FREQUENTLY ASKED QUESTIONS

FAQ Popular Topics

General Questions & Procedures

That depends on:

(a) how complex your requirements are,

(b) whether it is a new or existing system,

(c) and what technology is used.

For new systems, we are normally able to give you a ballpark figure and then after some analysis an estimate. For changes to existing systems, we work on an hourly rate because there are normally too many unknowns.

Please contact us for more details.

Scope creep (where the size of the project changes after the estimate has been accepted) is one of the biggest challenges software developers face, and we are no exception.

There are many reasons for this, the main one is that perceptions change during the project. Only at the end of the project do we really understand what was required.

Before we start coding we will send you a “Scope of Works” document which we ask you to sign and return. In there we try to document what is within scope and what is not. That is a difficult process and may leave a number of “grey areas” and we allow a 20% contingency to cover those. If the effort is beyond that contingency then we will review the agreement with you.

During the normal business day (9 am to 5 pm AEST) there is almost always someone in the office to take your call.

For emails we normally respond within 2 hours and offer guaranteed response rates for clients on a support contract.

If we are hosting your database then we will put it on to one of our AWS servers located in Australia.

Click here to find out more about Amazon Web Services (AWS). We use them because they have amazing reliability, scalability and security. One of the few providers offering ISO 27001 which is required by a number of our medical and government clients.

Yes. We have a strict policy of never sharing your information with anyone outside of our organisation. We take care to make sure that all of our staff understand how confidential it is and all staff signs an NDA (a non-disclosure agreement) when they join DB Gurus.

For completely bespoke systems (e.g. existing systems or very custom systems) then you own the code exclusively.
That is the situation where we develop the software from the ground up, specifically for you. At the end of the
project, once all invoices are paid, we will give you a full copy of the source code upon request.

For systems built from our templates (e.g. new Access systems) you own the code on the condition that you do not
share that code with any other organisation.

For systems we built previously (e.g. TheDatabase) then we own the IP and the code and we license you to use it. If
you purchase a full license then we can supply the code for you to host on your own server or maintain yourself.
This will come with conditions about keeping the code within your organisation.

Most of the management and a lot of the design and analysis is done within Australia, so that you can explain your requirements to a “local”, in your time zone.

To keep our costs competitive a proportion of the programming and testing is done in the Philippines .

We prefer bank transfers (bank details are on our invoices) or alternatively you can pay via PayPal which accepts payments in AUD or USD. Please remember to include your invoice number on all payments so that we can allocate funds correctly. We do not accept American Express.

`

For new databases we normally give you a ballpark estimate for the whole project. Once we have done the analysis and design work we give you a completed specification with an estimate for the project. This allows you to see exactly what you will get and mitigate the risks of the project.

For fixes or changes to an existing database system, we work on an hourly basis and provide regular reports on progress made and issues encountered. The hourly rate depends on the level of commitment: the more hours you commit to, the lower the hourly rate.

Please contact us for more details.

For clients on a support contract the minimum is 30 minutes. For new clients our minimum is 4 hours.

We normally use a mix of agile and waterfall methodologies. We use them for prototyping and use cases, programming and testing.

If you want a data-driven website then we will happily provide a design to match your existing website or corporate colours. If you want a simple marketing website then we suggest you contact a dedicated website designer.

We guarantee our work for one month after user acceptance. If there are any problems with our work during this period we will fix it for free. We cannot guarantee 3rd party products but will assist you in getting those problems resolved.

We have completed work for clients in Australia, New Zealand and the UK. We have representatives in all these locations and we support them all.

Yes we do, up to A$5m for Professional Indemnity and A$20m Public and Products Liability.

Database Selection and Implementation

The choice depends on your specific business needs: 

Choose PostgreSQL if: 

  • You want to minimize upfront costs (PostgreSQL is free and open-source) 
  • You need flexibility and want to avoid vendor lock-in 
  • Your business handles complex analytics, JSON data, or geospatial information 
  • You’re comfortable with community-driven support 
  • You plan to run cross-platform (Linux, Windows, macOS) 

Choose SQL Server if: 

  • Your business already uses Microsoft ecosystem (Office 365, Azure, Active Directory) 
  • You need enterprise-grade support with formal SLAs 
  • You handle high-volume transactional workloads 
  • Regulatory compliance requires built-in security features 
  • You prefer turnkey solutions with integrated reporting (Power BI, SSRS) 

Database implementation costs for Australian SMBs typically include: 

Initial Setup (One-time costs): 

  • Hardware (on-premises server): A$5,000 – A$20,000 
  • Implementation services: A$150-A$250 per user per month in labour 
  • Software licensing (SQL Server Standard): From A$300 per core (perpetual) 

Ongoing Costs (Annual): 

  • Cloud DBaaS: A$55 per vCPU per month (e.g., Oracle OCI) 
  • Managed DBA services: A$150-A$250 per hour or A$2,000-A$5,000 per month 
  • Software maintenance: 20% of license cost annually 

Example Total Cost: For a 20-user SMB with on-premises SQL Server: 

  • Year 1: ~A$90,000 (including setup) 
  • Years 2+: ~A$55,000 annually 

Cloud-native approach: ~A$73,560 annually (more predictable OPEX model) 

Consider these factors 

On-premises is better if: 

  • You have strict data sovereignty requirements 
  • Predictable workloads with stable user counts 
  • Existing IT infrastructure and expertise 
  • Long-term cost optimization (3-5 year cycles) 

Cloud databases are better if: 

  • You need rapid scaling capabilities 
  • Limited IT resources for maintenance 
  • Want to shift from CAPEX to OPEX model 
  • Require built-in disaster recovery and high availability 

Hybrid approach works well for businesses with mixed requirements – keeping sensitive data on-premises while using cloud for development/testing environments. 

 

SQL Database Specific Questions

SQL Server offers several editions for different business needs: 

SQL Server Express (Free): 

  • Database size limit: 10GB 
  • RAM limit: 1GB 
  • CPU limit: 1 socket or 4 cores 
  • Best for: Small applications, development, learning 

SQL Server Standard: 

  • No database size limits 
  • RAM limit: 128GB 
  • Advanced features: Always On Basic Availability Groups, basic reporting 
  • Best for: Most SMB production environments 

SQL Server Enterprise: 

  • No limits on RAM or database size 
  • Advanced features: Always On Unlimited Availability Groups, advanced analytics 
  • Best for: Large enterprises with complex requirements 

Recommendation for Australian SMBs: Start with Standard edition unless you specifically need Enterprise features like advanced analytics or unlimited availability groups. 

 

Key performance optimization strategies: 

Database Design: 

  • Proper indexing on frequently queried columns 
  • Normalize database structure appropriately 
  • Use appropriate data types to minimize storage 

Server Configuration: 

  • Allocate sufficient RAM (minimum 8GB for production) 
  • Use SSD storage for database files 
  • Configure tempdb properly (multiple files, separate drive) 

Query Optimization: 

  • Regularly update statistics 
  • Monitor and optimize slow queries 
  • Use SQL Server’s built-in performance monitoring tools 

Maintenance: 

  • Regular index maintenance (rebuild/reorganize) 
  • Database consistency checks (DBCC CHECKDB) 
  • Keep SQL Server updated with latest patches 

 

Cloud Database

Cloud databases offer several advantages: 

 

Cost Benefits: 

  • No upfront hardware investment 
  • Predictable monthly costs 
  • Pay-as-you-scale pricing models 

Operational Benefits: 

  • Automatic backups and updates 
  • Built-in high availability and disaster recovery 
  • 24/7 monitoring and support from cloud providers 

Scalability: 

  • Easily scale up/down based on demand 
  • Handle traffic spikes without infrastructure changes 
  • Global reach with multiple data centers 

Security: 

  • Enterprise-grade security controls 
  • Compliance certifications (ISO 27001, SOC 2) 
  • Regular security updates and patches 

 

Major cloud providers offer Australian regions: 

 

AWS (Sydney Region): 

  • Amazon RDS (SQL Server, PostgreSQL, MySQL) 
  • Amazon Aurora 
  • Amazon DynamoDB 

Microsoft Azure (Australia East/Southeast): 

  • Azure SQL Database 
  • Azure Database for PostgreSQL 
  • Azure Cosmos DB 

Google Cloud (Sydney): 

  • Cloud SQL 
  • Cloud Spanner 
  • Firestore 

Oracle Cloud (Melbourne/Sydney): 

  • Oracle Autonomous Database 
  • Oracle Database Cloud Service 

All these services allow you to keep data within Australian borders for sovereignty compliance. 

Australian Compliance and Data Sovereignty

Under the Privacy Act 1988 and Australian Privacy Principles (APPs), you must: 

 

APP 11 – Security Requirements: 

  • Take “reasonable steps” to protect personal information from misuse, interference, loss, and unauthorized access 
  • Implement security measures appropriate to your business size and data sensitivity 
  • Regularly review and update security controls 

Notifiable Data Breaches (NDB) Scheme: 

  • Notify affected individuals and OAIC of breaches likely to cause serious harm 
  • Notification must occur “as soon as practicable” after becoming aware 
  • Maintain incident response procedures and breach response plans 

Recommended Security Measures: 

  • Encrypt data at rest and in transit (AES-256 or better) 
  • Implement multi-factor authentication 
  • Use role-based access controls 
  • Regular security audits and penetration testing 
  • Employee training on data handling procedures 

 

Yes, but with important considerations: 

APP 8 – Cross-border Disclosure: 

  • You must take “reasonable steps” to ensure overseas recipients handle data consistently with APPs 
  • Include contractual clauses requiring compliance with Australian privacy standards 
  • Conduct due diligence on cloud providers’ security and privacy practices 

Sector-Specific Requirements: 

  • Health data (My Health Records Act): Must generally stay in Australia 
  • Financial services: May have additional APRA requirements 
  • Government contractors: May require data to remain onshore 

Best Practices: 

  • Choose cloud providers with Australian data centers 
  • Use encryption with keys under Australian control 
  • Include data location clauses in cloud contracts 
  • Regular compliance audits and monitoring 

Data sovereignty refers to the concept that data is subject to the laws and governance structures of the country where it’s stored. 

Why it matters for Australian businesses: 

  • Legal compliance: Ensures adherence to Australian privacy and data protection laws 
  • Regulatory requirements: Some industries require data to remain in Australia 
  • Government access: Foreign governments may have different data access laws (e.g., US CLOUD Act) 
  • Business continuity: Reduces risk of service disruption due to international disputes 

How to maintain data sovereignty: 

  • Use Australian-based cloud regions (AWS Sydney, Azure Australia East) 
  • Include data residency clauses in cloud contracts 
  • Implement encryption with Australian-controlled keys 

Regular audits to verify data location compliance 

Security and Access Control

Follow these essential security practices: 

Access Control: 

  • Implement principle of least privilege 
  • Use role-based access control (RBAC) 
  • Regular access reviews and user deprovisioning 
  • Strong password policies and multi-factor authentication 

Data Protection: 

  • Encrypt sensitive data at rest and in transit 
  • Use database-level encryption (TDE for SQL Server) 
  • Implement column-level encryption for highly sensitive data 
  • Regular security patches and updates 

Network Security: 

  • Place databases on separate network segments 
  • Use firewalls to restrict database access 
  • Implement VPN for remote access 
  • Monitor network traffic for anomalies 

Monitoring and Auditing: 

  • Enable database audit logging 
  • Monitor failed login attempts 
  • Track privileged user activities 
  • Centralize logs in a SIEM system 

 

Key requirements from Australian frameworks: 

 

Essential Eight (ASD/ACSC): 

  • Application control and patching 
  • Multi-factor authentication 
  • Daily backups with offline storage 
  • Principle of least privilege 

ISM Database Controls: 

  • Functional separation between database and web servers (ISM-1269) 
  • Network segmentation for database servers (ISM-1270-1272) 
  • Encrypted communications between servers (ISM-1277) 
  • Database event logging and monitoring (ISM-1537) 

SMB1001 Framework: 

  • Documented security policies and procedures 
  • Regular risk assessments 
  • Incident response plans 
  • Continuous monitoring and improvement 

 

Implement a structured approach to database access management: 

 

User Account Management: 

  • Create individual accounts for each user (no shared accounts) 
  • Use Active Directory integration where possible 
  • Implement account lifecycle management (creation, modification, deletion) 
  • Regular access reviews (quarterly recommended) 

Role-Based Access: 

  • Define roles based on job functions (e.g., read-only, data entry, admin) 
  • Grant minimum necessary permissions 
  • Use database schemas and views to limit data access 
  • Implement approval workflows for privilege escalation 

Authentication and Authorization: 

  • Enforce strong password policies 
  • Implement multi-factor authentication for administrative access 
  • Use Windows Authentication where possible (SQL Server) 
  • Log all authentication attempts and failures 

 

Performance, Scalability, and Cost Management

Cost-effective performance optimization strategies: 

 

Hardware Optimization: 

  • Invest in SSD storage for database files (biggest performance impact) 
  • Ensure adequate RAM (database should fit in memory if possible) 
  • Use RAID configurations for redundancy and performance 

Database Tuning: 

  • Regular index maintenance and optimization 
  • Query performance monitoring and optimization 
  • Database statistics updates 
  • Proper database file configuration (separate data, log, tempdb) 

Application Optimization: 

  • Optimize application queries and connection pooling 
  • Implement caching strategies 
  • Use stored procedures for complex operations 
  • Minimize data transfer between application and database 

Cloud Cost Management: 

  • Use reserved instances for predictable workloads 
  • Implement auto-scaling for variable workloads 
  • Regular cost monitoring and optimization 
  • Choose appropriate service tiers based on actual usage 

 

Monitor these key indicators: 

Performance Indicators: 

  • Query response times consistently above acceptable thresholds 
  • High CPU utilization (>80% sustained) 
  • Memory pressure and frequent disk I/O 
  • User complaints about application slowness 

Capacity Indicators: 

  • Database size approaching storage limits 
  • Transaction volume growth trends 
  • Concurrent user increases 
  • Data growth exceeding current infrastructure capacity 

Scaling Options: 

  • Vertical scaling: Upgrade CPU, RAM, storage on existing server 
  • Horizontal scaling: Add read replicas or implement sharding 
  • Cloud scaling: Use auto-scaling features in cloud databases 
  • Hybrid approach: Combine on-premises and cloud resources 

 

Implement comprehensive cost management: 

Cost Monitoring: 

  • Use cloud provider cost management tools 
  • Set up billing alerts and budgets 
  • Regular cost reviews and optimization 
  • Tag resources for cost allocation 

Cost Optimization Strategies: 

  • Right-size database instances based on actual usage 
  • Use reserved instances for predictable workloads 
  • Implement auto-scaling to handle variable demand 
  • Optimize storage types and backup retention policies 

Budgeting and Planning: 

  • Establish baseline costs for current usage 
  • Plan for growth and seasonal variations 
  • Include costs for backup, monitoring, and support 
  • Regular cost forecasting and budget reviews 

Data Migration and Integration

Common cloud migration challenges for Australian SMBs: 

Technical Challenges: 

  • Legacy system compatibility: Older applications may not work with cloud databases 
  • Data transfer complexity: Large datasets require careful planning and bandwidth consideration 
  • Network performance: Latency and connectivity issues can impact user experience 
  • Application refactoring: May need to modify applications for cloud optimization 

Business Challenges: 

  • Downtime minimization: Ensuring business continuity during migration 
  • Cost management: Hidden costs and variable pricing can exceed budgets 
  • Skills gap: Limited cloud expertise in small IT teams 
  • Change management: Staff resistance and training requirements 

Compliance Challenges: 

  • Data sovereignty: Ensuring data remains in Australia when required 
  • Security configuration: Properly securing cloud environments 
  • Regulatory compliance: Meeting industry-specific requirements 

Mitigation Strategies: 

  • Thorough assessment and planning phase 
  • Phased migration approach 
  • Staff training and external expertise 
  • Comprehensive testing and rollback plans 

Follow a structured migration approach: 

Pre-Migration Phase: 

  • Assessment: Inventory current databases, applications, and dependencies 
  • Planning: Define migration strategy (lift-and-shift vs. refactoring) 
  • Testing: Set up test environments and validate migration procedures 
  • Training: Ensure staff are prepared for new cloud environment 

Migration Execution: 

  • Data backup: Complete backup of all data before migration 
  • Pilot migration: Start with non-critical databases 
  • Phased approach: Migrate in stages to minimize risk 
  • Monitoring: Continuous monitoring during migration process 

Post-Migration: 

  • Validation: Verify data integrity and application functionality 
  • Performance tuning: Optimize for cloud environment 
  • Documentation: Update procedures and documentation 
  • Training: Ensure staff can manage new environment 

 

Hybrid integration strategies: 

 

Connectivity Options: 

  • VPN connections: Secure site-to-site connectivity 
  • Direct connections: Dedicated links (AWS Direct Connect, Azure ExpressRoute) 
  • API integration: RESTful APIs for application-level integration 
  • Database replication: Real-time or batch data synchronization 

 

Integration Patterns: 

  • Data synchronization: Keep on-premises and cloud data in sync 
  • Application integration: Connect applications across environments 
  • Backup and DR: Use cloud for backup and disaster recovery 
  • Burst to cloud: Scale to cloud during peak periods 

 

Best Practices: 

  • Implement proper security controls for hybrid connectivity 
  • Monitor performance across hybrid connections 
  • Plan for network latency and bandwidth requirements 
  • Maintain consistent security policies across environments 

 

Backup, Recovery, and Business Continuity

Essential backup and recovery practices: 

Backup Strategy: 

  • 3-2-1 Rule: 3 copies of data, 2 different media types, 1 offsite 
  • Frequency: Daily incremental, weekly full backups minimum 
  • Retention: 30 days minimum, extend based on regulatory requirements 
  • Testing: Quarterly restore tests to verify backup integrity 

Australian Framework Requirements: 

  • SMB1001: Documented backup procedures, offsite storage, regular testing 
  • Essential Eight: Daily backups with offline/immutable storage 
  • Privacy Act: Backup procedures must protect personal information 

Recovery Objectives: 

  • RPO (Recovery Point Objective): Maximum acceptable data loss (typically 4-24 hours) 
  • RTO (Recovery Time Objective): Maximum acceptable downtime (typically 2-8 hours) 
  • Document and test these objectives regularly 

 

Comprehensive disaster recovery planning: 

DR Strategy Components: 

  • Risk assessment: Identify potential threats and impacts 
  • DR site: Secondary location or cloud-based recovery 
  • Data replication: Real-time or near-real-time data copying 
  • Recovery procedures: Documented step-by-step processes 

Implementation Options: 

  • Cloud-based DR: Use cloud services for cost-effective DR 
  • Database mirroring: SQL Server Always On Availability Groups 
  • Backup-based recovery: Restore from backups (longer RTO) 
  • Hybrid approach: Combine multiple strategies 

Testing and Maintenance: 

  • Regular DR drills: Test recovery procedures quarterly 
  • Documentation updates: Keep procedures current 
  • Staff training: Ensure team knows their roles 
  • Performance monitoring: Verify DR systems are ready 

 

Key legal requirements: 

Privacy Act Requirements: 

  • Protect personal information in backups with same security as live data 
  • Include backup procedures in Privacy Management Framework 
  • Ensure backup retention aligns with data retention policies 
  • Secure disposal of backup media containing personal information 

Industry-Specific Requirements: 

  • Financial services: APRA requirements for operational resilience 
  • Healthcare: Health Records Act requirements for medical data 
  • Legal profession: Law society requirements for client data 
  • Taxation: ATO requirements for business records (5 years minimum) 

Best Practices: 

  • Document backup and retention policies 
  • Regular compliance audits 
  • Staff training on legal requirements 
  • Incident response procedures for backup-related breaches 

Secure backup implementation: 

Encryption Requirements: 

  • Encrypt backups at rest (AES-256 minimum) 
  • Encrypt backup transmission to offsite locations 
  • Manage encryption keys securely (separate from backup data) 
  • Regular key rotation and access reviews 

Access Controls: 

  • Limit backup access to authorized personnel only 
  • Use multi-factor authentication for backup systems 
  • Log all backup access and restoration activities 
  • Regular access reviews and deprovisioning 

Storage Security: 

  • Use immutable storage to prevent ransomware encryption 
  • Implement air-gapped backups for critical data 
  • Secure physical storage locations 
  • Regular integrity checks and validation 

Compliance Monitoring: 

  • Regular audits of backup procedures 
  • Compliance reporting and documentation 
  • Incident response procedures for backup breaches 
  • Staff training on secure backup practices 

Usability & Access

  • Web access anywhere (mobile-friendly where needed)
  • Streamlined workflows to reduce admin effort
  • Search, filters, and drill-down to records
  • Australian-based support

Visualisation & Reporting

  • Dashboards, graphs, trends, and maps
  • Standard and customised reporting templates
  • Export to common formats (CSV/XLSX/PDF as required)
  • Consistent reporting across sites and programs

Data Integrity & Security

  • Role-based permissions and optional 2FA
  • Encrypted connections (TLS/SSL)
  • Change tracking (who/what/when)
  • Hosted in Australia (AWS Sydney) with backups/DR options

Monitoring & Alerts

  • Warning and exceedance limits per site/parameter
  • SMS and email alerts when thresholds are breached
  • Flag anomalous or missing data for follow-up
  • Audit trail of changes for compliance transparency

Data Collection & Management

  • Automated uploads from telemetry and scheduled file imports
  • Manual uploads and easy field data entry
  • Configurable parameters, units, validation rules, and required fields
  • Manage sites, locations, and monitoring points in one place