Data handling

This page describes the hosted Aicura service, the platform at aicura.app that Aicura runs for its customers. Where Aicura processes personal information for your organisation, our Data Processing Agreement applies automatically through the Terms of Service.

If you buy Aicura through a cloud marketplace, it runs entirely in your own cloud account instead. No customer data, telemetry or support access reaches Aicura from a marketplace installation, so what this page describes does not apply to it.

What we collect

• Your account information, meaning name, work email, organisation name and type, collected when you sign up.
• Documents you upload, meaning privacy policies, governance policies and any other materials you explicitly add to the platform.
• Your AI register data, the structured metadata you enter about AI systems.
• Workflow data, meaning risk assessments, policy generations, scan results, recommendations and the artefacts the product produces for you.
• Discovery signals from the sources you connect, where you enable discovery. Aicura reads from the identity, device, cloud, service desk, code hosting, finance and workspace systems you choose to connect, and correlates what they report into suggestions for your register. Those signals can name your own staff, for example a sign-on to an AI service or an application installed on a managed device, so they can contain personal information about your people. Where you connect a code hosting source, Aicura lists your repositories and reads dependency and configuration files to identify the AI SDKs (the code libraries developers use to call AI services) and services in use. It records the matched names and the files they were found in. The file contents themselves are never captured, so no copy of your source code is retained, and the connector collects no commit or contributor information. Its repository access is read-only and you can install it on selected repositories only. You control which sources are connected and you can disconnect any of them.
• Enforcement and monitoring results, where you run them. The gateway, scanners and drift monitoring run in your environment and report through a Hub, a small service you run that connects outbound to Aicura. Aicura holds the results and the governance record, not the underlying AI traffic.
• Support tickets and correspondence, anything you send us through support.
• Basic usage logs, enough to debug issues and understand which features are being used, no more.

What we don't collect

• Your customers' personal information, except incidentally in documents you upload.
• Behavioural tracking of any kind. Aicura never tracks site visitors or users, and discovery is not an exception. Discovery reads the inventory and access records of sources you deliberately connect, to find AI your organisation is running. It does not follow individuals or build profiles of them.
• Your AI traffic. Prompts and responses passing through your own gateway stay in your environment.
• Data from sources you haven't asked us to process.
• Anything used for advertising or cross-customer profiling.
• Payment card details, which go directly to Stripe.

We don't train models on customer content

This is unambiguous. The models Aicura uses to generate assessments, draft statements and policy content are accessed through Amazon Bedrock under enterprise terms that exclude your inputs and outputs from training of foundation models. Your documents, your AI register and your generated policies are never used to train a model that other customers benefit from. This is both a technical commitment and a contractual one.

Data residency

Aicura has one hosting region today, in Australia, and every customer is served from it wherever the customer is based. Customer document content, the AI register, generated outputs, support tickets, audit logs and AI processing all stay in Australia. Primary infrastructure is in AWS ap-southeast-2 (Sydney), model calls run on Amazon Bedrock's Australian cross-region inference in Sydney or Melbourne, embeddings run in Sydney and backups are in AWS ap-southeast-4 (Melbourne).

A few narrow flows leave Australia. Apart from requests, including uploads, passing through Cloudflare's edge in transit, none of them involves the documents you upload or anything you haven't chosen to publish.

• Stripe processes billing data in the United States.
• Resend sends transactional and briefing emails from AWS Tokyo (ap-northeast-1), Resend's closest region to Australia at the time of writing. Email content is the recipient address and the email itself.
• Cloudflare handles DNS, content delivery and the web application firewall on its global edge network, so inbound requests pass through it.
• Cloudflare R2 stores the Trust Centre pages you choose to publish, in its Asia-Pacific region.
• Cloudflare D1 stores submissions to this website's contact and briefings forms on its global edge.

Each is listed on the sub-processors page with full detail.

Retention and deletion

• Your organisation's data, meaning register, documents, assessments and generated policies. Duration of your subscription.
• Your organisation's data after subscription cancellation. 60 days, then deleted on request or at the end of that window.
• LLM call logs (prompts and model output). Up to 90 days, then automatically deleted.
• Evidence Vault snapshots. 10 years, under AWS Object Lock in compliance mode, so no one, including Aicura, can delete them sooner. They are not removed on cancellation.
• Backups. Database backups and replicated copies of stored files in the Melbourne backup account expire on their schedule, within 7 years. They are used only to recover the service after an incident.
• Change log (record of writes to your data). 7 years.
• Authentication audit logs. 7 years, held under AWS Object Lock and immutable for the retention period.
• Billing records. 7 years from end of relationship.
• Website contact form submissions. 2 years.
• Briefings subscription. Until you unsubscribe, plus 30 days.

You can ask us to delete your data sooner. Email [email protected] and we'll action deletion within 30 days. Specifics are also in the privacy policy.

Cookies and tracking

The Aicura platform doesn't set its own tracking or analytics cookies. It uses local storage in your browser to hold authentication tokens and interface preferences (theme, tour completion). Cloudflare may set technical cookies for security challenges and bot mitigation. This website doesn't run analytics, tracking pixels or behavioural advertising tools.

Your privacy rights

Aicura Pty Ltd. is an Australian company and an APP entity under the Privacy Act 1988 (Cth), so the Australian Privacy Principles govern how we handle personal information. Where the EU or UK GDPR applies, it does too. You can ask to access, correct or delete the personal information we hold about you, restrict or object to how we use it, take a copy with you and withdraw consent you've given. You can complain to the Office of the Australian Information Commissioner, or to your local data protection authority in the EU, EEA or UK. The privacy policy sets out each right and how to use it. We take those rights seriously. We support our customers' governance work, so meeting our own obligations is the least we can do.