Investors

Data security and privacy

WiseTech places data and cyber security at the forefront of its development process. We have adopted a structured, proactive approach to managing information security risks, using a strong internal set of controls related to data protection. Our layered approach to protecting customer data includes employee training, physical security, system security, policies, logging and auditing.

WiseTech Global and its subsidiaries recognize the importance of data privacy and comply with relevant data privacy regulations, including the EU General Data Protection Regulation (GDPR), to safeguard the security and privacy of all customer data.

Data security

WiseTech’s Information Security Management System (ISMS) is designed to ensure the confidentiality, integrity, and availability of WiseTech information assets and the confidential customer information retained in WiseTech information systems.

The ISMS provides the framework for managing the information security risks associated with the management and operation of WiseTech’s information assets.

It complies with the requirements of ISO/IEC 27001:2013 for the following scope:

WiseTech’s ISMS is certified under ISO/IEC 27001:2013 for the delivery of services to support WiseTech Global’s business applications and the provision of WiseCloud services in accordance with the Statement of applicability version 1.0 dated August 15, 2021.

Our Information Security Policy provides direction for managing security risks associated with information, source code, cloud services and systems. Compliance with this Policy and all supporting material is mandatory for WiseTech Global employees, contractors and third parties who, during their work to support WiseTech, have access to WiseTech Global products, services, systems, corporate information, or customer information.

Our Information Security Committee is in place to ensure continued management focus on the ISMS and information security incidents, and our Global Manager – Information Security is responsible for directing and implementing the ISMS.

We have adopted a layered approach to protecting customer data that includes physical security, system security, policy, governance, logging, and auditing.

We have completed an independent Service Organisation Control audit of our key WiseCloud systems and perform penetration testing on our key business systems (including our acquired businesses) and remediate any potential issues identified by the testing.

We have previously completed SSAE16/ Security Operations Centre (SOC) 1, 2 and 3 Audits with global firm KPMG and obtained certification.

Information security risk management is embedded into all of our critical processes, and information security risks are identified and managed in a consistent, proactive way. Adopting a risk‑based approach, utilizing industry frameworks and best practices, allows us to build our strategy with appropriate governance at a Board and Senior Management level. Systematic processes are used to learn from successes and failures, driving continuous improvement.

Covering people, processes, and technology, our security initiatives are mapped to the five pillars of the NIST framework. Our IS Team members are also required to complete detailed training on our ISMS.

All WiseTech team members are required to complete Privacy and Data Protection, and Cyber Security training.

We regard our people as our first line of defence and have created security awareness training hosted on WiseTech Academy, which all staff are required to undertake annually. This training is tested by targeted phishing campaigns to monitor and track learning over time. Our people are also required to complete privacy and data protection training and more specific training in relation to the EU GDPR.

In relation to ransomware and other attacks currently facing businesses globally, we regularly review the news, underground websites, threat intelligence feeds and the dark web to understand the different threat actors which are currently operating and may be targeting the logistics industry. Our controls are built around specifically detecting or preventing ransomware.

Privacy

WiseTech Global and its subsidiaries recognize the importance of privacy and data protection and comply with relevant laws and regulations, including the EU GDPR, to safeguard the security and privacy of all customer data.

WiseTech is headquartered in Australia and must comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. WiseTech’s Privacy and Data Collection Notice sets out how we collect, manage, and disclose personal information.

However, as a global logistics software company that services 170 countries throughout the world, we also need to keep up to date with legal and regulatory developments globally.

We believe that complying with the toughest law provides a seamless way in which the business can continually update compliance and measures to protect and secure data. Therefore, we take the approach of complying with the most robust law globally which is currently the GDPR, a European Union regulation with extra-territorial reach.

By ensuring a uniform approach to privacy and data protection, the technical teams at WiseTech Global will not need to rewrite code again and again to respond to changes across geographies or implement certain security features for some locations but not others.

In addition to a close collaboration between our technical teams and legal in ensuring design, build, and procedures are compliant with our Australian and international legal and regulatory obligations, our external Data Protection Officer supports WiseTech to comply with the requirements of the GDPR.

In terms of data privacy, we have adopted the most stringent standards across our business. We have established a robust vulnerability management program with ongoing, automated scanning to uncover security vulnerabilities or misconfigurations across our infrastructure. We combine this with regular manual penetration testing; with in-house capabilities and trusted external third parties performing regular tests.

We have data processing terms with customers and data collection and privacy notice informing our customers and other stakeholders how we collect and process data. We also consider the ability of our potential suppliers to ensure privacy and data protection compliance prior to proceeding with any engagement. Our standard Data Processing Addendum with our customers is available here.