Security Questionnaire

Pre-answered vendor assessment for brokerages and aggregators. Anything not covered here: security@autocalc.com.au.

Last updated: July 2026

Where is customer data stored?: All AutoCalc infrastructure — application, database, storage, document parsing and live chat support — runs in AWS's Sydney region. No broker or client data leaves Australia. Two things reach global providers by design: if you sign in with Google, that credential exchange happens with Google, and payments are handled by Stripe. We also use Google Analytics on our website to see which pages get used; it records anonymous usage events (which page, which button) and is never sent a name, an email address, a client's details, or anything from a case.
Is data encrypted in transit and at rest?: Yes. In transit: TLS 1.2+ (ELBSecurityPolicy-TLS13-1-2-2021-06). At rest: AES-256 server-side encryption.
Are uploaded payslips retained?: No. Payslip files are parsed in memory and discarded — never written to disk or a database. Only the structured figures extracted from them are retained, inside the cases the broker chooses to save.
Can documents be redacted before upload?: Yes, and redaction happens on the broker's own device before anything is transmitted. The document is flattened to an image with the redactions burned in, so covered text is removed rather than merely hidden. This is verifiable: disable networking after choosing a file and the preview and redaction still function.
Is customer data used to train AI models?: No. Payslips are sent to Amazon Bedrock for a single inference call and are not retained by the provider or used to train, retrain, or improve any model.
Is AI used to produce the lending figures?: No. Borrowing-capacity figures are produced by deterministic, lender-specific code. No language model is in the calculation path.
How long is data retained?: Payslip files and the figures extracted from them: never retained. Extracted figures are held only inside saved cases, until the broker deletes them — then for as long as the backup answer below describes. Drafts: retained until you delete them, the same as saved cases — autosaved drafts are ordinary cases and carry no expiry. Operational logs: up to 90 days. They record which signed-in user made a request and what happened — never your client's name, address, phone number, date of birth, bank account or ID numbers, employer, or income amounts, and never the payslip file itself.
When a case is deleted, is it removed from backups too?: Up to 35 days. The case database keeps a rolling 35-day point-in-time backup, held by AWS in its own managed backup storage. Restoring the service after a disaster — accidental deletion, corruption, a failed change — is the only thing we use it for. It is not read for analytics, support, troubleshooting or any other day-to-day purpose. When you delete a case it leaves the live database straight away; the copy inside the backup window then ages out on its own and is gone 35 days later.
Who are your sub-processors?: Amazon Web Services — Application hosting, storage, authentication, document parsing, and live chat support (Amazon Connect). (Sydney) Stripe — Subscription billing. (Global (Stripe-managed)) Google — OAuth sign-in, and Google Analytics for anonymous website usage statistics. Analytics records which pages and features are used — never names, client details, or case data. (Global (Google-managed))
Are production and non-production environments separated?: Yes. Production and testing run in separate AWS accounts, each with its own network, database tables, identity pool and deployment role. Testing has no access to production data, and no customer data moves between them.
How is access to production data controlled?: Access is limited to a small number of named team members. Admin and staff role grants are made through the cloud provider's admin console; the application itself holds no permission to grant them. Brokers can only access cases they created.
How are sessions managed?: Session tokens expire after 4 hours. Deactivated accounts lose access on the next request.
What is your incident response and breach notification process?: We investigate, contain, and — where required under the Privacy Act 1988 — notify affected users. Security concerns can be reported to security@autocalc.com.au, acknowledged within one business day.
Do you hold an independent security certification?: No — and we would rather say so plainly than imply otherwise. We are building in a deliberate order: architecture first, audit next. We remove risk rather than certify its management: payslip files and the figures extracted from them are never stored, so there is no store to breach. We will begin a formal audit engagement as we take on firms whose procurement requires one.
Do you offer a Data Processing Agreement?: Yes. Email security@autocalc.com.au with your firm's requirements.
Do you carry cyber liability insurance?: Not at present. We state this openly so it can be factored into your assessment.

Controls in operation

Encryption in transit — all traffic to and from AutoCalc is over HTTPS/TLS 1.2+.
Encryption at rest — all stored data is encrypted server-side (AES-256).
Australian data residency — all AutoCalc infrastructure — application, database, storage, document parsing and live chat support — runs in AWS's Sydney region. No broker or client data leaves Australia. Two things reach global providers by design: if you sign in with Google, that credential exchange happens with Google, and payments are handled by Stripe. We also use Google Analytics on our website to see which pages get used; it records anonymous usage events (which page, which button) and is never sent a name, an email address, a client's details, or anything from a case.
No-training commitment — customer data is never used to train AI models. Each payslip is sent to Amazon Bedrock once and discarded after the response returns.
No AI in calculations — borrowing-capacity figures are produced by deterministic lender-specific code, not by a language model. Payslip extraction runs at zero temperature to minimise variation, and every extracted figure passes through deterministic post-processing rules and is shown to you for review before any calculation uses it.
Authentication — sign-in is handled by AWS Cognito, either with Google OAuth or with an email and password. Passwords are stored and verified by Cognito — AutoCalc never stores them, and never writes them to any log or database.
Session lifetime — session tokens expire after 4 hours. Deactivated accounts lose access on the next request.
Least-privilege access — production data is accessible only to a small number of named team members through scoped access controls. Admin and staff role grants happen only via our cloud provider's admin console — there is no way for the application itself to elevate a user's privileges.
Audit logs — operational logs are retained for up to 90 days. They record which signed-in user made a request and what happened — never your client's name, address, phone number, date of birth, bank account or ID numbers, employer, or income amounts, and never the payslip file itself.
Separate production environment — production and testing run in separate cloud accounts, each with its own network, database tables, sign-in directory and deployment credentials. Testing has no access to production data, and no customer data moves between them.

Full detail: Security & Privacy.