Join the OneAddress
Partner Network

Zero-knowledge encryption

Encrypted client-side with AES-256-GCM before leaving the customer's browser, under a content key wrapped to the public key you registered. We never see plaintext addresses.

HMAC webhook signatures

Every payload is signed with HMAC-SHA256 using your webhook secret. Verify authenticity before processing.

Per-recipient key exchange

Per-recipient encryption under the public key you register, so only your private key can decrypt payloads sent to your organisation. Elliptic-curve, RSA and hybrid post-quantum keys are all supported, and which scheme is used follows the key you enrol. The portal documents each once you have signed up.

Full audit trail

Every transmission logged with timestamps, dispatch IDs, and confirmation status for compliance.

Australian data residency

Encrypted address payloads, transmission records, and identity verification records are stored in AWS ap-southeast-2 (Sydney). Identity verification itself is performed by Global Data Pty Ltd, an accredited Australian identity service provider, inside their hosted flow: the document photograph and liveness selfie are never received or stored by OneAddress, so what is held here is the verification outcome, its reference, and the verified name and date of birth. One named exception, because you may need it for your own cross-border assessment: the liveness step of that check, the short selfie video, runs on Global Data servers in the United States and is not retained there, while the rest of the check including the document photograph is processed in Australia. Authentication is handled by our first-party system hosted entirely within Australia (AWS Sydney). Address lookup is answered from our own copy of the Australian Government’s public address dataset, held in Australia, so no third party receives address text. Encrypted address payloads and the identity records we hold stay in Australia; some auxiliary services (payments, email, error monitoring, and social sign-in) are provided by overseas processors; see the customer Privacy Policy for the full subprocessor list.