Australian residency
Every byte lives in Sydney — application, database, object storage and the model endpoint. No offshore routing, no cross-region replication.
Security & trust
Security you can
audit
Honest controls, not aspirational marketing. Everything below is either running today or has a date against it — where something is in progress, it says so.
See the data path
Sydney residency on every plan
Four commitments
Tenant isolation
Tenant context is set fail-closed before any primitive runs. A skill that cannot resolve its tenant does not execute; it errors.
Never trained on
Your content is never used to train a model, ours or anyone else’s. Our model provider is contractually barred from training on it, and the endpoint is stateless between calls — nothing is retained once a response is returned.
Fully auditable
Every run writes who triggered it, what it touched, what it produced, and who approved it. Exportable on Growth and above.
Where a request actually goes
Residency is a claim about a boundary. Here is the boundary.
Every hop below happens inside one Google Cloud region. There is no path out of it — not for inference, not for backups, not for failover. That is a configuration, not an intention, and it is the thing to check in the pack.
Australia
01
Your deskTeams, web or Slack — wherever the person already works
TLS 1.3
Sydney · australia-southeast1
02
Load balancerTerminates at the Sydney edge
In region
03
Cloud RunTenant resolved and pinned before a single primitive runs
Fail-closed
04
OpenAI · Australian endpointPrompt in, completion out. Nothing retained, nothing trained on, no human review
Stateless
05
Cloud SQL + object storageEncrypted at rest, 30-day backups, zero cross-region replication
At rest
No egress to another region. No offshore inference. No cross-region replica to fail over to.
Why it is worth money, not just reassuring. Under TPB(GS) 31/2018, sending client data offshore is a disclosure you owe your clients and something they can decline. Staying onshore means your engagement letters do not have to be re-papered and no client has to opt in to anything before you can use this.
What a skill can actually reach
Accuracy is the second thing practices ask about, and the honest answer is about edges, not confidence.
A tool that sits outside your systems is trusted less than one inside them, and rightly — you cannot see where it stops. So here is where it stops. There are three answers and only three: it happens, it waits for a person, or it cannot be done at all.
Just happens
Reading what you have already connected
Ledger balances and transactions
Documents in your filing system
Job and task records
Mail you have already sent
Waits for you
Anything that changes data, or leaves the building
Every write to the ledger
Any message to a client
Any document filed on your behalf
Every lodgement, without exception
Cannot
Refused by the way it is built, not by a setting
Remove an approval step
Reach a system you have not connected
Write code or handle a credential
Act for a colleague you have not shared a rule with
The middle lane is the one that matters. An approval is not a setting somebody can switch off when the week gets busy — an approval step cannot be moved or removed, and a skill that reaches one stops there and waits, however confident it is.
TPB(GS) 55/2026, line by line
The Board’s AI guidance asks for four things. Three of them are features you can point at.
Issued 22 July 2026. It treats putting client information into an AI tool as disclosing it to a third party, which changes what a registered agent has to do before and during use. We are not your adviser on it — but you should know which parts DeskMate answers and which part is still yours.
| What the guidance asks | Where it lives in DeskMate | Whose job |
|---|---|---|
| Client permission before their data goes in, including where it will be stored | We publish the storage answer — Sydney, named sub-processors, nothing offshore — so the disclosure you give your client is a short one. | Yours |
| A person reviews the output before it is relied on | Structural. Anything that changes data or reaches a client stops at an approval step, and that step cannot be moved or switched off. | Ours |
| The verification is documented at each step | Every run writes what it read, what it produced, who approved it and when — with a link back to the source of each figure. | Ours |
| You can show all of it later | Run logs kept 18 months and exportable at any point, as a file rather than a screen. | Ours |
This is our reading of the guidance as it applies to our product, not tax agent advice. Your obligations under the Code are yours, and the first row above stays yours no matter what software you use.
What a run leaves behind
“Documented at each step” means a record exists. This is the record.
Nothing here is reported by the skill about itself. Every line is evidence — what actually moved, what was actually read, and who actually pressed the button.
Bank reconciliation · client file
Run 4,182 · 07:02 AEST
TriggeredScheduled, 07:00 daily — set by the reconciliations senior
Read412 statement lines from the ledger, chart of accounts from the ledger, 3 coding rules taught by the BAS lead
Produced389 matched, 23 exceptions with evidence attached
Held2 writes above the threshold — queued, not applied
ApprovedManager, 09:14 AEST — 2 of 2 released
Retained18 months, exportable as a file at any point
If a client, the Board or your PI insurer asks what the software did on a file, this is the answer, and you can export it without asking us for it.
Certification
Two security assessments done, one standard still to go, and we will say plainly where each one sits.
The ATO’s Digital Service Provider framework names IRAP or ISO/IEC 27001 at its top risk tier. It does not name SOC 2. If a practice is judging us on the standard their own regulator points at, that standard is ISO 27001 — so it goes first, and it is not something we quietly offer only when asked.
Sydney residency and the isolation model
Running today. Tenant context is resolved fail-closed before any primitive executes; a skill that cannot resolve its tenant errors rather than proceeding.
Live
Xero security self-assessment
Complete. Carried out against Xero’s App Partner security requirements, which is what our connector access to Xero sits on.
Complete
ATO Operational Security Framework assessment
Complete. The security assessment behind our Digital Service Provider application, covering activity statements, STP pay events and ABN lookup. The listing itself is the ATO’s to grant, and we will not claim it before they do.
Complete
ISO/IEC 27001
The standard the ATO framework names, and the one we are working toward. Ask us for the current stage and the target date — we will give you both in writing rather than a badge.
Committed
SOC 2
Available if your own policy asks for it. We would rather you held us to ISO 27001.
On request
Your questionnaire, answered by a person
Send it as it is. No portal, no login, no redirect to a trust centre. Usually back inside three business days, with the architecture diagram, the sub-processor list and the retention schedule attached.
Retention
WhatHow long
Chat historyTenant-configured. Default: last 10 conversations per user.
Skill run logs18 months, then purged. Exportable at any point before that.
Connector tokensAES-GCM encrypted at rest. Revoked immediately on disconnect.
Deleted tenant dataRetrievable for 30 days after you disconnect, destroyed on day 30, backups included.
Who else touches your data
Every third party in the path, what they do, and where they do it. If this list changes we tell you before it takes effect — you should never learn about a new sub-processor from a questionnaire.
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud | Application, database and object storage | australia-southeast1 · Sydney |
| OpenAI | Model inference only — no training, no retention | Australian endpoint |
| Microsoft | Teams and Outlook delivery, where you connect them | Australia |
| Slack | Message and approval delivery, where you connect it | United States |
Connector sub-processors only appear in your path if you connect that tool. Disconnect it and the token is revoked immediately.
Found something
Report a vulnerability
Email security@brightpathaisolutions.com. We acknowledge inside one business day and will tell you what we found and when it is fixed. We will not take action against anyone who reports in good faith.
Ask for the pack
Architecture diagram, sub-processor list, retention schedule and our answers to the usual questionnaire. Sent as a document, not a portal login. Usually inside three business days.
Ask us the hard questions.
Send your security questionnaire, or book a call with the person who built the isolation model. Not a sales engineer reading a script.
Talk to security