Security
Security your IT team can sign off.
ISO 27001 certified, your data held in Australia, and controls your admins set for everyone.
Independently audited. Held in Australia.
The standards we meet, where your data lives and what we’ll never do with it.
- ISO 27001
Independently audited against the standard for managing information security.
Certified - Australian Privacy Principles
We comply with the Privacy Act 1988, including the Notifiable Data Breaches scheme.
Compliant - Held in Australia
Australian and New Zealand workspaces are stored in Sydney and never copied to another region.
Storage - Never trained on your data
Nothing your team writes is used to train or tune a model.
Commitment
Your data, in Australia
- Stored in Australia On Amazon Web Services, backed up daily.
- Encrypted AES-256 at rest, and TLS 1.2 or later in transit.
- Yours when you leave Export everything for 30 days after you leave, then we delete it.
Access you control
- Single sign-on Okta, Microsoft Entra ID or any SAML 2.0 provider.
- Two-factor and passkeys For anyone not on single sign-on.
- Your approval first We open your workspace for support only with your permission.
Tested and watched
- Penetration tested Every year, by an independent firm.
- Monitored around the clock Alerts on anything unusual.
- Incident response Planned and rehearsed.
Your workspace. Your rules.
Your admins set the rules once, for everyone.
- What AI can do Each AI feature on or off, and whether it reads your records.
- Who signs in, and how Single sign-on for everyone, through your identity provider. We set it up with you.
- Which assistants connect Claude, ChatGPT, Copilot or any assistant that supports MCP, only if you allow it, and read-only if you choose.
- Who’s in Admins add and archive members. Archiving ends access at once.
Common questions
Visit the trust centreWhere is our data stored?
Australian and New Zealand workspaces are stored in Sydney, on Amazon Web Services, and never copied to another region.
Does GovConnex train AI on our work?
No. Nothing your team writes is used to train or tune a model, and your admins choose what Analyst can see.
Can we use single sign-on?
Yes, with Okta, Microsoft Entra ID or any SAML 2.0 provider. We set it up with you, and from then on everyone in your organisation signs in through it.
Is GovConnex ISO 27001 certified?
Yes. The certificate is in our trust centre.
Will you complete our security questionnaire?
Yes. Your account executive will work through it with you.
How do we report a security issue?
Email security (at) govconnex.com. Our security team looks into every report.
Know first. Prove the impact. Book a time with our team. Request a demo