AI and client data policy

Principles

1. Your data stays yours. We do not use client data to train AI models, and we use only AI services whose terms say the same.
2. Least data. An AI model receives only the data that a task needs. We prefer summaries to raw records.
3. Code checks first, AI drafts second, a person signs last. Screening, unit conversion and QA rules run as tested code. AI writes draft text only. A qualified person reviews each output before it goes to a regulator or a client.
4. Every output can be traced. Each run keeps a log: the input files, the rule version, the model, the prompt, the reviewer and the date.
5. No personal information in AI tools unless you approve it in writing and the tool is an enterprise service.

Your options

• Standard: Sustaniq's enterprise AI accounts, with the controls above.
• Your tenancy: all AI calls go through your own cloud account, in an Australian region.
• No AI on raw data: AI sees only synthetic or summary data. Code does the rest.

Storage and handover

Work happens in your systems where possible. At handover, we return or delete your data, unless the contract says otherwise. Credentials stay with you.

Australian rules we follow

• The Privacy Act 1988 and the Australian Privacy Principles, including the automated-decision transparency duties that start on 10 December 2026.
• Australia's Guidance for AI Adoption (2025).
• Your own information security and AI policies.

If something goes wrong

If client data goes to a wrong place, we tell you within 24 hours: what data, where, and what we did. We record every incident.

Questions about this policy: hello@sustaniq.io