Security
Written to answer the questions a security review actually asks. Everything here is a property of the running system, not an intention.
Where your data lives
Australia, end to end.
| Location | |
|---|---|
| Database | ap-southeast-2 (Sydney) |
| Documents | Australian object storage |
ap-southeast-2 | |
| AI inference | ap-southeast-2, Australian-only inference profile |
The AI point is the one most often missed elsewhere. Board papers are processed in Australia, and that is enforced by an IAM policy that refuses non-Australian inference profiles — not by a configuration setting someone could change.
Who can reach it
Isolation is enforced by the database, not by the application. Every table
holding board data has row-level security with FORCE, and the application
connects as a role that cannot bypass it. The application refuses to start
against a role that can.
This is a stronger claim than separate databases with an application choosing between them: one is a property of the database, the other a promise about code.
What we can prove
- Append-only audit log with daily Merkle anchoring
- Sealed decisions — director signatures verifiable without trusting us. See Sealed decisions
- Governance Passport — scoped verification for outsiders
AI handling
- Claude on AWS Bedrock. No training on customer data.
- No silent fallback to another provider. If Bedrock is unavailable, Pam fails rather than routing your board papers elsewhere.
- No prompt or response text is logged — model id, latency and token counts only.
Access and identity
Passwords are never issued or transmitted; directors set their own from a single-use link. Multi-factor authentication is available. Passkeys are supported for sealing decisions.
Deletion
Board data can be erased on request. The audit trail is tamper-resistant but not undeletable — those are different properties, and only the first is what makes a record evidence. A store that cannot delete would put us in breach of Australian Privacy Principle 11.2.
What we do not claim
No SOC 2 or ISO 27001 certification. We would rather say so than imply otherwise; the controls above are real and independently checkable, and certification is a separate exercise we will undertake when a customer's procurement requires it.