Security & Privacy

AI that is safe to give your customers' data to.

The biggest AI risk for a small business is not the technology. It is staff using personal accounts with no rules. Our setup puts the business back in control of who uses AI, with what data, and under which terms.

Our principles

How we set things up

Business terms only

We only set up business plans whose commercial terms exclude your data from model training by default, and we show you where the vendor says so.

Least privilege

Integrations get the smallest access the task needs, usually read-only. Write access is added only when you ask for it, and only where it is needed.

Your accounts

The workspace, billing and admin rights are in your name. We use a separate admin account that you can remove at handover.

Single sign-on

On AI Professional and Ultimate, staff sign in with your Google or Microsoft account, so leavers lose access the moment their account is disabled.

Visibility

Audit logs and admin settings are switched on where the plan supports them, so you can see who connected what.

Clear rules for staff

A one-page AI use policy: what data can go in, what must be checked before it goes out, and who to ask.

Australian privacy

Built with your privacy obligations in mind

If your business handles personal information, the Australian Privacy Principles still apply when AI is involved. We configure retention, sharing and connector settings to support your obligations, and we document what data flows where, so you can answer customers' questions with confidence. From 10 December 2026, new rules also require covered businesses to disclose when AI helps make significant decisions about people: see our guide to AI and the Privacy Act.

We are not lawyers. For regulated industries, such as health or financial advice, we work alongside your compliance adviser.

  • Data map: which systems the assistant can read and write
  • Retention: how long conversations and files are kept
  • Sharing: who can see shared projects and chats
  • Offboarding: what happens when someone leaves
  • Handover: admin rights and credentials returned to you
CAN READ CAN WRITE Emaildrafts onlyCalendarproposes timesFiles & documentsoffAccounting (e.g. Xero)offCRM / job managementoffTeam chatreplies you approve
The default on AI Professional. Read access where the work needs it; write access off unless you switch it on, and even then a person approves.

Data map

You can see exactly what it can touch

Every setup ends with this table filled in for your business, system by system. It is the page you show a customer, an auditor or a nervous staff member.

Security questions

Do you keep copies of our data?
No. We work inside your accounts during the setup and do not copy your documents or conversations to our systems. At handover, you remove our admin access.
Where is our data stored?
With the AI vendor, under the terms of your business plan. Data location options differ by vendor and plan; we tell you what is available for your plan before you choose.
Can the AI send emails or change records on its own?
Only if you allow it. By default we set integrations up so the assistant drafts and a person approves, and we keep write access off unless there is a clear reason for it.

Last reviewed . Vendor plans and prices change often; we recheck this page every quarter.

Want a second opinion on how your team uses AI today?

Book a free 30-minute call. We will point out the biggest risks and the quickest fixes, whether or not you work with us.

Call Book a call