Core components
- Member front-end (web PWA, iOS, Android)
- Deterministic advice engine (licensed core)
- SOA generation service
- Ask Otivo (AI assistant)
- Admin and Insights portals
What Otivo is
Otivo is a containerised, fully managed SaaS platform delivering AFSL-licensed financial advice. Built on PHP Laravel and Vue.js, running exclusively on AWS Sydney (ap-southeast-2). A defining characteristic: Otivo is non-transactional. No party can move or remove money inside the system, materially limiting breach risk. The platform separates cleanly into member-facing front-end and licensed advice back-end—either layer can be integrated independently.
Containerised, cloud native
Architecture
Built on Laravel and Vue.js
Data layer
- RDS Aurora MySQL 8 (Multi-AZ, relational data)
- ElastiCache Redis (sessions/cache)
- DynamoDB (historical logging)
- S3 with Object Lock (immutable advice records)
Platform services
- API Gateway (REST APIs, OAuth 2.0-secured)
- Auth0 (authentication, SOC 2 Type II, AU-hosted)
- Cloudflare (DNS, CDN, WAF, DDoS)
- ECS Fargate (Linux containers, auto-scaling)
Infrastructure managed entirely via Terraform (Infrastructure-as-Code). No client OS, database, or middleware management required. Client-side: current-version-or-one-prior modern browser on desktop, tablet, or mobile. No plug-ins or installs.
Open API 3.0, 131 endpoints
Integration
REST, SSO, batch—your choice
ISO 27001 certified
Security and compliance
APRA-aligned, KPMG-audited
Framework
ISO/IEC 27001:2022 certified; NIST CSF, APRA CPS 234/230 aligned; Privacy Act & Australian Privacy Principles compliant; KPMG-audited annually.
Controls
RBAC, least-privilege; MFA on privileged access; Cloudflare WAF/DDoS; SAST/SCA; annual CREST penetration testing.
Data protection
AES-256 at rest (AWS KMS), TLS 1.2+ in transit. Client-specific keys; multi-tenant isolation.
Residency
All data exclusively in Australian AWS (Sydney). No offshore processing. Auth0 handles authentication only.
Breach response
Investigation within 24h; ASIC/OAIC notification per protocol.
Always-on reliability
Infrastructure, availability and scale
Fast recovery, minimal data loss
Complete audit trail
Observability and audit
7 years immutable logs
Observability
CloudWatch, Sentry, APM, SIEM, UptimeRobot. Health checks every 30s; automated alerting.
Audit
Structured-JSON logs cover advice transactions, auth events, config changes, data access, API calls, system events. Retained 7 years minimum in immutable S3 Object Lock. Cryptographic hashing enables tamper detection.
Events capture
UTC timestamp, actor identity, source IP/user-agent, action type, target object, before/after state, result code, cryptographic hash.
SIEM
Logs forwarded via CloudWatch subscription, syslog, or API pull. Categories: authentication, authorisation failures, config changes, anomalies, API security.
ASIC RG 175 compliant
Data housekeeping and retention
Retention governed by the Information Management Policy, aligned to ASIC RG 175 (min 7 years for advice records).
DataRetention
Advice records & SOAs7 years (immutable S3 Object Lock)
Audit/access logs7 years
CloudWatch operational logs≥90 days
RDS daily backups30 days
RDS monthly/annual12 months / 7 years
Member account dataLife of relationship + regulatory retention
Backup integrity verified by automated restoration testing. End-of-life deletion by cryptographic erasure with written confirmation.
Compliance that scales with you
Delivery and operations
Four-phase delivery, no code required
— 1 of 4
Implementation
Four-phase Agile delivery: Discovery (workshops, architecture, advice scope, brand, compliance); Build & Configure (platform config, integration dev, staff portal); Test & Validate (SIT, UAT, security, compliance); Go-Live & Hypercare (phased rollout). Two-week sprints with continuous deployment. Journeys, advice rules, and branding are configuration-led—no client code required.
— 2 of 4
Releases
Fortnightly minor releases, quarterly major releases via blue/green deployment. Security patches and critical fixes apply to all clients (≥5 business days' notice). Changes undergo CTO review, Compliance validation, and 100% pass on accuracy, disclosure, classification, and data-protection checks.
— 3 of 4
Issue prioritisation (SLAs)
P1 Critical: 15 min response, 4 hour resolution target
P2 High: 30 min response, 8 hour resolution
P3 Medium: 2 hour response, 2 business day resolution
— 4 of 4
Environments
Five separated environments (dev, test, UAT, staging, production) isolated at network and access-control layers. Clients have authorised access to dedicated staging and UAT throughout engagement.
Onwards
Ongoing support
Platform administration handled by Otivo. Client-side effort is minimal: configuration, content review, MI consumption. Training and up to two refresher sessions per year included.
Enterprise ready
Proven across super and insurance
DeploymentAWS Sydney only; fully managed SaaS; Terraform IaC
StackPHP Laravel + Vue.js; ECS Fargate; Aurora MySQL; Auth0; Cloudflare
Data residency100% Australian; no offshore processing
ComplianceISO 27001:2022 certified; APRA CPS 234/230 aligned; AFSL-licensed; KPMG-audited
Risk profileNon-transactional—no money movement, limited blast radius
IntegrationOpenAPI 3.0, 131 endpoints; REST/SSO/batch; front-end/back-end separable
Availability99% SLA, ~99.9% historical; Multi-AZ HA; RTO 6h / RPO 15m
Proof pointsMultiple production deployments across superannuation and insurance