Trust & Security
Funds held with regulated Australian account infrastructure. Double-entry hash-chained ledger.
BuildFair doesn't hold your money.
When you pay funds into a BuildFair-managed project, those funds sit with our banking partner Kobble, which operates under AFSL 545391 (Yondr Money Pty Ltd). We hold the audit trail, the verification, and the release authority. They hold the cash. That separation is the central design choice of how BuildFair works. It means BuildFair can't run off with your money, can't lose your money in a corporate failure, and can't move your money to anyone other than the parties authorised under the project rules you and your builder agreed to.
This page sets out how the architecture works, who the regulated parties are, what controls are in place, and what happens if something goes wrong.
Where your money sits
The funds you pay into a BuildFair project go into a regulated account with our banking partner Kobble, which operates under AFSL 545391 (Yondr Money Pty Ltd). Kobble is the regulated counterparty for the funds in your project. BuildFair is the layer above that determines when funds release and to whom, based on the project rules.
In practical terms: when you pay a deposit or a progress payment into your project, that money sits in a regulated Australian account with Kobble (operating under AFSL 545391, Yondr Money Pty Ltd). It isn't in the builder's general operating account. It isn't in BuildFair's operating account. It's held externally until the conditions for its release have been met.
What stops BuildFair from misusing your money
Three controls, layered.
The first is architectural. BuildFair doesn't have direct access to project funds. Kobble does. Our role is to authorise releases when the project rules say a release is due, for example when a progress milestone has been met, a subcontractor invoice has been approved, the project has completed, or the funds need to be returned to you. We can't authorise a release that isn't covered by the project rules.
The second is the ledger. Every transaction on the platform is recorded in a double-entry ledger, the same accounting model banks use. Every dollar in has a corresponding dollar out, and the books have to balance to the cent at all times. The ledger is the source of truth. If a release was authorised, it's recorded. If a release happened that wasn't authorised, the books wouldn't balance, and the system would flag it.
The third is tamper-evidence. The ledger is protected by a hash chain. Every entry includes a cryptographic fingerprint of the entries that came before it. If anyone tried to alter a past entry to cover their tracks, every subsequent entry's fingerprint would no longer match, and the alteration would be visible. The technology is the same as the one that secures cryptocurrency networks. We use it because it makes the audit trail tamper-evident in a way that traditional databases aren't.
What happens if BuildFair goes out of business
It's a fair question to ask of any payments company, and the answer is that your money would still be safe.
BuildFair doesn't hold customer funds. Our banking partner Kobble does. If BuildFair as a company failed tomorrow, the funds in your project account would still be held in regulated custody, recoverable through the relevant regulatory framework. BuildFair's operational failure would mean you'd need to find another way to manage the release of those funds, potentially through Kobble directly or through a court-supervised process, but the funds themselves would not be at risk.
This is the central reason BuildFair is built the way it is. We don't hold the cash. We hold the rules and the records. Kobble holds the money.
How we verify everyone on the platform
When a builder, subcontractor, owner, or supplier joins BuildFair, they go through Know Your Customer and Know Your Business verification. We use Sumsub, an established global identity verification provider, to confirm identities, business registrations, and beneficial ownership. This isn't optional. It's how we make sure the people on each side of a project transaction are who they say they are, and that the businesses receiving funds are real, registered, and accountable.
KYC on BuildFair isn't a regulatory requirement we're forced to meet under our current architecture. We do it anyway because verifying everyone on the platform is part of making the platform trustworthy. It also makes the audit trail meaningful: every transaction is between identified, verified parties.
Who oversees BuildFair
BuildFair is an Australian company, BuildFair Pty Ltd, ACN 682 829 045. We're based in Australia, we serve Australian residential construction, and we operate under Australian law.
The regulated payments infrastructure under BuildFair is provided by our banking partner Kobble, which operates under AFSL 545391 (Yondr Money Pty Ltd). We are not currently required to hold our own AFSL because we don't hold customer funds. We are not currently required to be an AUSTRAC reporting entity because the architecture doesn't make us a designated service provider under the relevant legislation. Both positions have been confirmed and are documented.
What we're working on
Compliance and security work for a fintech is continuous, and we're always adding to our baseline. The platform is built around a double-entry, hash-chained, tamper-evident ledger and external identity verification through Sumsub, with project funds held by our regulated banking partner Kobble rather than in BuildFair's own accounts. As our compliance program matures, the detail will be published on this page.
FAQ
Frequently asked questions
Is my money safe if BuildFair gets hacked?
The funds aren't held by BuildFair, so a breach of BuildFair's systems doesn't give an attacker direct access to project funds. Kobble operates its own security infrastructure. What an attacker could in principle target on BuildFair's side is the release authorisation logic, which is why we run the double-entry ledger and hash chain audit trail as additional protections. We also follow standard security practices for the platform itself: encrypted data at rest and in transit, multi-factor authentication for all account holders, and regular penetration testing.
Can BuildFair freeze my money?
We can hold a release temporarily if there's a flagged dispute or a verified compliance concern, but we can't move your money to anyone other than the parties authorised under the project rules. Hold actions are recorded in the ledger and visible to the parties involved. The default state of any project is that funds release according to the agreed rules, not at our discretion.
Who do I contact if something goes wrong?
Our support team is the first point of contact. For regulated complaints, issues that fall under AFSL or consumer protection law, Kobble operates the complaints process for the funds-holding side, and the Australian Financial Complaints Authority (AFCA) is the external dispute resolution body. Contact details are on our contact page.
Is BuildFair regulated by APRA?
No. APRA regulates banks, insurers, and superannuation funds. BuildFair isn't any of those. Our banking partner Kobble operates under AFSL 545391 (Yondr Money Pty Ltd), regulated under the AFSL framework administered by ASIC.
What data do you collect, and where is it stored?
The data we need to verify identities, run the platform, and meet our legal obligations. It's stored on Australian-based AWS infrastructure. The specifics are in our privacy policy. Australian data is covered by the Australian Privacy Act 1988 and the Notifiable Data Breach scheme.
Does BuildFair have access to my bank account?
We don't read or pull from your bank account. You initiate payments into your BuildFair project from your bank, the same way you'd pay any other invoice. We don't store your bank login credentials. We don't have direct debit authority over your account.
What if I want to leave BuildFair mid-project?
The funds in your project account belong to you (or to the parties authorised under the project rules) and aren't held hostage by your continued use of the platform. If you choose to leave a project, the funds get returned to whichever party the rules specify, with the audit trail intact for any future dispute or legal process.