Stored and processed in Sydney
The database, the document store, the servers, the email we send and the AI model all run in the AWS Sydney region. Nothing is stored or replicated outside it.
Security
What happens to your clients' data
You answer to your clients if their financials end up somewhere they should not, so you should not have to take a vendor's word for it. If anything here is not specific enough to verify, ask and we will show you.
The short version
Stored and processed in Sydney
Records, documents, email and the AI model all run in AWS Sydney. Traffic passes through Cloudflare on its way to us, and nothing is stored there.
Encrypted the whole way
In transit and at rest, with your Xero and BGL credentials encrypted again on top.
Walled off from every other organisation
A signed credential decides which organisation a request belongs to, and the database enforces the boundary itself.
Your team and clients see only what you allow
Permissions run per area, with tax file numbers behind one of their own. Clients see only the entities you grant.
Every change is logged
So is every look at a sensitive field, in a trail our own software cannot edit.
A person sends every email
We file the document and fill in your template. Your team reads it and sends it.
Where your clients' data sits
In Sydney, encrypted the whole way. The two ways anything touches another country are written down here.
What passes through other countries
Traffic reaches us through Cloudflare's nearest location, which can be overseas for someone working abroad. Nothing is stored there and the connection stays encrypted. If you connect Gmail or Outlook, the drafts we put in your mailbox are held by that provider under your own arrangement with them.
Encrypted in transit and at rest
Every connection is encrypted, including the one from Cloudflare to our servers, where our certificate is checked. The database and document store are encrypted at rest. Xero and BGL tokens and authenticator secrets are encrypted again under a key that never sits in the database.
Passwords and sessions
Passwords are hashed and never stored, logged or shown, including to us. Session cookies cannot be read by page scripts or carried to another site.
Who can see what
No other organisation can reach your records, and inside yours, your team and clients see only what you allow.
The organisation comes from the credential, not the request
Which organisation a request acts on is read from a signed credential the browser cannot edit. Changing an id in a web address gets nobody into your records.
The database checks it as well
The database enforces the same boundary on its own, so a mistake in our code still runs into a wall our code does not control.
Team permissions run down to the field
You set read, write or nothing per area, and tax file numbers sit behind a permission of their own. A field someone cannot read never reaches their browser, and every reveal of a tax file number is logged.
Clients get their own login
The client portal is a separate application. Each client signs in with their own login and authenticator, and sees only the entities you have granted them one at a time. Removing access takes effect on the spot.
Email carries a link, not the document
Signing requests and signed copies arrive as a link that needs a portal login or a one-time code, so a forwarded email gives nothing away. The only attachment we send is a copy of an ATO letter with the tax file number, payment reference numbers and EFT codes struck out.
Sign-in takes more than a password
Every login, team or client, needs a password and a code from an authenticator app, and nobody can switch that off. Five wrong passwords or codes in a row lock the account for 15 minutes.
Sessions end on their own
A sign-in lasts two hours. Ask to stay signed in and it lasts until a day passes without you. Either way, client records lock behind your password after 30 minutes without activity. A session used from a different browser is ended and you get an email about it.
The record of who did what
Built to hold up when somebody asks about it months later.
Every change to a client record is logged
Every create, change and delete is logged, and so is every reveal of a sensitive field such as a tax file number: who, what, which record and when. Entries are kept for 18 months and the database will not let our own software edit them.
Signature evidence stands on its own
Every e-signature keeps the signer, their IP address, their browser and the time of each step, stored apart from the document so the evidence survives a dispute over the file.
How we use AI
What you need to tell your clients about it.
The model stays in Sydney and sees only what it needs
Our AI model runs in AWS Sydney. It only sees documents after tax file numbers, payment reference numbers and EFT codes are masked, and if masking cannot be done cleanly the document stops. From your storage it sees folder and file names, never their contents.
A person sends every email
The email to your client is your own approved template, never wording a model wrote. Nothing goes out until someone on your team reads it and sends it.
Your data stays yours
While you are with us, and on the way out.
We do not sell it or share it
Your client records are not sold, not shared beyond the suppliers listed below, and not used to build anything we sell to someone else.
You can take it with you
Your organisation's owner can ask us for a full export at any time. We prepare it and email the owner, who downloads it from settings with their password and authenticator code. It holds every record and every document, tax file numbers do not leave in full, and the download expires after 24 hours.
Leaving means it is deleted
The owner closes the organisation with their password, and nothing happens for 30 days, so you can take an export or cancel. Then every client, job, team member and file is deleted, and backups roll over within 35 days. We keep the organisation's name, ABN and owner so the records below still say whose they were. Audit entries run out their 18 months, and signed documents with their evidence are kept five years from signing unless your organisation and the signer both agree to delete them sooner.
Who else touches it
Every supplier who could come into contact with your data. If that changes, so does this list.
| Supplier | What they do | Where | What they could see |
|---|---|---|---|
| Amazon Web Services | Servers, database, document storage, email and the AI model | Sydney (ap-southeast-2) | Every stored client record and document, and the email we send |
| Cloudflare | Network, encryption and hosting for the front end | Global network | Traffic in transit, nothing stored |
| Stripe Only if you connect it | Collecting payments from your clients, if you bill through us | Global, with an Australian entity | Billing details. Card numbers never reach us |
| Xero, BGL, Microsoft, Google Only if you connect it | Platforms you connect for import, storage and email | Set by that platform | Only what you connect them to, when you connect it |
How we would handle an incident
If an incident touched your data you would hear it from us directly, in writing, with which of your clients are involved. You would hear it while we were still working through it, because you have notification duties of your own under the Privacy Act.
Version 1.0 · reviewed 13 October 2026 · if something here changes, the version and date change with it.