What happens to your data.
Your request is processed in Australia. It is not stored after the answer is sent. It is never used to train AI models. Nobody at Continuum Labs reads it.
The rest of this page explains how, so your risk team can check it.
Where it is processed
- Step 1Your systemSends a request over an encrypted connection.
- Step 2A gateway in an Australian data centreChecks your key and records billing details only.
- Step 3AI computers in an Australian data centreRun the AI model and write the answer.
- Step 4Back to your systemThe answer returns. The request content is discarded.
Every step happens in Australia. [Name the data centre operators and sites here once contracts are signed.]
What we keep, and for how long
| Information | What we do with it |
|---|---|
| Content of your requests and answers | Not kept. Discarded once the answer is sent. |
| Billing records | Which key, which model, when, and how many tokens. Kept for five years, as Australian tax law requires. |
| Account details | Names and emails of your users. Kept while your account is open. |
| Security logs | Connection records used to detect abuse. Kept for [period]. |
Who else is involved
AI requests never leave Australia. Our gateway, which checks your key and passes each request to the model, runs on Vercel in its Sydney region. Vercel is a United States company. Your request passes through it in Sydney and is not stored. Account details, hashed keys and usage counts are held by Supabase in its Sydney region. Supabase is also a United States company, and it never receives the content of your requests. Ordinary services such as email and payments may use providers overseas, and they never see the content of your AI requests either. [Name the model service provider, the email provider and the payment provider here once contracts are signed.]
Certificates
The data centres we use hold independent security certificates, such as ISO 27001. These are the operators' certificates. We say so plainly, and we will add our own as we achieve them.
How we secure the service
Connections are encrypted. Access to our systems is limited to the people who need it and is logged. If a security incident affects you, we tell you promptly and explain what we are doing about it.
Your obligations, and how we help
Rules such as APRA's information security standard apply to your organisation, not to us. We provide the documents and controls that help you meet them.
Report a security issue
If you find a weakness in our service, email hello@continuumlabs.ai. We respond to every report.