Trust, Security & Privacy
Last modified on 29 January 2026
When it comes to adopting new technology, we know that data privacy and security are at the forefront of everyone’s mind, especially when it comes to AI. It’s one of the most frequent and important topics we discuss with our customers.
At Brokernote, we treat security as a core feature. We understand that our customers entrust us with sensitive data, and we are committed to protecting that information through rigorous security standards, transparent privacy practices, and responsible AI deployment.
Our commitment is clear: We recognise the critical nature of data security and have dedicated resources and processes to safeguarding your privacy. Your data remains your data.
1. Security Architecture & Infrastructure
We employ a defense-in-depth strategy to protect your data at every layer, hosted entirely within Australia.
Infrastructure & Cloud Security
Our platform is hosted on Microsoft Azure, utilising a modern serverless architecture that inherits the highest standards of physical and network security.
- Tier-1 Cloud Providers: All backend processing and storage occur within Microsoft Azure's secure data centres, compliant with ISO 27001, SOC 2 Type II, and FedRAMP standards.
- Network Protection: We reinforce security by interfacing our product with a backend API fortified with industry-standard security practices. This includes secure access controls, strict IP filtering, and DDoS protection.
- Serverless Isolation: Our compute workloads run in ephemeral, isolated environments, minimising the attack surface and eliminating the risks associated with long-lived servers.
- Data stays in Australia: We ensure application data remains within Australian borders including our application logic, databases, and AI models, to meet data sovereignty requirements.
- Modern Scalable Architecture: Our applications efficiently handle increase in workloads automatically, ensuring stable availability and performance.
Data Protection
- Encryption in Transit: All data transmitted between your device and our servers is encrypted using strong TLS 1.2+ protocols (HTTPS).
- Encryption at Rest: Your data is encrypted using 256-bit AES encryption (FIPS 140-2 compliant) while stored in our databases and storage systems.
- Access Control: We enforce strict Role-Based Access Control (RBAC) and the Principle of Least Privilege across our internal systems. Access to production environments is restricted to authorised personnel and is logged and audited.
Authentication & Payments
- Identity Management: We partner with Clerk, an industry-leading identity provider, to handle user authentication. This ensures robust protection against credential attacks and supports Multi-Factor Authentication (MFA).
- Secure Payments: All payment processing is handled by Stripe, a PCI Service Provider Level 1. Brokernote never stores or processes your full credit card information.
2. Responsible AI & Ethics
We leverage advanced Large Language Models (LLMs) to power our processing capabilities. We are committed to using this technology ethically and safely.
Alignment with Organisational AI Principles
Our products are designed to align with the core principles of modern organisations:
- Transparency: We are transparent about our usage of AI, ensuring users comprehend how AI aids in solving problems within their workflows.
- Inclusivity and Empowerment: Our platform is developed to be unbiased and equitable, providing fact-based outputs that empower teams to deliver superior client services.
- Data Privacy and Security: We adhere to the highest industry standards. Our models do not ingest user data for training, ensuring the integrity and confidentiality of your information.
- Mission-Driven: We are fundamentally committed to enhancing the quality of services provided by our clients. By automating manual processes, we enable teams to concentrate on high-value activities.
- Explainable AI: We prioritise solutions that are comprehensible and relevant. Our commitment to explainable AI ensures that users can easily understand and utilise our technology.
3. FAQ
Below you will find answers to our most commonly asked questions. We are committed to maintaining a high standard of data security and privacy. If you have any further questions or concerns, feel free to reach out, and we will be happy to provide additional details or clarifications.
AI Technology & Usage
Our products leverage AI technologies, including leading-edge Large Language Models (LLMs), renowned for their capabilities in natural language processing. A critical aspect of our approach is the prioritisation of privacy and security throughout the model selection process. We commit to transitioning between models only when we can ensure adherence to our rigorous standards of data protection and security compliance.
Not currently. Our products treat inputs verbatim. They may reformat, structure, and re-combine information to improve clarity, however, no new content is "invented" or created.
Not currently. Our products process data and produce predictable outputs. They do not interpret content nor do they function in any advisory, predictive, or recommending capacity.
Organisations primarily use our products to replace manual effort in creating similar outputs, optimising internal workflows and improving overall productivity. Brokernote’s services leverages advanced AI to tackle time-consuming document formatting and processing tasks. By automating these tasks, we enable organisations to concentrate on client service and other strategic activities.
Yes. For creation, enhancement, and testing of our products, we exclusively use data that is either produced internally or acquired from external sources with explicit permissions. Whenever external data is employed, we secure express consent from data owners, ensuring full compliance with IP rights and data protection laws. We have implemented robust measures—including vetting processes and legal compliance checks—to prevent unauthorised use of third-party intellectual property.
We are dedicated to providing outputs of the highest quality. We have established a comprehensive testing process and a robust body of test data that closely simulates real-world scenarios. Regular testing cycles verify the fitness of our models.
However, we recognise the inherent limitations of current AI technologies. To protect against potential inaccuracies, all outputs require review. It should not be directly used or relied upon as a substitute for advice or as a basis for a business, financial or insurance decision. We advocate for a collaborative approach that combines our products with human expertise to achieve the best possible outcomes.
Our policy is built upon several foundational principles:
- Responsible Use: AI should be beneficial and avoid harm.
- Bias Mitigation: We strive to develop solutions that are as unbiased as possible and essentially fact-based.
- Customer-Centric Experience: We ensure solutions are accessible, easy to use, and customised to client needs.
- Continuous Improvement: We engage with the AI community and keep up-to-date with the latest research in AI ethics.
Data Privacy & Sovereignty
Our products access documents and text inputs provided by the user via our user interface or API endpoints for the specific purpose of processing that request.
You retain full ownership of all data you upload to Brokernote. We act solely as a data processor.
Access to application data is strictly restricted. Only a limited number of authorised Brokernote engineering staff have access, and only when necessary for maintenance, security, or troubleshooting purposes (Principle of Least Privilege). All access is logged. We do not provide third-party access to your data.
Data processing takes place exclusively in Australia. All infrastructure, including our application logic, databases, and AI models, is hosted in Australian Azure regions (e.g., Australia East). This ensures your data remains within Australian borders to meet data sovereignty requirements.
We operate on a principle of minimal retention.
- Processing Data: Inputs and generated outputs are retained only for the duration necessary to provide the service (maximum 48 hours), after which they are automatically and permanently deleted from our processing systems.
- Account Data: Minimal account information (email, billing history) is retained for active subscriptions in accordance with legal and accounting standards.
No, as the products do not collect any non-essential personal data, there is no need for an opt-out process. We only process data you explicitly submit for processing and minimal account data required to provide the service.
Our system logs capture metadata regarding system performance, error rates, and usage statistics to ensure stability and security. We do not log the contents of your documents or the text inputs you provide for processing.
Security & Compliance
All data is considered sensitive. It is protected during transmission using HTTPS and SSL protocols. At rest, data is encrypted and decrypted transparently using 256-bit AES encryption (FIPS 140-2 compliant).
Yes. The products undergo regular internal security assessments and automated vulnerability scanning to ensure compliance with industry standards. We also employ continuous monitoring and alerting for potential security issues.
We currently do not hold SOC 2, ISO 27001, or PCI compliance certificates ourselves. However, the technology vendors we work with—Microsoft Azure, Vercel, Clerk, and Stripe—are fully compliant with these standards. You can visit the trust centers of our key technology partners for more information on their certifications.
Operational Reliability & Access
Our infrastructure is fully serverless, and our deployment practices adhere to modern standards enabling continuous development and deployments. In the event of a significant disruption, we have documented business continuity plans to rapidly redeploy our environment.
Our modern scalable architecture efficiently handles increases in workloads automatically, ensuring stable availability and performance.
We utilise Point-in-Time Recovery (PITR) for our databases, allowing us to restore data to any second within the retention window. Our storage systems are configured for redundancy to protect against hardware failures.
We follow a structured incident response framework:
- Preparation: Continuous monitoring.
- Detection & Analysis: Immediate triage of alerts.
- Containment & Recovery: Isolating systems and restoring service.
- Post-Incident: Analysis to prevent recurrence. We are committed to providing timely support and transparent communication in the event of an incident.
We utilise a strict Continuous Integration/Continuous Deployment (CI/CD) pipeline. Every code change undergoes automated testing (unit and integration), human and AI powered reviews, and static security analysis before being deployed to a staging environment for final verification.
Users access our products primarily through our secure web-based interface (SaaS) utilising modern web browsers. We also provide secure API endpoints for organisations requiring programmatic integration.
Brokernote provides administrators with granular control through a Hierarchical Settings model and a comprehensive Role-Based Access system. This ensures brand consistency while maintaining security.
Hierarchical Settings Model We use a three-level hierarchy to manage configuration:
- System Default: Sensible defaults (e.g., standard margins) provided out-of-the-box.
- Organisation (Admin): Settings configured by the Org Admin that represent your "Company Brand." These override system defaults. Admins can lock specific settings (e.g., Font Family) to ensure strict adherence to brand guidelines, preventing users from changing them.
- User (Member): Personal preferences. User settings can only override Organisation settings if the Admin has not locked that specific setting.
Organisation Admin:
- Billing Access: Can purchase licenses, view invoices, and update payment methods.
- User Management: Can invite new users and assign/revoke licenses.
- Settings Control: Configures "Organisation Settings" (branding, disclaimers, policy locks).
- Tool Access: Has access to all tools (e.g., Reformatter) provided they have an active license.
- Tool Access: Can use all tools provided they have an active license.
- Personal Settings: Can configure personal preferences, but these may be overridden by locked Organisation settings.
- Restricted: Cannot see billing information, manage other users, or change company-wide branding.
Access is restricted via our authentication provider (Clerk). Administrators can revoke access for specific users within their organisation at any time. Additionally, our API access requires unique, revocable API keys.
