Security you can trust from day one

Developed and operated under Mobiddiction’s Information Security Management System, certified to ISO/IEC 27001:2022 by an independent, accredited auditor.

The certificate’s scope covers “the design, development, hosting and support of Mobiconnect powered digital applications and platforms operated by Mobiddiction”. M4 sits within that certified scope.

Certification demonstrates that we identify and manage information security risks, maintain robust access, encryption and incident response controls, and undergo continual improvement through annual audits and management review. For NSW Government and Enterprise clients, it provides verifiable assurance that our systems meet mandated security and privacy obligations.

Since Mobiddiction was founded in 2012, we have delivered projects in health, finance, public safety and other regulated environments where trust is critical. Our teams include senior leaders and principal engineers with more than twenty years of experience in secure IT delivery, including over a decade inside high security government programs. That experience shaped our secure by design philosophy well before we began formal certification.

Secure by design means every project starts with one question: can the outcome be achieved without collecting personal or sensitive data? If not, what is the minimum data required, and how do we reduce exposure at every stage of the system life cycle? We treat data minimisation as a first principle, because an organisation cannot have a breach of information it never collects.

When sensitive or regulated data must be processed, we evaluate the risks, controls and obligations with the client and choose the least complex, safest way to achieve the goal.

Our ISO/IEC 27001 program formalised the controls, standards and operational processes we had already established over many years. Certification confirms that our Information Security Management System meets international best practice in risk management, policy governance, operational security, supplier management and continuous improvement.

The journey included documenting business-wide risk treatment plans, hardening our internal cloud infrastructure, defining asset management and incident response models, establishing staff training pathways and mapping our secure development practices to the Annex A controls. It also strengthened change management, audit logging, access governance and monitoring across M4, which runs NSW Government programs such as SharkSmart.

Our certification is backed by ongoing internal reviews, annual surveillance audits and regular external audits. Our Trust Centre at trust.mobiddiction.com.au is where procurement teams can access our controls, policies and governance documentation, and review the evidence behind our compliance program.

Mobiddiction has more than a decade of experience in the health sector, where privacy and secure data handling are paramount. Our work includes PatientVR and VapingVR for NSW Health, early stage Apple Watch health projects in collaboration with Mayo Clinic, and health and wellness programs with partners such as SP Health. We also support confidential patient, nurse and medical education programs with pharmaceutical and health organisations, and children’s wellbeing initiatives with the Starlight Foundation, giving us a mature understanding of Federal and State health privacy requirements in NSW and Queensland.

Our financial sector work added compliance exposure around identity, secure onboarding, transaction visibility, staff confidentiality and auditability. It strengthened our ability to design systems that satisfy high assurance identity controls, formal risk registers and strict operational segregation standards.

Our systems are designed with privacy in mind, encompassing the Australian Privacy Act and the Australian Privacy Principles, and our privacy tools are made for the obligations our clients operate under, including self-service deletion and data export for people who use their apps.