Your data stays in accounts you control. Where it can't, we tell you exactly where it goes.

Separate by default. Each client gets separate accounts, projects, databases and keys. Nothing is pooled with other clients' data, and no client's data is used to build anything for another.

No standing model access. Agents send an AI model only what a task needs, through business or API accounts. Model providers never get ongoing access to your systems or tools. They do keep what is sent for a limited time, and we say exactly how long below.

A person approves what matters. Every agent has named approval steps before it sends, pays, deletes or changes anything that matters, and every build ships with a documented way for you to pause it without us.

Only some of the services we use can keep data in Australia: Claude through Amazon Bedrock (Sydney and Melbourne) and Supabase (Sydney). Anthropic's own API, OpenAI, Google Workspace, Railway, n8n Cloud, Calendly and Resend have no Australian processing option. So we offer three tiers, and your Statement of Work says which one you are on.

Before work starts, your Data Processing Schedule lists every provider that may handle personal information, and the countries involved. We won't start sending personal information to a new country without your written approval.

Anthropic (Claude API). Not used to train models under Anthropic's commercial terms. Inputs and outputs are deleted within 30 days, unless zero data retention is arranged with Anthropic. Content flagged for a usage policy breach can be kept longer. Processed in the United States.

Claude on Amazon Bedrock (Australia). Bedrock does not store or log prompts and responses, does not use them for training and does not share them with Anthropic. With Australian routing, requests stay in Sydney and Melbourne. Newer Claude models sometimes reach Bedrock in Australia later than Anthropic's own API.

OpenAI (API). Not used to train models by default. Abuse-monitoring logs are kept for up to 30 days, unless OpenAI approves zero data retention. Processed in the United States.

The systems we build send your data to AI models only through business or API accounts, never consumer chat apps. Under those terms the providers do not train their models on it. They do keep it for a while, and here is how long. For our own work we also use Claude Code on a Claude Max plan, under Anthropic's consumer terms with model training switched off, as our privacy policy explains.

Where your data warrants it, we request zero data retention from the provider, or build on Claude through Amazon Bedrock in Australia. We never train or fine-tune a model on your data unless your Statement of Work asks us to build a model only for you.

Last updated 1 October 2026. Clients get at least 14 days' written notice before we add or replace a provider that handles their personal information, with the right to object. The first list is what we use to run the business. The second is what our builds are made from; only the ones your Statement of Work names are used for you, and for a client-hosted build those accounts are in your name, so the provider's contract is with you. Telephony providers for call and SMS builds are named per build.

Running the business, 10 providers

Client builds (per Statement of Work), 7 providers

Access. You invite us into your systems with the least role that works, read-only first. We don't ask for your own login, and we don't take shared passwords by email or chat. If a key has to move, it goes by an expiring one-time link and is rotated when the work ends.

Encryption. Data is encrypted in transit (TLS) and at rest by the providers above. Our work laptop has full-disk encryption and Microsoft Defender antivirus with tamper protection turned on.

Our email. Our Google Workspace is hardened: outgoing mail is authenticated with SPF, DKIM and a DMARC policy of reject, all of Gmail's advanced phishing and malware protections are on, automatic forwarding is off, and security alerts (suspicious sign-ins, leaked passwords, new admins, new users) go straight to us.

Multi-factor authentication. In progress, and we won't claim it before it's true. Two-step verification is being rolled out and enforced across our Google Workspace now, followed by security keys on admin accounts and multi-factor authentication on every platform that holds client data. This line changes when that is finished.

This website. Form submissions are written to the database from the server only. The database has row-level security on with no public access, so the key that ships to browsers cannot read or write enquiries.

Logging. Agent actions and access to client data are logged wherever the systems involved allow it, so you can see what an agent did and when.

If we become aware of actual or suspected unauthorised access to, disclosure of or loss of your data while we hold it or in an account we hold, we tell you without undue delay and within 72 hours. We tell you what happened and when, what kinds of data and roughly how many people are affected, the likely consequences, what we are doing to contain it, and who to contact, and we keep updating you as we learn more.

We help you assess whether it is an eligible data breach under the Notifiable Data Breaches scheme, which has to be done within 30 days, and support any notice to the Office of the Australian Information Commissioner and the people affected. We won't notify the regulator or your customers about your data without your agreement, unless the law requires us to. Every incident is recorded, along with the steps taken to stop it happening again.

At the end of a Statement of Work, or earlier if you ask in writing:

1. 01We return your data in a common, machine-readable format, within 14 days of you asking.
2. 02You get the Handover Package: the configuration and source code of your build, a runbook for running, monitoring and switching it off, and a list of every service and account it uses.
3. 03Credentials and admin access are handed over or reset, our access is removed, and any keys that passed through us are rotated.
4. 04Any accounts we held for you are transferred to you. SAI-managed builds keep running for up to 30 days while they move.
5. 05We delete your data from our systems and any accounts we hold within 30 days, routine backups clear within 35 days, and we confirm the deletion in writing.

We keep only what the law makes us keep, such as tax records, and anything you have approved for a case study.