Trust you can check.
Where your data lives, who can see it, and the documents behind each answer.
SOC 2 Type 2Report under NDA
Hosted in AustraliaClient data stored in Australia
Google Cloud and AzureAustralian data centres- SSO and two-factorOn Enterprise
- 7-year audit logLocked and immutable
- Checked every dayVanta monitors our controls
The short answers.
| Where records are stored | Australia, in Google Cloud and Microsoft Azure data centres. |
|---|---|
| Where AI requests are processed | Your firm chooses. The full model range uses some models that process requests in the United States or other regions, and web search uses a US provider. The Australia-only setting runs meeting transcription in Australia and uses only Australian-hosted models, some of which can still process a request in another Microsoft region. Web search queries can still be processed outside Australia. Enterprise firms can add the latest models to the Australia-only setting, through priority processing. Records stay stored in Australia either way. The trust centre lists where each model processes data. |
| Training on your data | Our AI providers' enterprise terms do not allow it. |
| How long AI providers keep requests | Some keep requests for up to 30 days to check for misuse, then delete them. |
| Personal details | The assistant's web search blocks any query that holds a tax file number or an email address. The AI model reads the client record, because the draft needs it. |
| Who can see your data | Users in your organisation, within the roles you set. AdviseWell staff only when support or maintenance needs it. |
| Recordings and transcripts | Kept for as long as you set. |
| Audit log | Kept for seven years in immutable storage. |
| Documents you can request | MSA, DPA and our SOC 2 Type 2 report, shared under NDA. |
Your client data is stored in Australia.
AdviseWell runs on Google Cloud and Microsoft Azure, in Australian data centres. Each firm chooses its AI setting, and an Australia-only setting is available.
We define all of our infrastructure as code, so every environment is consistent, reviewable and repeatable.
- HostingGoogle Cloud and Microsoft Azure, Australian data centres.
- EnvironmentsDevelopment, staging and production are separate, with their own credentials, secrets and access controls.
- StorageNo storage bucket can be made publicly accessible. An organisation-wide policy enforces it.
Only the right people see your firm's data.
- Sign-in
- Single sign-on and two-factor sign-in, on Enterprise
- Configurable session management
- No anonymous access. Every request needs a verified identity
- Bot and abuse protection on sign-in and sensitive endpoints, against credential stuffing and scraping
- Firm isolation
- Every data request is checked against the user's organisation
- Users reach only their own organisation's data
- Database rules enforce ownership and access, independent of application code
- Roles and least privilege
- Role-based access control. Admin functions are limited to authorised roles
- Billing and impersonation carry extra limits and an audit trail
- Service accounts get the minimum permissions they need
- Service account keys are disabled. Automation uses short-lived, federated credentials
Our own staff are held to the same standard. Access to internal systems needs identity verification through our Zero Trust provider, and a device health check before production access.
Encrypted in transit, at rest and in backups.
- Encryption
- In transit: all data uses TLS. Links between clouds use encrypted VPN tunnels, and developer access uses encrypted tunnels.
- At rest: databases, file storage and backups are encrypted with cloud-managed keys by default.
- Backups and recovery
- Point-in-time recovery on the primary database
- Daily automated backups, with a defined retention period
- Object versioning on file storage
- Audit logs kept for 7 years in locked, immutable storage. The retention rule cannot be shortened or removed.
Private by default, from the network up.
- Network
- Private networking. Workloads have no direct public exposure
- Zero Trust access for internal systems
- Web application firewall and CDN with DDoS protection and bot mitigation
- Virtual machines cannot be given public IP addresses
- Compute
- Private, managed Kubernetes. Control planes and nodes are not exposed to the internet
- Shielded VMs with Secure Boot, vTPM and integrity monitoring
- Automatic security patching, and routine VM recreation for a clean baseline
- Software delivery
- Every deployment passes a security gate: dependency, container image and static code scans
- High and critical findings block the deployment
- Immutable builds, protected branches with required reviews, and no long-lived credentials
- Rate limiting and per-environment CORS allowlists on the API
- Monitoring and response
- Audit logging across all cloud services, with dedicated logging on more than 25 critical services
- Alerts on changes to network configuration, firewall rules, IAM roles and project ownership
- Alerts are ranked by severity, with real-time notice for critical events
- Error tracking in the app, and DNS query logging across the organisation
What the AI sees, and what it does not do.
AdviseWell uses AI models to draft file notes and documents. The adviser reviews and signs off every one. AdviseWell does not give financial advice.
Where the limit is. The assistant's web search blocks any query that holds a tax file number or an email address. The AI model reads the client record, because the draft needs it.
- Model termsWe use AI models under enterprise terms that do not allow training on customer data. The security pack names each provider.
- Personal details (PII)The assistant's web search blocks any query that holds a tax file number or an email address.
- Adviser reviewEvery draft shows its sources. The adviser checks and signs off.
- Retention controlsYou set how long recordings and transcripts are kept.
- CalculatorsFigures come from built-in calculators, not from the language model.
Reports you can read, and monitoring that runs every day.
- SOC 2 Type 2
Sensiba, an independent auditor, tested how our controls operated over a period and reported on it. The report is available under NDA.
- Trust centre
Reports, policies and controls in one place. Request documents at trust.advisewell.co.
- Continuous monitoring
We use Vanta to monitor controls and track evidence across the organisation and its infrastructure.
A SOC 2 report is an auditor's opinion on our controls. It is not a guarantee, and it does not replace your own due diligence.
Found something? Tell us.
We welcome responsible security research. Email security@advisewell.co.
- We acknowledge your report within 48 hours.
- We update you on the fix as it progresses.
- We do not pursue legal action against good-faith researchers.
The pack your licensee needs.
Ask for it before you start a trial. We send it in the first week of a guided trial anyway.
- Security pack
The answers to a licensee's due diligence questions, in one document.
- Master services agreement
The terms we contract on.
- Data processing agreement
How we handle personal information on your behalf.
- SOC 2 Type 2 report
Under NDA.
Questions your licensee will ask.
Where is our client data stored?
In Australia, in Google Cloud and Microsoft Azure data centres.
Is client data processed outside Australia?
It depends on the setting your firm chooses. With the full model range, some AI models process requests in the United States or other regions, and web search uses a US provider. With the Australia-only setting, meeting transcription runs in Australia and only Australian-hosted models are used. Some of those models can still process a request in another Microsoft region. Web search queries can still be processed outside Australia. Enterprise firms can add the latest models to the Australia-only setting, through priority processing. Client records stay stored in Australia either way. Our trust centre lists each AI model and each service provider that handles client data, and where each one processes it.
Do you have SOC 2?
Yes. We have a SOC 2 Type 2 report from Sensiba, an independent auditor, available under NDA. A SOC 2 report is an auditor's attestation, not a certification.
Is our data used to train AI models?
We use AI models under enterprise terms that do not allow training on customer data. The security pack names each provider and its terms.
Are personal details removed before they reach the AI model?
No. The assistant's web search blocks any query that holds a tax file number or an email address. The AI model reads the client record, because the draft needs it.
Who can see our firm's data?
Users can only see data that belongs to their own organisation, within the roles you set. Every data request is checked against organisation membership, and sensitive operations are logged. AdviseWell staff access it only when support or maintenance needs it, under confidentiality obligations.
How long do you keep audit logs?
Seven years, in locked, immutable storage.
What if we find a vulnerability?
Email security@advisewell.co. We acknowledge within 48 hours, keep you updated on the fix, and do not pursue good-faith researchers.
Ask us anything about security.
Request the pack, or email the team. A real person answers.