Trust and security
\nHow we handle access, data and AI on your behalf. Security and governance are built into every engagement from the first week.
\n\n\nYour data stays yours
Your system of record remains the single home for your data. We do not use client data to train AI models. [Confirm]
Least access
We access your platforms as authorised users with only the permissions the work needs, and remove access when an engagement ends.
Agreed before building
Where a tool needs a working copy of data, where it is held and how long it is kept are agreed in writing first. [Confirm]
People approve what matters
Agents cannot take irreversible or consequential actions without a named person approving them.
Every action logged
What each agent does is recorded, so you can always see what happened and why.
Ownership throughout
You own what we build for you: your configuration, your code, your agents and your data.
Every agent has a named owner, a defined autonomy tier, scoped permissions and technical controls, and is monitored after launch.
Name, owner, purpose and permissions for every agent in your business.
Each agent is assessed against known agentic risks before it goes live.
Approval gates, spending limits, logging and a tested way to switch any agent off.
The main platforms that may process data in our work, depending on what we build for you. [Confirm full subprocessor list]
Australia's Guidance for AI Adoption
Six practices for accountable, safe AI use from the National AI Centre.
ISO/IEC 42001
The international standard for AI management systems.
NIST AI Risk Management Framework
A structured approach to identifying and managing AI risk.
OWASP Top 10 for Agentic Applications
The leading taxonomy of security risks specific to AI agents.
[Confirm wording on alignment versus certification]
If your IT, security or procurement team needs our policies, a completed questionnaire or details of our incident process, we will provide them early in the conversation. [Confirm incident response and policy documents available]