Compliance & evidence
A record you can stand behind, not a folder you have to defend.
Knowing something today is a different problem from proving it later. SubSure is built for both, and treats the second one as the harder of the two.
The baseline
What a new organisation starts with
Every organisation begins with three required document types. These are SubSure's default configuration — a sensible starting point for Australian residential and commercial builders, not a statement of what the law requires of every business.
Public Liability
With a minimum cover amount your organisation sets, and can raise for a higher-risk trade without changing it for everyone.
Workers Compensation
Required by default, with a documented exception for a genuine sole trader — see below.
Trade Licence
Checked for presence and currency, with the licence class recorded as it appears on the document.
Anything else you require
Professional indemnity, white card, a qualification, or another document type from the platform catalogue.
What each of these means for your business, and whether they are sufficient, is a decision for you and your own advisers. SubSure applies the requirements you configure; it does not advise on what they should be.
The sole-trader exception
A declaration is evidence in its own right, with an expiry date like anything else.
A subcontractor who works alone and employs nobody can say so, by typing their name against a plain-English statement. That declaration is stored as the evidence for why workers compensation was not required — the exact words they agreed to, who agreed, and when — and it appears in an evidence export alongside real certificates rather than as a note about a missing one. It lasts twelve months and then lapses, at which point they are reassessed as though it had never been made. If they later supply an actual certificate, it takes precedence automatically.
Evidence
Preserved, not overwritten
A record that only shows the current state answers half the question. SubSure keeps the parts that let you answer the other half.
Versions are retained
When a renewal replaces a certificate, the previous version is kept in full — the file and the values read from it — rather than being overwritten.
Decisions are recorded
Every compliance evaluation is written to an append-only log with its reasons, so a status is traceable rather than merely current.
Rules are versioned with the decision
A decision records the requirement configuration in force when it was made. Raising a minimum today does not rewrite what was true last March.
Actions are logged
Uploads, confirmations, corrections, rejections and configuration changes are recorded with who did them and when.
Corrections are kept
Where a person corrected a value that was read from a document, both the original reading and the correction are retained.
Deletion is deliberate
The one point a file is genuinely deleted is when a subcontractor discards an upload before confirming it — because at that point it never became evidence.
Security
How the records are protected
Described in terms of what the system does. SubSure holds no security certification or regulatory accreditation, and nothing here should be read as claiming one.
Separated by organisation
Access rules are enforced in the database itself, not only in the application. A query for another organisation's records returns nothing rather than an error revealing they exist.
Uploads are scoped and short-lived
A subcontractor never receives a general-purpose upload credential. The server issues a single-use signed URL scoped to their own storage path after re-checking their session.
Files are validated and scanned
Uploads are checked against their actual contents rather than their file extension, scanned for malware before anything is read, and PDFs are rebuilt in a format that cannot carry active content.
Links are single-purpose
An upload link belongs to one subcontractor, expires, is verified against something only they know, and locks out after repeated failed attempts.
Roles are enforced server-side
Permission checks run on the server and in the database. Hiding a control in the interface is never what is protecting an action.
Data stays in Australia
The database and document storage are hosted in the Sydney region. Documents are read by an AI service that may process them overseas, which is disclosed to the subcontractor at the point they supply one.
Ask the hard question first.
If you want to know what an evidence export actually contains, or how a past date is reconstructed, get in touch and we will show you.