Trust centre
How we handle your data, in one place.
Where your data lives, who processes it, how we protect it, and the controls your administrators and auditors can use.
Data residency
Processed and stored in Australia.
K9 AI is undergoing an independent IRAP assessment up to PROTECTED, expected to complete by December 2026.
- AI models run on Amazon Bedrock in Sydney, with no cross-region routing.
- Conversations, files, search indexes, audit logs and backups are stored in Sydney.
- Requests reach the model under K9’s account. Model providers don’t receive your prompts or responses, and nothing trains a model.
- Web search is off by default. If your administrator turns it on, only the search terms are sent to external search providers; it is always blocked for OFFICIAL: Sensitive and PROTECTED work.
- Subscription payments are processed by Stripe, so billing details (such as name, email and card) are handled outside Australia. Stripe never receives any chat, prompt, file or AI data.
- If you cancel, your data is kept for 30 days in case you change your mind, then permanently deleted, and it ages out of our daily backups within a further 35 days. Tax invoices are kept for five years, as Australian tax law requires.
Sub-processors
Who processes your data.
The third parties that process customer data for K9 AI. Ask us if you need notice of changes for your contract.
- Amazon Web ServicesHosting, storage, backups, key management and monitoringData: All customer dataLocation: Sydney, Australia
- Amazon Bedrock (AWS)AI model inference and embeddings (Mistral AI and NVIDIA models, served by AWS)Data: Prompts, file extracts and responsesLocation: Sydney, Australia
- Amazon SES (AWS)Account and notification emailData: Names, email addresses and notice contentLocation: Sydney, Australia
- StripeSubscription payments and invoicesData: Billing contact, organisation, plan and card details. Never chat, prompt, file or AI dataLocation: Outside Australia (US, Ireland)
- CloudflareBot check on self-service sign-up (Turnstile)Data: IP address and browser signals of the person signing upLocation: Global network
- Public search engines, via SearXNGOptionalWeb searchData: Search terms only, sent from K9’s serversLocation: Outside Australia
- FirecrawlOptionalReading web pages chosen from search resultsData: Page addresses (URLs)Location: Outside Australia
- Jina AIOptionalRanking web search resultsData: Search terms and the text of resultsLocation: Outside Australia
- Public live-data services (Open-Meteo, DuckDuckGo, Kitco)OptionalCurrent weather, search results and market prices when a question needs live dataData: A place name or search terms taken from the promptLocation: Outside Australia
- Anthropic (Claude Code)AI-assisted engineering and operations by K9 staffData: Limited customer data seen incidentally during administration or support. Not used for model trainingLocation: Outside Australia (US)
Optional services are used only when an organisation administrator turns on web search.
Security practices
How we run the service.
Our controls are aligned with the ISM and support your own assessment. They don’t replace it.
- Encrypted connections to K9 AI, encrypted storage and daily backups in Sydney
- MFA mandatory for administrators, with re-checks before sensitive changes
- Every release passes automated secret, code, dependency and container scanning
- Each release image ships with a software bill of materials (SBOM)
- Regular penetration testing; latest summary available under NDA
- Continuous threat detection and audit logging on our cloud platform
Governance
Controls for your administrators and auditors.
Admin guides, including the Compliance API specification, come with the security pack.
Customer-managed keys
Encrypt new conversations and files with a key in your own AWS account in Sydney. Revoke it and that content can’t be read, even by K9.
Retention and legal hold
Keep data until deleted, or 30 days to 7 years. Hold an organisation, user or conversation. Deletion reaches search, logs, files and vectors.
Privacy Act requests
One-click personal data export, and an audited register for access, correction and deletion requests.
eDiscovery and Compliance API
Search, view and export with a stated reason, or connect your archive with scoped, expiring API keys.
Access transparency
Users see when an administrator or “K9 Cyber support” accessed their content, when and why.
SIEM forwarding
Sign-ins, admin changes, file transfers, deletions, AI tool use and DLP hits, with retry, replay and delivery monitoring.
Custom DLP rules
Keywords, identifiers or patterns that block, warn with a reason, or redact. Test them before they go live.
SCIM and IP allow-list
Provision from Entra ID or Okta so leavers lose access straight away, and limit sign-in to your networks.
Organisation policy
Choose the features, models and agent tools on offer, enforced on the server, with an optional PSPF classification banner.
Requests
Ask for the paperwork.
Data processing agreement
Our DPA, covering how we process personal information for you under the Privacy Act.
Request our DPASBOM and security pack
Our security pack for your assessors, the current software bill of materials, or help with your security questionnaire.
Responsible disclosure
Found a security issue? See our disclosure policy, or use the contacts in security.txt.
Disclosure policyRequests go to security@k9cyber.com.au. We reply within one business day.