built on. “Palantir-grade” is the discipline, not the brand.
CRMs model what happened. Surity360 proves it was right.
CRMs store data. Workflow tools track tasks. Both are static — the actual prep work happens outside them, in inboxes, scratch documents and offshore admin queues. Neither tells you whether the resulting advice is defensible either. Surity360 closes both gaps: it runs the prep upstream, and it proves the advice downstream.
Most principals worry about the risk of trying a new platform. The bigger, quieter risk is the cost of not trying anything.
Day 30 deliverable: a working Client 360 plus one of AAA expiry dashboard, HUB24 alignment, or SMA cost-vs-diversification justification at the $50 BID materiality bar — on your live data, with a written ROI estimate based on what we found.
Implementation is a refundable A$5,000 fee credited against your first month's Steward bill if you convert at Day 30. Forfeited if you walk away — covers the founder's setup time. Waived for the first 3 practices per quarter, until further notice. To qualify: complete a discovery call, complete an initial assessment, and submit an application that we approve.
The window to put this foundation in place — quietly, on your own terms, without a forced migration — is closing now, not in twelve months.
Surity360 is built by Australian advisers for Australian advice. Not adapted from a US RIA tool, not localised from a UK paraplanning platform — designed from day one against ASIC's BID standard, the FAAA's stewardship language, and the live Australian platform stack. It was specced, broken, and rebuilt inside a Tasmanian advice practice for two years before a single line of marketing copy was written. Every workflow on this page was carved out of a real Tuesday afternoon — not sketched on a whiteboard.
Per-adviser pricing anchored to true operational value: A$150–200K per adviser (1–2 onshore support staff). Standard pricing at A$900 / adviser captures ~5.4% of that value. Early adopters get 40% off, locked in for 3 years (with CPI adjustments).
All prices on this page are stated excluding GST.
Add-ons are flat per practice — the price does not scale with adviser count.
How we count advisers: relevant providers currently registered on ASIC's Financial Advisers Register. Provisional advisers in their Professional Year, paraplanners, client services, and support staff are not counted.
| Steward (5 × A$540) | A$2,700 |
| All four live add-ons (A$2,900 × 0.8) | A$2,320 |
| Infrastructure pass-through (typical) | ~A$1,000 |
| All-in monthly (early adopter) | ~A$6,020 |
| Standard monthly (A$900/adviser) | ~A$9,020 |
| Cumulative 3-year early-adopter savings | A$72K |
Infrastructure pass-through. Google Cloud and MongoDB Atlas costs are billed at our cost, no markup — typically around A$1,000 / month, depending on practice size and how much data changes each day. Itemised on the invoice. Each practice runs in its own dedicated Google Cloud project and MongoDB Atlas cluster — completely independent infrastructure; we are honest about what that costs.
No surprises. No usage meters, no overages on documents processed, no per-API-call surcharges, no automatic price rises mid-contract. Annual prepay earns one month free. Multi-year and licensee pricing is available on request.
Both are gated — one human reads each request before the link goes out, no tracking pixels, no third-party analytics, no cookies dropped.
The §961B safe-harbour test hasn't changed since 2012. The systems an Australian advice practice runs on have. ASIC's October 2025 Review of offshore outsourcing of financial services by advice licensees made the consequence explicit: the licensee carries the evidence chain, regardless of which CRM, platform or workflow tool holds the work. This paper diagnoses five recurring failure modes — unfindable evidence, stale fact find, unrecorded alternatives, implementation gap, expiry blind spot — against the live Australian advice stack: planning software (XPlan, Plutosoft, AdviserLogic, Midwinter), workflow CRMs (Worksorted, Practifi, Salesforce FSC), platforms (HUB24, North, Netwealth, BT Panorama, Macquarie, Praemium, CFS), client portals and document repositories.
Request the paperAdviser-tech platforms split cleanly into feed-first warehouses (which answer “what is the portfolio”) and ontology-first evidence graphs (which answer “does the file evidence that the §961B standard was met for the advice that was given”). This paper makes the engineering case for the second architecture from canonical software-engineering doctrine — Domain-Driven Design (Evans), DRY with the Rule of Three, Open / Closed (Martin), and Producer-Extends / Consumer-Super (Bloch) — which Palantir codified at DevCon5 in March 2026 as the four ontology design principles its government and enterprise platforms are built on. Each principle is mapped to live Surity360 code. Five concrete tests for a 30-day pilot.
Request the paperSubmissions go through a short form on surity360.com.au. We reply from pilot@surity.com.au within one working day.
Standard Steward pricing is A$900 / adviser / month (A$1,800 monthly practice minimum for 2 advisers). Early adopters get 40% off — A$540 / adviser / month, locked in for 3 years with CPI adjustments (A$1,080 minimum). Add-ons are flat per practice. Infrastructure (Google Cloud and MongoDB Atlas) passes through at our cost — typically around A$1,000 / month, depending on practice size and how much data changes each day. The pilot itself is free; implementation is a refundable A$5,000 fee credited against your first month if you convert (waived for early adopters). We count only relevant providers currently registered on ASIC's Financial Advisers Register — Professional Year provisional advisers, paraplanners, and support staff don't count toward your headcount. Full pricing →
The honest one: we are early-stage and we want lighthouse SMB customers. Each quarter, the first 3 practices to qualify get the implementation fee waived and a 36-month 40% discount lock (early-adopter pricing held at 40% off whatever standard pricing is that year, with CPI adjustments). To qualify: a discovery call, an initial assessment, and an approved application. The cohort runs until further notice.
Surity360 makes you a more attractive acquisition, not a less. Capital-backed consolidators pay a higher multiple for practices with clean data, structured evidence, and a unified client record, because they do not have to fix it post-deal. That is exactly what Surity360 produces. Whether you sell to a consolidator, run an internal succession, or pass the practice to family, you walk into the conversation with the operational discipline that sets the price.
We do not currently write back to XPlan. XPlan reconciliation is read-only and currently depends on the practice running MyProsperity alongside XPlan — we read fact find data and key client records from MyProsperity, then reconcile against Worksorted and HUB24. XPlan stays the SOA production engine. Worksorted has native API integration — bi-directional once you opt in, read-only by default during the pilot.
Yes — any CRM with a documented API can be connected. Worksorted is what we run out of the box; SuiteCRM and a small number of others have working connectors today. Beyond that, integrating a new CRM is bespoke implementation work, scoped at the discovery call. The same applies to investment platforms outside the standard set: Netwealth, CFS, MLC, BT Panorama, Praemium and others can all be wired in — but as a custom build, not as a checkbox at sign-up.
HUB24 — full integration out of the box including SFTP daily reports, alignment dashboard, and Playwright automation for portal-only workflows. North — full integration: Playwright automation plus client list ingest. Netwealth, BT Panorama, CFS, MLC, and Praemium — read-only daily report ingest is straightforward; deeper integration is custom implementation work on top of the standard pilot. Listed on the 2026 roadmap as productised connectors but available now via custom build.
Compliance lawyers now treat $50/year as the materiality bar for product cost comparisons. Every SMA in every review has to demonstrate that the fee differential over a cheaper alternative (a direct ETF, a model portfolio) is offset by quantifiable diversification benefit and satisfies the other key BID criteria — client return objectives, time horizon, tax/CGT position, liquidity, turnover suitability, ESG preferences, client familiarity. Surity360's data layer holds your live HUB24 and North holdings today, and the ADW (Advice Development Worksheet) module captures all the BID criteria as structured fields. The cost-vs-diversification view that computes concentration, correlation, and factor exposure for each SMA against a chosen alternative — and emits a BID-ready file-note paragraph that ties the cost gap to every key criterion — is a candidate Phase 1 pilot deliverable. Live data ingest and structured BID capture now; the standardised cost-justification engine is on the 2026 roadmap.
The SMA sector has grown roughly 24% per year since 2019, and the regulator has noticed. ASIC has broadened its managed discretionary account review to cover SMAs, and at the December 2025 Professional Planner Researcher Forum, Count's head of investments said he had recently been asked by the regulator how an adviser can make a sound best-interest review decision on an SMA without standardised performance and look-through data — and acknowledged the question was not easy to answer. Surity360 closes the data half today: each model portfolio is monitored across 1D, 4W, 3M, YTD, FY, 1Y, and 3Y horizons, benchmarked against the indexes and peer funds you choose, with drift, drawdown, and relative return on the adviser's screen before the review meeting. Combined with the ADW module's structured BID criteria capture, the file note can show — on live data — that the SMA still aligns with the client's risk profile, return objectives, and the alternatives available. Live today; a productised review pack export is on the 2026 roadmap.
Your practice runs in its own dedicated Google Cloud project (australia-southeast1, Sydney) and its own dedicated MongoDB Atlas cluster (Sydney) — provisioned exclusively for you, never pooled in a shared vendor datalake. No data is co-located with another practice at any layer. No data leaves Australia. All connections encrypted in transit and at rest. You can see it, query it, export it, and take it: you own the asset outright — freehold, not leasehold.
Surity360 runs on the same infrastructure global banks rely on. Compute sits in Google Cloud (australia-southeast1, Sydney); structured data in MongoDB Atlas (Sydney) — both independently certified to ISO 27001 and SOC 2 Type II, both encrypted in transit and at rest. Cloudflare Access guards the perimeter with mandatory two-factor authentication and email verification on every login. Application access is then gated by bcrypt-hashed passwords and role-based permissions. Secrets live in Google Cloud Secret Manager, never in code or environment files. Each practice runs in its own dedicated Google Cloud project and its own dedicated MongoDB Atlas cluster — completely independent infrastructure, not a logical partition of shared hardware. No shared databases, no cross-practice access possible. The cluster is yours: you can query it, export it, and take it — you own it freehold, not leasehold. The isolation that once required institutional capex now runs for a single practice on a subscription, billed to you at cost. Surity360 is built for Australian advice practices and adheres to the Australian Privacy Act and the Australian Privacy Principles (APPs). All data resides in Australia; no client data ever leaves Australia. Offshore admin staff (for example Manila-based paraplanning) access the platform through the same Cloudflare 2FA, role-based permissions, and per-action audit log as onshore users — every read and write attributable to a named identity, aligned with ASIC's October 2025 expectations on offshore outsourcing. A Data Processing Agreement (DPA) forms part of the standard contract, setting out controller / processor obligations, breach notification commitments, and the security measures we maintain against unauthorised access.
We provide a licensee briefing pack covering data handling, hosting, security, audit, and ASIC alignment. To date, every licensee that has reviewed the pack has approved a pilot. If you are self-licensed, even simpler — you make the call.
The pilot is scoped to one screen, one workflow. If your team does not use it after 30 days, that is the answer — and you have lost nothing. Source data stays in your existing systems. Worst case, you stop syncing to Surity360 and you are exactly where you started. It cannot break anything — read-only by default.
Practice Brain — an adviser-ready synthesis layer that produces structured summaries per client before every review meeting. Expanded platform connectors for Netwealth, BT Panorama, and Praemium. Tighter Lumiant integration. Salesforce and Dynamics connectors. Productised agent workflows for ROA filing, rebalance execution, and BID consent capture — all included in the Steward subscription.
You are being offered four hours of your time, a free 30-day pilot, and a written ROI estimate on your own data. If it does not earn its keep, you walk away. Your stack is unchanged.