Security & trust

Built to pass a procurement review.

Whether you are a cautious small business or a financial-services procurement team, here is exactly how your data is hosted, processed, and protected.

Last updated:

Stored in Australia. Processed where we tell you.

Everything we keep about your sessions lives in the Sydney region — application on Vercel (syd1), database on Supabase (ap-southeast-2). Processing is a separate question and we answer it plainly: your conversation, and any file you upload, is sent to Anthropic in the United States to be read by Claude, and Knowledge Base text is sent to Voyage AI to be made searchable. Neither stores it. Product-usage events — which steps were used and when, never content, names or email addresses — go to Mixpanel in the United States. Every provider and its region is on our subprocessors page.

Never used to train models

Conversations are processed by Anthropic's Claude under their commercial API terms — your data is not used to train their models. We do not sell data to third parties.

Hard tenant isolation

Each organisation's sessions and Knowledge Base are isolated. Access is decided through a single server-side authorisation checkpoint, not per-page guesswork.

Microsoft SSO

Sign in with your existing Microsoft Entra (work) account, with a magic-link fallback. No extra password to manage or leak.

You own your Knowledge Base

The per-company context you load is customer-owned and access-controlled (view / edit / org-admin). You decide what goes in, and it is yours.

Deletion on request

Ask us to delete your session data at any time and we will action it within 30 days of a verified request, except where retention is required by law.

The detail procurement asks for

Data is encrypted in transit (HTTPS/TLS) and at rest by our database provider; files you upload are stored inside that same encrypted Sydney database, so there is no separate file store to secure. Access to session data is restricted to the participant and authorised administrators. We publish the full list of subprocessors who help deliver the service — including the ones outside Australia and what each receives — and a standalone privacy policy covering what we collect, how we use it, and how long we keep it.

Our subprocessors →Privacy policy →Terms & Conditions →