Security
The AI never touches your money.
This is the part of IniDeck we would most like you to interrogate, because it is the reason the rest of it can be trusted with an invoice.
The short version
A language model works out what you meant. It then produces a fixed set of instructions and is disconnected. Ordinary software — the kind that cannot improvise, cannot guess and cannot invent a number — carries those instructions out. Your client names and figures are never in the model's hands at any point.
Why this matters more than it sounds. Most AI tools keep the model running while it acts on your live data, deciding and checking as it goes. That is fine for drafting an email. On a ledger, an unsure model does not stop — it picks the most likely answer and continues. That is how you get an invoice for the wrong client, or the right client and the wrong amount.
What we actually do
Your clients are anonymous to the model
Names, phone numbers, addresses and amounts are stripped out and replaced with placeholders before any request leaves our systems. The real values are reattached afterwards, locally, once the instructions have been checked.
Nothing of yours trains a public model
Your business records are never used to train anyone's AI, ours included. Where we improve our own systems, we use anonymised records of how instructions were structured — never their contents.
Approval before anything irreversible
Sending to a client, taking a payment, changing a price. It prepares, you approve. This is not configurable down to zero.
Your business logic stays yours
Your pricing, your process, your client relationships stay inside your workspace. Nothing learned from your business is offered to another one.
Encrypted in transit and at rest
Standard, and worth stating. Access to production data inside IniDeck is restricted, logged, and the presumption is that nobody has it.
A permanent record of what happened
Every action, when it happened, and exactly what you approved. If a client ever disputes something, you are not reconstructing it from memory.
Where we are on certification
Stated plainly, with dates, because vague security language is worse than none.
- Australian Privacy Principles — we operate to these now, as an Australian business handling Australian customer data.
- GDPR — our data processing agreement is available now for customers who need one.
- SOC 2 Type I — in progress. We will publish the report when we have it rather than referring to it beforehand.
- Penetration testing — scheduled with an independent firm, with a summary available to customers under evaluation.
If you are evaluating IniDeck and need something specific — a sub-processor list, a security questionnaire, a DPA signed — ask us and you will get a real answer, including where the answer is "not yet".
Questions people ask
Which AI models do you use?
Commercial models from established providers, used only to interpret what you are asking for. Because they only ever receive masked placeholders and never act on your records, we can change provider without any change to how your data is handled.
Can your staff read my client data?
Access to production data is restricted and logged, and is not part of normal operations. Where support genuinely requires it, it is time-limited and recorded.
Where is my data stored?
On cloud infrastructure in secure data centres. We will tell you the specific regions and sub-processors on request — see our sub-processors page.
What happens if you have a breach?
We notify affected customers without undue delay, with what happened, what was affected and what we are doing. We would rather tell you early and imprecisely than late and neatly.
Can I delete everything?
Yes. You can export your records and ask for deletion at any time. We keep only what we are legally required to keep, for as long as we are required to keep it.
Do you sell data?
No. Not to anyone, in any form, for any purpose. There is no version of our business model that involves it.
Stop doing the admin.
About ten minutes to set up. It starts working the same day.