Security & Data Protection

Overview

Security and data protection are central to how we build. Everything we deliver is hosted in Australia, encrypted, access-controlled and logged, and designed to align with APRA CPS 234, the Privacy Act 1988 and the Australian Privacy Principles.

This page sets out the safeguards we apply, your rights over your data, and how we handle the information we hold. We design and document our work to support your obligations; final compliance sign-off rests with your own risk and compliance function, and we provide the evidence they need.

Data Sovereignty

Your data is stored and processed in Australia. Onshore residency is the default, not an upgrade, and your data is not quietly routed offshore for processing.

• Data stored and processed in Australian data centres.
• Your data is not used to train third-party models, and we document this.
• No background processing in jurisdictions you have not agreed to.

Technical Safeguards

The controls below are applied to every project we operate.

• Encryption of data in transit and at rest.
• Role-based access control on a least-privilege basis.
• Multi-factor authentication on the systems we operate.
• A full audit trail: every automated action is logged and reviewable.
• Continuous monitoring and a defined incident response process.
• Regular, tested backups.

Framework Alignment

We design and document our work to align with the frameworks that govern regulated Australian industries. We do not claim certifications we do not hold.

• APRA CPS 234. Information security controls mapped, documented and supported by onshore residency and access control.
• Privacy Act 1988 and the Australian Privacy Principles. Personal information handled per the APPs, with data minimisation and clear retention.
• ASIC obligations. Record-keeping and audit trails, with controls documented for review.

Human Oversight

AI handles the work; people keep the judgement. On anything that materially affects a customer, a payment or a compliance obligation, a person stays in the loop by design, with guardrails you set and controls documented for your risk function.

How We Handle Your Data

Collection. We collect only what is needed to deliver the service you asked for, and we tell you what that is.

Usage. Your data is used to operate your solution. It is never sold and never used to train third-party models.

Sharing. We do not share your data except where you direct us to, or where we are legally required to.

Your Data Rights

You stay in control of your information and can exercise these rights at any time.

• Access. Request a copy of the personal information we hold.
• Correction. Ask us to correct information that is wrong or out of date.
• Deletion. Request deletion, subject to our legal retention obligations.
• Portability. Request your data in a portable format.
• Restriction. Ask us to limit how your information is processed.
• Complaint. Raise a concern with us, and with the OAIC if it is not resolved.

Contact

For any security question, or to exercise a data right, contact us at info@evolaition.ai.