Security & Privacy

AutoCalc does not store payslip files. When you upload one, the bytes are sent to our document-parsing service and then discarded. We never write the file to disk or any database.

This applies to every upload, every user, no exceptions. If our team needs sample documents to test or improve the parser, we use our own test fixtures — not files uploaded by brokers.

The structured data extracted from the document (e.g. employer, gross pay, allowances) isn't kept either, unless you save the case. Where you do, it lives inside that saved case and nowhere else, and you can delete the case at any time. See the retention table below.

Before a payslip is uploaded, you see a full preview of it inside your own browser and can black out anything you don't want to share — tax file numbers, bank account details, addresses. AutoCalc finds those fields automatically and highlights them for you — one click hides a highlighted field, and you can draw your own boxes before anything is sent. You stay in control: nothing is hidden (or kept visible) without your say-so.

Redaction is real removal, not a sticker. Some PDF tools draw a black box over text while the words remain underneath, ready to be copy-pasted out. AutoCalc instead converts the document to a flat picture with the boxes burned in. The original file — hidden text and all — never leaves your computer. What we receive contains no trace of what you covered.

See it for yourself, no technical skills needed: turn off your Wi-Fi after choosing a file. The preview and redaction still work, because they run entirely on your device. Nothing is uploaded until you press the upload button.

For your IT or compliance team

The preview is rendered with a locally-bundled copy of PDF.js served from our own domain — no third-party scripts or CDNs are fetched on this path. Verification: open the browser's developer tools, Network tab, then select a payslip. No request carrying your document leaves the browser until the upload button is pressed (you may still see unrelated same-origin asset and analytics requests — none of them contain your file). If you have blacked anything out, the request contains only the flattened, redacted copy — a rasterized image with no text layer; the original file with the covered content is never transmitted. If you apply no redactions, the file is sent as-is.

AutoCalc never uses AI to do calculations. Every borrowing-capacity number you see — max loan, UMI, assessment rate, shading — is produced by deterministic TypeScript code that mirrors each lender's own serviceability spreadsheet, line for line. There is no language model anywhere in the calculation path. The only thing AutoCalc uses a model for is reading a payslip PDF and turning it into structured fields (employer name, gross pay, YTD figures, etc.).

The parser is constrained, not creative. It runs at zero temperature and is asked only to label figures already printed on the page — it is not asked to calculate, estimate, or infer anything that isn't written there. Its output then passes through deterministic classification and annualisation rules before you see it.

You always review before anything is used. After a payslip is parsed, the broker sees every extracted figure (per-period base, overtime, bonus, allowances, YTD, super) inside the income summary card and can edit, override or reclassify any of them before the calculator runs. Nothing flows into the bank calculations until the broker accepts the parsed values.

Why this matters. A common worry about AI is hallucination — the model inventing a number. AutoCalc structurally rules that out two ways: (1) we never let the model do arithmetic; it only labels what is already on the page, and (2) the serviceability calculation is run by Excel-equivalent TypeScript code that has thousands of automated tests cross-checking it against each lender's own spreadsheet. If the broker corrects an extracted figure, the calculator simply uses the corrected value.

Where the document is processed:

Parsing runs on Amazon Bedrock inside AWS's Sydney region. The commitments we rely on from AWS:

• We never use customer data to train our AI. Payslips and any other content you submit are not used to train, retrain, or improve any foundation model — not by AutoCalc, and not by AWS or the underlying model providers.
• Customer data is used once and then discarded. Your payslip is sent to Bedrock for a single inference call. AWS does not retain the input or the output after the request completes — nothing is logged, cached, or stored by the provider.
• Inputs stay within the AWS Sydney region for the duration of the request.

These commitments come directly from AWS's published terms for Bedrock. See AWS Bedrock Security & Compliance for the source.

AutoCalc routes every payslip parse through Sydney. The extracted structured data we receive back is the only thing that touches our systems.

Sound architecture and independent audit are both worth having, and we intend to have both. This is a question of order, not preference.

We're a small Australian team, so we do one thing properly at a time — and the first is the architecture: collect as little client information as the job requires, and don't store what we don't need.

A payslip you upload is parsed in memory and discarded — never written to disk, never placed in a database, never used to train a model. Anything you black out never leaves your computer. There is no store of payslip files to breach, because we don't keep one.

We think that's the right order. A certification attests that the controls around a risk are well managed; removing the risk outright is stronger than managing it.

To be clear about what that does and doesn't cover. We hold no independent security certification. An independent audit would still speak to things architecture alone doesn't — access provisioning, change management, incident response, vendor review. We operate controls in each of those areas (see below), but they have not been independently audited. If your firm requires an independent report before approving a tool, we'd rather you know that now than find out at approval stage.

As we take on larger firms whose procurement requires a formal report, that becomes the next thing we do properly. We'll begin an audit engagement when we're serving firms that require one.

• Encryption in transit — all traffic to and from AutoCalc is over HTTPS/TLS 1.2+.
• Encryption at rest — all stored data is encrypted server-side (AES-256).
• Australian data residency — all AutoCalc infrastructure — application, database, storage and document parsing — runs in AWS's Sydney region. No broker or client data leaves Australia. Two things reach global providers by design: if you sign in with Google, that credential exchange happens with Google, and payments are handled by Stripe. We also use Google Analytics on our website to see which pages get used; it records anonymous usage events (which page, which button) and is never sent a name, an email address, a client's details, or anything from a case. See the sub-processors table below.
• No-training commitment — customer data is never used to train AI models. Each payslip is sent to Amazon Bedrock once and discarded after the response returns. See how document parsing works, above.
• No AI in calculations — borrowing-capacity figures are produced by deterministic lender-specific code, not by a language model. Payslip extraction runs at zero temperature to minimise variation, and every extracted figure passes through deterministic post-processing rules and is shown to you for review before any calculation uses it. See the parsing section, above.
• Authentication — sign-in is handled by AWS Cognito, either with Google OAuth or with an email and password. Passwords are stored and verified by Cognito — AutoCalc never stores them, and never writes them to any log or database.
• Session lifetime — session tokens expire after 4 hours. Deactivated accounts lose access on the next request.
• Least-privilege access — production data is accessible only to a small number of named team members through scoped access controls. Admin and staff role grants happen only via our cloud provider's admin console — there is no way for the application itself to elevate a user's privileges.
• Audit logs — operational logs are retained for up to 90 days. They record which signed-in user made a request and what happened — never your client's name, address, phone number, date of birth, bank account or ID numbers, employer, or income amounts, and never the payslip file itself.
• Separate production environment — production and testing run in separate cloud accounts, each with its own network, database tables, sign-in directory and deployment credentials. Testing has no access to production data, and no customer data moves between them.

AutoCalc relies on the following third-party services. Each is bound by its provider's data-handling terms.

Only a small number of named AutoCalc team members have production access. Admin and staff role grants are made via our cloud provider's admin console — there is no path inside the AutoCalc application that lets a user grant themselves elevated access.

Brokers can only see the cases they themselves have created. Admins can list customer accounts for support and tier management but do not have a path that exposes raw payslip files (because none are stored).

If we detect or are notified of a security incident, we will investigate, contain, and (where required by the Privacy Act 1988 or applicable law) notify affected users.

Report a security concern to: security@autocalc.com.au. We aim to acknowledge within one business day.

Brokers and broker firms can request a written data processing agreement covering AutoCalc's role as a processor under the Australian Privacy Principles. Email security@autocalc.com.au with your firm's requirements and we will work through it with you.

If you're assessing AutoCalc on behalf of a brokerage or aggregator, the answers to the usual vendor questions are on this page:

• Where data is stored — AWS Sydney (ap-southeast-2). See the controls section.
• Encryption — TLS 1.2+ in transit, AES-256 at rest.
• What is retained, and for how long — see the retention table.
• Who we share data with — see the sub-processors table.
• Access control — see the access section.
• Breach notification — see the incident-response section.
• Independent audit status — none held. See the section on why.

A pre-answered security questionnaire covers these in a printable format. For a written data-processing agreement, or anything not covered there, email security@autocalc.com.au.

AutoCalc is an independent tool. It is not affiliated with, endorsed by, sponsored by, or partnered with any lender. We identify lenders by name only — we do not display their logos or branding, and lender names and trademarks remain the property of their respective owners.

AutoCalc's calculators are independently developed implementations of publicly described lender serviceability logic. They are not provided by, or copied from, any lender's software.

Where AutoCalc populates a lender's serviceability calculator or template with the figures you entered, it is automating a step accredited brokers already perform by hand. This feature is available only to licensed or authorised brokers. Lender calculators, templates, and related materials remain the property of the respective lenders, and you remain responsible for ensuring your access to and use of those materials complies with the relevant lender's terms (see our Terms of Service, section 5).