Trust & Transparency

Security

The controls R3 actually has in place — and the limits it will not overstate.

Version and effective date: 17 August 2026

1. Posture

R3 holds financial and ownership information about valuable animals, so security is treated as a core part of the product rather than an afterthought.

R3 does not hold ISO, SOC or government security certification, and does not claim to. What follows describes controls that are actually implemented.

Rishav Aryal (ABN 34 930 918 759) is the sole-trader service provider. R3 Racing Analytics is the service/brand name used on this site.

2. Access control

Client access is scoped to a single client portfolio and enforced by database-level row-level security, not merely by the user interface.
Administrator accounts require multi-factor authentication.
Sensitive administrative areas require a stepped-up (multi-factor verified) session, not just a signed-in session.
Administrator roles are separated, including a read-only auditor role with write controls removed rather than hidden.
Suspending an administrator revokes existing sessions and tokens rather than waiting for them to expire.

3. Data handling

Client documents and published reports are held in private storage buckets and served through authenticated access paths.

Traffic to the platform is served over encrypted connections; managed database and storage services provide encryption at rest as part of the underlying platform.

Sensitive server-side operations run through controlled database routines rather than broad table write access.

4. Audit and accountability

Administrator actions — including status changes, suspensions and reactivations — are recorded with an audit trail.

Correction of records keeps history rather than silently overwriting it, so a figure can always be traced back to how it got there.

5. Dependence on providers

R3 runs on managed infrastructure. Those providers are named on the Technology Providers & AI Disclosure page.

R3 relies on their platform-level security controls and cannot independently guarantee their internal practices. R3's own controls are designed to limit what is exposed to them.

6. Retention

Retention, purge behaviour for Quick Add drafts, backup ageing and deletion requests are described on the Data Retention & Deletion page.

7. Honest limits

R3 is a solo-operated service. There is no 24/7 security operations centre, and no online service can be guaranteed absolutely secure.

R3 prioritises suspected unauthorised access and account lockouts ahead of ordinary support, and will communicate directly with affected clients during a material incident.

Nothing on this page limits or excludes rights you have under the Australian Consumer Law or other laws that cannot lawfully be excluded. Where any wording here conflicts with those rights, those rights prevail.

8. Reporting a security issue

Report suspected vulnerabilities or unauthorised access to rishavaryal16@gmail.com. Please include enough detail to reproduce the issue and avoid accessing other clients' data while investigating.

Good-faith reports are welcome and will be acknowledged.