Security posture.

Data isolation

• Row-level security (RLS) enforced at the database. Tenant data is isolated by database-level policy, not application logic alone. No cross-tenant data is reachable even if an application defect exists.
• Tenants in regulated verticals receive additional logical isolation. Financial planning, medical, and legal tenants are separated at the schema level by default — not as an upgrade or add-on.
• No shared data stores between tenants. Each tenant's graph, documents, and event history are partitioned and cannot be queried across tenant boundaries.

Data residency

• Production database, backups, and file storage: Australian data centres. No cross-border transfer for stored data.
• AI inference: Anthropic PBC (United States). Queries submitted to AI features are processed by Anthropic's infrastructure in the US. This is disclosed in our Privacy Policy §6 and covered by Anthropic's data processing commitments.
• No other cross-border transfers for production workloads. Infrastructure management, monitoring, and backups operate within Australian regions.

Encryption

• In transit: TLS 1.2 minimum on all endpoints. All communication between clients and the platform, and between internal services, is encrypted in transit.
• At rest: encrypted at the storage layer. Database volumes and file storage are encrypted at rest using platform-managed keys.

Audit and logging

• Append-only audit log on every operator action. Every login, query, document action, AI tool call, and database write is recorded. Entries cannot be modified or deleted at the application layer.
• Tenants have access to their own audit log. Operators can review the full activity history for their tenant from within the platform.

Incident response

• Confirmed data incidents: tenant notification within 24 hours. If we confirm a data incident affecting your tenant, we will notify you within 24 hours of confirmation.
• Notifiable data breaches reported to the OAIC. Eligible data breaches are reported to the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

Compliance status