Security and privacy

Confidential information,
handled properly.

Care and community services run on sensitive information. Ask Mandy is built so it stays that way: stored in Australia, secured to the standard government agencies expect, and never used to train AI, while your team gets the most capable AI available.

Where your information goes, start to finishThree stops. Each one accounted for.
Stop 1 · Your office
Your team

You sign in with multi factor authentication. Team permissions decide who can open which clients and records.

  • Multi factor sign in
  • Role based access
Stop 2 · Australia
Ask Mandy

Your account, conversations, case notes and exports are stored encrypted on servers in Australia and are not moved offshore. Every action is logged.

  • Stored in Australia
  • Encrypted at rest
  • Audit trail on every record
Stop 3 · AI processing
The AI model

Only the text needed to answer is processed, under enterprise terms that prohibit using it to train or improve any model. Nothing about your organisation is kept.

  • Never used for training
  • Not retained by the model
The model only ever sees the question and the legislation it needs to answer it. Your client records, notes and files stay at stop 2, in Australia.

What we commit to

In plain words, and in our terms.

  • Your data lives in Australia

    Account, records, case notes, uploads and backups are stored on Australian infrastructure under Australian law. We do not move stored data offshore.

  • Security to the standard government agencies expect

    Encryption in transit and at rest, multi factor authentication, role based access control and a full audit trail. Our security documentation is available to customers on request.

  • Never used to train AI

    Your questions, notes and documents are not used to train or improve AI models, by us or by our AI providers. That is written into our terms with them.

  • Confidential by default

    Client information is visible only to the people your administrators allow. Every view, change and export is recorded, so you can always answer who saw what.

  • Designed around the Privacy Act

    Built to the Australian Privacy Principles: collect only what is needed, keep it secure, be transparent, and give you control over correction, export and deletion.

  • The most capable AI, kept on a short leash

    Frontier AI models, allowed to answer only from the current legislation and required to cite it. You get the intelligence without the guessing, and your team gets hours back.

Plain commitments

What we do, and what we never do.

We always

  • Store your data on servers in Australia, under Australian law.
  • Encrypt your information in transit and at rest.
  • Keep a full audit trail of who created, viewed, changed and exported each record.
  • Let you export or permanently delete your organisation's data on request.
  • Cite the legislation behind every answer so it can be checked.
  • Tell you promptly if anything ever affects the security of your data.

We never

  • Use your questions, notes or documents to train AI models, and nor do our AI providers.
  • Sell, share or advertise with your data.
  • Move your stored data outside Australia.
  • Let staff read your client information without a logged, legitimate reason.
  • Hide a security question. Our security documentation is available to customers on request.
  • Give legal advice. Mandy gives cited information; your professional judgement stays yours.
Questions we get asked

Security and privacy, answered.

Where is my data stored?

On servers located in Australia. Your account, conversations, case notes, uploaded documents and exports are stored there, encrypted, and are not moved offshore.

Is my information used to train AI?

No. Your questions, notes and documents are not used to train or improve AI models, by Ask Mandy or by the AI providers we use, whose enterprise terms prohibit it.

Who at my organisation can see a client's record?

Only the people you give access to. Team permissions are set by your administrators, and every view, change and export is recorded in the audit trail.

What does "government grade security" mean in practice?

Encryption in transit and at rest, multi factor authentication, role based access control, audit logging, and hosting on Australian infrastructure operated to the standards government agencies require. Our security documentation is available to customers on request.

Can we delete our data?

Yes. You can delete individual records at any time, and on request we will permanently delete your organisation's data and confirm when it is done.

Does Ask Mandy meet the Privacy Act and the Australian Privacy Principles?

Ask Mandy is designed around the Australian Privacy Principles: collect only what is needed, keep it secure, be transparent about how it is used, and give you control over access, correction and deletion.

Confidential information, handled properly.

Bring your security team's questions. We would rather answer them before you sign up than after.

Talk to us