Data & security
How we work with your data
What we actually do with your data, systems and credentials on every engagement. It is written for the people who have to approve a supplier's access, not as marketing.
Your data stays in your environment, in Australia
- We work inside your environment by default: your cloud accounts, repositories, ticketing and collaboration tools, on the terms your organisation sets.
- We do not copy production or personal data to our own systems. If a copy is genuinely needed, for example to reproduce a performance problem, we agree in writing what is copied, where it is held, who can access it and when it will be deleted.
- Anything we build or host defaults to Australian regions, such as AWS Sydney or Melbourne and Azure Australia East or Southeast. If a service cannot keep data in Australia, we tell you before using it, and the decision is yours.
- Wherever possible we work with synthetic or de-identified data instead of real records.
Least-privilege access
- Named individual accounts, issued through your identity provider with multi-factor authentication. We never share accounts.
- Access is scoped to the task and read-only by default. Elevated access is requested for a specific purpose and dropped when that purpose is done.
- Access is reviewed during the engagement and removed at the end. We give you a list of everything we were granted so you can confirm it is all revoked.
Credentials and secrets
- Credentials are never sent by email, chat or ticket. They go through your secrets manager or an encrypted password manager.
- Secrets never go into source code, configuration files or infrastructure-as-code. We use your secrets store and short-lived credentials wherever the platform supports them.
- At handover we list any long-lived credential we have seen and recommend it be rotated.
- Our own devices use full-disk encryption, screen locks and current security updates, and our business accounts are protected by multi-factor authentication.
How we govern AI and agent integrations
- No client code, documents or data go into an AI tool without your written approval of the tool, the plan or tier, and the data involved.
- When AI tools are approved, we use business or enterprise plans whose terms exclude your data from model training, and we record where that data is processed.
- Agents and MCP servers get their own narrowly scoped identities, separate from any person’s access. They are read-only by default.
- Any action that changes data, spends money or reaches outside your environment requires explicit human approval. Every tool call is logged so it can be audited.
- A person reviews everything an agent produces before it is merged, deployed or relied on.
- We document each integration’s data flows, permissions and failure modes so your privacy, security and risk teams can assess it. That documentation can feed straight into a privacy impact assessment.
Confidentiality and the end of an engagement
- We work under your confidentiality, privacy and acceptable-use terms, and sign your deed of confidentiality where one is required.
- At the end of an engagement, anything we held on your behalf is returned or securely deleted, and we confirm this in writing.
- If we suspect something has affected your data or systems, we tell you straight away rather than waiting until we are certain, and we support your incident process.
Frameworks and assessments
We have not been formally assessed against the Essential Eight, the Information Security Manual or the Victorian Protective Data Security Framework, and we do not claim alignment with them. We do work within your organisation's own policies and controls, including those frameworks where they apply to you. We are glad to complete your supplier security questionnaire, or to walk your security team through any of the practices above.
questions
Need more detail for your security review?
Send us your questionnaire or your requirements and we will answer them specifically, in writing.