Trust Centre
The locks on every door.
Our agents work with your money, your customers and your code. This is where your data lives, who can reach it, and what we are certified for.
Hosted in Australia
Production data and recordings stay in Sydney-region infrastructure by default.
No training on your data
Not by us, and not by our model providers, under contract.
One key per agent
Each agent has its own scoped access. Revoke one floor without touching the rest.
Every action logged
What each agent saw, decided and did, and who approved it. Exportable to your SIEM.
Compliance
Draft: statuses in brackets are placeholders. Replace them with your real position before launch, and never list a certification you don’t hold.
| Framework | Status | Notes |
|---|---|---|
| Privacy Act 1988 and the APPs | Aligned | Privacy policy, data processing agreement and a breach plan under the Notifiable Data Breaches scheme. |
| SOC 2 Type II | [In progress] | Report available under NDA once issued. |
| ISO/IEC 27001 | [Planned] | Covering platform, operations and install teams. |
| ISO/IEC 42001 (AI management) | [Planned] | Our AI governance is being built to this standard. |
| ASD Essential Eight | [Maturity level] | Self-assessed each year. Summary on request. |
| Voluntary AI Safety Standard | Aligned | See the mapping on the AI transparency page. |
Security controls
- Encryption
- AES-256 at rest and TLS 1.2+ in transit. Customer-managed keys available.
- Identity
- Single sign-on with SAML or OIDC, SCIM provisioning and enforced MFA for staff.
- Access
- Role-based access, just-in-time production access and quarterly reviews.
- Agent sandboxing
- Agents run in isolated workers with allow-listed network access and scoped tools.
- Prompt-injection defence
- Text in emails, web pages and documents is treated as data, never as instructions, and tested every release.
- Testing
- Annual third-party penetration test, plus continuous dependency and container scanning.
Subprocessors
We give 30 days’ notice before adding a subprocessor that handles client data.
| Provider | Purpose | Location |
|---|---|---|
| [Cloud provider] | Hosting, storage and compute | Australia (Sydney) |
| [Model provider] | Language model inference, zero data retention | [Region] |
| [Voice provider] | Telephony for voice agents | [Region] |
| [Monitoring provider] | Logs and monitoring, redacted | [Region] |
Contact the security team
Request documents
Security whitepaper, penetration test summary, data processing agreement, completed questionnaires and our continuity plan.
hello@teammate.autos
Found a vulnerability?
We run coordinated disclosure, reply within two business days and won’t take legal action against good-faith research.
hello@teammate.autos