Security
Security and confidentiality
Confidentiality is the first question a business should ask about AI. Here are our answers, in plain terms, with links to the sources. The binding commitments are in your client agreement.
Where your data is processed
For client engagements we build on AWS in Australia (Sydney region where available); any exception only with your written agreement.
We call AI models through Amazon Bedrock. AWS states that Bedrock doesn’t share prompts or outputs with model providers and doesn’t use them to train models (link below). If a model you need isn’t available in an Australian region, we’ll tell you which region it would use and ask for your written agreement first.
Systems you already use, such as Microsoft 365, Google Workspace, WhatsApp or Salesforce, keep their data where their providers keep it, under your agreements with them. Each system description lists every service a build touches and where it runs.
Who can see it
These are the controls we plan each engagement around. The ones that apply to yours are set out in your client agreement before work starts.
- Access limited to the people named in your agreement
- Multi-factor authentication on every account that can reach your data
- Least-privilege access: each part of a system can reach only what its task needs
- Access logging, so you can see who and what touched your data
How outputs are checked
Systems are designed so a person stays in charge of anything that matters.
- Built so a person reviews outputs before they’re used
- Findings link to their source; anything unsourced is flagged
- Grounding checks against the source document
- A test set from your own work, with a pass mark agreed before go-live
- Uncertain items go to a person
Your obligations
General information, not legal advice. The OAIC’s guidance is a useful plain-language starting point on privacy and AI. If you work in a regulated profession, check your professional body’s guidance too; the Law Society of NSW guide is one example. We design systems so a person can supervise significant outputs and you can show how they were produced.
Confidential client and business information
Confidential client and business information is meant to stay inside the access boundary agreed for your engagement. How it may and may not be used, including across clients and for demos, is set out in your client agreement.
Explaining automated decisions
Changes to the Privacy Act start to apply from 10 December 2026 to decisions made with the help of computer programs. For each system we document what it reads, what it decides or recommends, and where a person reviews it, so you can explain it.
If something goes wrong
If we become aware of an incident affecting your data, we’ll tell you promptly and help you with your obligations under the Notifiable Data Breaches scheme.
At the end of an engagement
We return or securely delete your data, as you choose, except for any records the law requires us to keep, and confirm in writing when it’s done.
Services we use
Two lists: the services behind this website and our business, and the services a client build typically uses.
| Service | What it does | Where |
|---|---|---|
| Vercel | Website hosting and analytics without cookies | United States and other regions |
| Resend | Delivers contact-form messages to our inbox | United States |
| Cal.com | Booking calls | United States |
| Google Workspace | Email, calendar and documents | United States and other regions |
| Service | What it does | Where |
|---|---|---|
| Amazon Web Services, including Amazon Bedrock | Hosting, storage and AI models | Australia by default |
| A vector database, if a build needs one | Search across your documents | Agreed per build and listed in the system description |
| Systems you already use (Microsoft 365, Google Workspace, WhatsApp Business, Salesforce) | Where your work already lives; listed in each system description | Under your agreements with those providers |
What we don’t claim
We don’t hold ISO 27001 or SOC 2 certification. We build on AWS infrastructure that does, and we’ll tell you exactly which services each build uses.
Questions IT providers and insurers ask
Is our data used to train AI models?
Our builds for clients call AI models through Amazon Bedrock, and AWS states that Bedrock doesn’t use prompts or outputs to train models. If a build needs any other AI service, we check its terms and list it in the system description. The binding terms are in your client agreement.
Will you sign our NDA?
Send it to us before the call or discovery and we’ll review it.
Can we see a system description before we sign?
Yes. We share an example during discovery, and you get the real one for your system before go-live.
Can we give this page to our IT provider or insurer?
Yes. It prints cleanly; use your browser’s Print or Save as PDF.
Last updated 10 October 2026
Next step
Start with AI discovery.
A fixed-fee discovery, credited toward your retainer. A 15-minute call first, with no preparation and no client data.