How we protect your business

Built and operated to the controls independent auditors certify against — SOC 2 and ISO 27001 for security, ISO 42001 for responsible AI. Formal, independent certification is available as part of an enterprise agreement.

Nothing reaches your customers without an authorised approval — you choose how much runs automatically, and where it stops for you.

Every action the system or a person takes is permanently recorded and exportable — records can't be quietly altered.

People get the minimum access their role needs; anything extra is time-boxed and expires automatically.

Administrative accounts are protected by a second factor, not just a password.

Unattended sessions sign out automatically after a period of inactivity (with a countdown warning first), and every session has a hard time limit — so a walked-away screen or a forgotten login can't be misused.

Hosted in Australia (dedicated instances available in your region — including deployment into AWS or Azure for enterprise requirements), fully separated per client, never used to train AI models, exportable if you ever leave.

Traffic is encrypted end-to-end; backups run nightly, encrypted, and are stored off the primary server.

Every service is watched around the clock — issues alert us immediately and we respond within your plan’s response times.

Built around the Australian Privacy Principles, including your customers' right to access and erasure.

Human approval gates, fully audited AI actions and instant kill-switches — the controls emerging AI standards (ISO 42001, Australia's Voluntary AI Safety Standard) call for, built in from day one.

A published way for security researchers to report a flaw safely — acknowledged within 2 business days, and every report opens a tracked incident with the same fix clock as anything we find ourselves.