AutoCalcAutoCalc

Security Questionnaire

Pre-answered vendor assessment for brokerages and aggregators. Anything not covered here: security@autocalc.com.au.

Last updated: July 2026

Where is customer data stored?
All AutoCalc infrastructure — application, database, storage, document parsing and live chat support — runs in AWS's Sydney region. No client data leaves Australia. Two things reach global providers by design: if you sign in with Google, that credential exchange happens with Google, and payments are handled by Stripe. We also use Google Analytics on our website to see which pages get used; it records anonymous usage events (which page, which button) and is never sent a name, an email address, a client's details, or anything from a case.
Is data encrypted in transit and at rest?
Yes. In transit: TLS 1.2+ (ELBSecurityPolicy-TLS13-1-2-2021-06). At rest: AES-256 server-side encryption.
Are uploaded payslips retained?
No. Payslip files are parsed in memory and discarded — never written to disk or a database. Only the structured figures extracted from them are retained, inside the cases the broker chooses to save.
Can documents be redacted before upload?
Yes, and redaction happens on the broker's own device before anything is transmitted. The document is flattened to an image with the redactions burned in, so covered text is removed rather than merely hidden. This is verifiable: disable networking after choosing a file and the preview and redaction still function.
Is customer data used to train AI models?
No. Payslips are sent to Amazon Bedrock for a single inference call and are not retained by the provider or used to train, retrain, or improve any model.
Is AI used to produce the lending figures?
No. Borrowing-capacity figures are produced by deterministic, lender-specific code. No language model is in the calculation path.
How long is data retained?
Payslip files and the figures extracted from them: never retained. Extracted figures are held only inside saved cases, until the broker deletes them — then for as long as the backup answer below describes. Drafts: retained until you delete them, the same as saved cases — autosaved drafts are ordinary cases and carry no expiry. Operational logs: up to 90 days. They record which signed-in user made a request and what happened — never your client's name, address, phone number, date of birth, bank account or ID numbers, employer, or income amounts, and never the payslip file itself. The one exception is Policy Search: questions are recorded as typed, so leave client details out of them. We redact them before any review to improve answers.
When a case is deleted, is it removed from backups too?
Up to 35 days. The case database keeps a rolling 35-day point-in-time backup, held by AWS in its own managed backup storage. Restoring the service after a disaster — accidental deletion, corruption, a failed change — is the only thing we use it for. It is not read for analytics, support, troubleshooting or any other day-to-day purpose. When you delete a case it leaves the live database straight away; the copy inside the backup window then ages out on its own and is gone 35 days later.
Who are your sub-processors?
Amazon Web Services — Application hosting, storage, authentication, document parsing, and live chat support (Amazon Connect). (Sydney) Stripe — Subscription billing. (Global (Stripe-managed)) Google — OAuth sign-in, and Google Analytics for anonymous website usage statistics. Analytics records which pages and features are used — never names, client details, or case data. (Global (Google-managed))
Are production and non-production environments separated?
Yes. Production and testing run in separate AWS accounts, each with its own network, database tables, identity pool and deployment role. Testing has no access to production data, and no customer data moves between them.
How is access to production data controlled?
Access is limited to a small number of named team members. Admin and staff role grants are made through the cloud provider's admin console; the application itself holds no permission to grant them. Brokers can only access cases they created, with one exception: in a team account the account holder can read and edit a member’s cases, and team members can read and edit each other’s where the account holder has turned team sharing on; the account holder also chooses whether members can see, read or edit the account holder’s own cases. Every broker agrees to both before joining a team, team sharing is off unless the account holder switches it on, and every such read, edit and share is written to an access log naming who did it. The account holder can also see counts of each active member’s activity (no client data), and each such view is logged too. An edited case stays in its creator’s account and keeps naming them as its creator; someone without edit access can open a copy in their own account instead — also logged.
How are sessions managed?
Session tokens expire after 4 hours. Deactivated accounts lose access on the next request.
What is your incident response and breach notification process?
We investigate, contain, and — where required under the Privacy Act 1988 — notify affected users. Security concerns can be reported to security@autocalc.com.au, acknowledged within one business day.
Do you hold an independent security certification?
No — and we would rather say so plainly than imply otherwise. We are building in a deliberate order: architecture first, audit next. We remove risk rather than certify its management: payslip files and the figures extracted from them are never stored, so there is no store to breach. We will begin a formal audit engagement as we take on firms whose procurement requires one.
Do you offer a Data Processing Agreement?
Yes. Email security@autocalc.com.au with your firm's requirements.
Do you carry cyber liability insurance?
Not at present. We state this openly so it can be factored into your assessment.

Controls in operation

Full detail: Security & Privacy.