Trust
Security and trust
Where your data lives, who can reach it, what the AI sees, and what we have not done yet.
CONTROLS
How your data is protected
Each customer's data is separated in the database
PostgreSQL row-level security on all customer data, with a second check in the application on every change. Inside a group, staff can also be limited to the companies they work on.
Two-factor sign-in for every account
Multi-factor authentication is mandatory, and the database itself refuses data access to a session that has not completed the second factor. Social logins are not accepted.
Encrypted in transit and at rest
TLS 1.2 or later on every customer endpoint and AES-256 encryption at rest. Tax file and IRD numbers are stored only in encrypted form at the application layer.
A record of who did what
Audit logs cover sign-ins, role changes and consequential changes to your data.
Where your data lives
Your database, your file storage and the web application run in Sydney, Australia.
We do not claim that everything stays in Australia. Some of the services we rely on process data elsewhere, mostly in the United States: background jobs, error monitoring, email delivery and whichever cloud AI provider you choose to use. Every sub-processor and its location is listed in our Data Processing Addendum.
AI and your data
You choose the model, per task: a cloud provider, or a model you run on your own hardware. With self-hosted AI the model runs inside your network and Allwis connects out to it, so no inbound port is opened. A workspace can be set to self-hosted AI only, and in that mode a request is refused, not sent to a cloud provider, when your own model is unavailable.
Your data is never used to train our models or any provider's. Every AI call is logged. The AI drafts, flags and proposes, and a person approves anything that touches money.
What we have not done yet
We would rather you read this here than find it out later.
- Allwis does not hold a SOC 2 report or an ISO/IEC 27001 certification. We are preparing for a SOC 2 examination and no auditor has been engaged yet.
- Backups are daily and kept for 7 days. Point-in-time recovery is not enabled, so a restore can lose up to 24 hours of changes.
- OAuth tokens, API keys and bank account numbers are encrypted at the application layer. While that migration is completed, a plaintext copy is kept alongside the encrypted one, protected by storage encryption and row-level security.
QUESTIONS
What security reviewers ask
Can we see your security questionnaire responses?
Yes. Email security@allwis.ai and we share them under NDA.
Who are your sub-processors?
They are listed, with locations, in the Data Processing Addendum.
What happens if there is a breach?
We aim to notify affected customers without undue delay, and within 72 hours of becoming aware of a personal-data breach where Article 33 of the GDPR applies, or as other applicable law requires.
How do we report a vulnerability?
Email security@allwis.ai with the details and steps to reproduce. We acknowledge within 2 business days.
Bring your hardest questions
Send us your security questionnaire, or bring your IT lead to the first onboarding session.