Security
How your records are kept, and what we have not done yet.
Wellrun holds whose name your accounts are in, your licences and your people's roles, so it should tell you how that is protected. Each line below is something the product enforces today.
7 days free, no card. Fill in three sections and you get 7 more. If you choose a plan, from $39 plus GST a month, renewing until you cancel.
What Wellrun does
Held in Australia
Every record and every uploaded file is held in Sydney.
No passwords to steal
You sign in with a link Wellrun emails you. A password cannot open a Wellrun account, and there is nowhere in Wellrun to store the passwords for your own systems.
A second step, if you want it
Owners and administrators can add a six-digit code from an authenticator app to the email link. We strongly recommend it.
Sessions end
A signed-in session ends after fourteen days, or after seventy-two hours unused.
Each seat sees only its sections
Your team and your accountant open only the groups of sections you give them, and the database checks that on every read, not just the screen.
Staff records stay inside
People is never available to an outside adviser or anyone a pack is shared with, whatever is turned on.
Every document open is written down
There is no way for a browser to fetch a stored file directly. Each open goes through one route that records who opened what, and when, before the file is handed over.
The activity record cannot be rewritten
Nothing in the product can edit or delete the record of who changed what, and the database refuses any change to it.
Card details never reach us
Payments are taken by Stripe. Wellrun never sees or stores a card number.
No AI
Nothing you type or upload is sent to an AI model.
Locked-down pages
Every page is served with a strict content security policy, HTTPS only (HSTS), and refuses to be shown inside another site's frame.
What has not been done yet
Nobody outside Wellrun has tested it yet. There has been no independent penetration test and Wellrun holds no security certification. When an independent review is done, a summary of what it found and what was fixed goes here.
The privacy policy lists every outside service that touches your information and where it is. Wellrun is new and taking its first customers.
Found a problem?
Write to hello@wellrun.com.au. We read every report and reply within two business days. Please do not test against other customers' accounts or data. The same details are in security.txt.
See it for yourself, free for a week.
7 days free, no card. Fill in three sections and you get 7 more. If you choose a plan, from $39 plus GST a month, renewing until you cancel.