Your data, handled like it matters.
This page is written to be forwarded to your security team, unedited. For everyone else, the plain-English version of every promise is here too.
1. Data residency
All client data (documents, messages, embeddings, and model inference) is processed and stored in AWS Sydney (ap-southeast-2). No exceptions, no offshore processing, no quiet fallbacks to other regions.
2. No training on your data
Your data is never used to train any model: ours, a vendor's, anyone's. We use AWS Bedrock, whose service terms exclude customer content from model training, and we configure every workspace accordingly. This is a contractual commitment, not a settings default.
3. Isolation
Each client's content lives in its own isolated store with per-client access scoping. Nothing is shared between clients: not documents, not embeddings, not conversation history, not learned behaviour.
4. Audit trail
Systems we build log who asked what, when, and what the system did, retained per your policy and exportable for your compliance file. If your organisation is audited, the record exists.
5. Human-in-the-loop, by design
Every system we build stops at a person confirming.
Our systems prepare work (extract, draft, structure, cite) and hand a human the decision. They do not send, pay, diagnose, advise or execute on their own. This is our standing design rule because it is the one that survives an audit, in any industry.
6. Retention and deletion
Retention windows are agreed per engagement and default to the minimum practical. On request, or at engagement end, client data is deleted, and the deletion is confirmed in writing.
7. Subprocessors
One: Amazon Web Services (Sydney region), for compute, storage, and model inference. There is no analytics vendor, no offshore contractor, and no data broker in the chain. This website sets no third-party cookies.
8. What we never do
- Train models on client data
- Share, sell, or cross-use client data, between clients or with anyone else
- Process or store client data outside Australia
- Build systems that act without a human confirming
- Serve advertising or use client data for it
Questions your reviewer will have
Happy to complete security questionnaires, walk through architecture with your team, or put any commitment on this page into the contract. Start the conversation, and see how we build for the architecture behind these commitments.