How we handle your information
This is how we keep your business and customer information safe when we set up AI assistants, CRMs and automations: where it lives, who can get in, what we keep and what happens when we finish.
The short version
It lives in your accounts
Your AI plan, your CRM and your tools stay yours. We build inside them, so the setup belongs to you, not us.
We don't keep your customer data
We don't run a database of your customers' information. It passes through our automations to get where it needs to go, and we don't store it once the job is done.
Only the three of us
Only our three co-founders can get into client systems. We're all based in Australia and bound by a signed confidentiality undertaking.
You approve each email
Email stays as drafts for you to review, and a person approves anything that goes out. The assistant can add calendar events and update CRM records, because that's part of the job.
The least access we need
Every connection gets the minimum permission the job needs. If a workflow only creates records, we ask for that and nothing more.
Written policies
Our security policy follows the Australian Cyber Security Centre's Essential Eight and the NIST Cybersecurity Framework. We review it at least once a year, and you can ask for a copy.
Your logins and access
How we get and hold them
- You share logins through a secure link.
- We keep them in an encrypted password manager, in a separate vault for each client.
- Keys for connected tools sit in the encrypted store of the platform that uses them, never in emails, documents or code.
- Passwords are long, random and never reused.
How we protect them
- We use two-factor sign-in on every system that supports it, including our password manager.
- Everyone has their own named login, and nobody shares an account.
- Our laptops are fully encrypted, lock when idle and update automatically.
- We don't store your files on our laptops. If we have to open one, we delete it when the task is done.
We pass data through. We don't keep it.
When an automation moves a record between your systems, it passes through and we clear it as soon as it arrives safely. We don't save successful runs. We hold a failed run briefly so we can fix it, then clear it.
Your source data stays in your own systems, and we don't touch it until the transfer is confirmed. If a tool goes down, nothing is lost: it runs once the tool is back.
Everything travels encrypted. Where a tool we use processes data outside Australia, we tell you before we use it, and it's listed in our Privacy Policy.
If something goes wrong
We have a written incident response plan. We treat a suspected problem as real until we rule it out.
- We contain it within an hour of finding out, starting with cutting off any affected access at the source.
- You hear from us within 24 hours, from one named contact.
- We record and review every incident, so it doesn't happen twice.
From first login to the last
You send logins
You send them through a secure link.
We hold them in a vault
Each client gets a separate encrypted vault.
We keep access while we support you
That way we can fix what you report quickly. After that we remove it, unless you keep us on for ongoing support.
We close it out
We revoke our keys at the source, clear anything left in our automations, delete working files, remove our access and confirm it in writing. We also suggest you change any password you sent us.
If we built a custom connector for you, it keeps running for 30 days after support ends, then moves to your own account, or stays with us if you keep us on for ongoing support. We keep a private copy of your interview files.
The paperwork, done properly
We wrote these policies to meet the security review a finance-industry client required before we could connect to their systems. Every client now gets the same standard.
- Information Security Policy
- Incident Response Plan
- Business Continuity Plan
- Data Retention and Deletion Procedure
- A register of every platform that handles client data, with where it's hosted and how it's certified
Need them for your own review? Ask and we'll send them over.
Some things stay with you
- We don't ask for card details.
- We don't send emails for you: we draft them and you approve each one.
- If we can't connect something safely, we tell you and leave it out.
For what we collect through our website and how we use it, read our Privacy Policy.
Questions about your data?
Ask us on a 45-minute discovery call on Google Meet, and we'll walk you through how we'd handle your setup.
Or call 0488 060 568.