Your site photos, rate cards, and client data live on IRAP-assessed Australian cloud infrastructure. We don't ship it offshore, we don't train third-party AI models on it, and we don't store it in plaintext.
Trust at a glance
AU-resident
100%
Every customer record processed and stored inside Australia.
Third-party AI training
0
Your data is never used to train a general-purpose model.
At rest
AES-256
Per-tenant managed keys via AWS KMS.
In transit
TLS 1.2+
TLS 1.3 preferred; weaker ciphers blocked at the edge.
Breach notify
72 hrs
Affected customers notified within 72 hours of detection.
Live status of each compliance + certification programme. Active = audited and current. Anything else is marked plainly. No badges we haven’t earned.
IRAP-assessed AU cloud
All production infrastructure and customer data
Continuous
ActiveAll production infrastructure and customer data
Continuous
Evidence: DPA on request
Privacy Act 1988 (Cth) - APP 1–13
All customer personal information handling
On the roadmap
PlannedAll customer personal information handling
On the roadmap
Evidence: Privacy policy
SOC 2 Type II
Security, availability, confidentiality
On the roadmap
TBDSecurity, availability, confidentiality
On the roadmap
ISO 42001 (AI management)
AI management system governing QuoteMaker
On the roadmap
PlannedAI management system governing QuoteMaker
On the roadmap
ISO 27001
Information security management system
On the roadmap
PlannedInformation security management system
On the roadmap
ISO 9001
Quality management system
On the roadmap
PlannedQuality management system
On the roadmap
Essential Eight (ACSC)
Cyber-security maturity baseline
On the roadmap
PlannedCyber-security maturity baseline
On the roadmap
Penetration testing
External + authenticated web app + API
On the roadmap
TBDExternal + authenticated web app + API
On the roadmap
Disaster-recovery drill
Failover + restore from backup
On the roadmap
TBDFailover + restore from backup
On the roadmap
Need an audit report, DPA, or sub-processor list under NDA? hello@quotemaker.com.au. Reply within one Australian business day.
Five steps from your phone to the client’s inbox. Every step happens inside Australia.
01
Capture
Photos, voice, video uploaded over TLS to AWS Sydney. Voice transcribed in-region. Never leaves AU.
02
Process
AI inference runs in AU. Rate-card matched against your library. Output is a draft scope and a draft PDF.
03
Store
Encrypted at rest with AES-256, per-tenant keys. Logical tenant isolation enforced at the DB layer.
04
Retain
Active while your account is. On cancellation, 90-day grace window then full deletion on request.
05
Delete
Hard delete from primary + backups within 30 days of confirmed request. Certificate available on request.
Six areas your security team will ask about. Linkable anchors so you can deep-link a colleague.
Every site photo, voice note, rate card, client record, and generated quote is processed and stored inside Australia. No customer data crosses the border for any reason - including model inference, support tooling, or analytics.
Traffic between your browser, mobile apps, and QuoteMaker is encrypted in transit. Customer data on disk is encrypted at rest with managed keys.
Builders and their teams sign in with email + password by default. Professional and Enterprise tiers can enable SSO. Multi-factor authentication is available on all paid tiers.
Customer data is backed up daily with point-in-time recovery available for the previous 30 days. Disaster recovery is tested twice a year.
Your site captures, rate card, client list, and generated quotes are not used to train any general-purpose AI model. The QuoteMaker engine is fine-tuned on consented training data only. Customer data is processed for your account, and your account alone.
If we have an incident affecting customer data, we notify affected customers within 72 hours and post a summary on our status page within 14 days of resolution.
A short, deliberate list. We update it within 30 days of any addition. Full DPA available under NDA.
Amazon Web Services
Primary cloud infrastructure (compute, storage, database), AU-hosted AI inference, and transactional email
AWS Sydney (ap-southeast-2)
All customer data
Sub-processor list reviewed monthly. We notify customers of additions at least 30 days before they go live.
If you’ve discovered a security issue with QuoteMaker, please report it directly to our security team before disclosing publicly. We acknowledge every report within one business day and aim to resolve confirmed issues within 30 days.
Security contact
security@quotemaker.com.auAcknowledgement SLA
1 Australian business day
Early access · founding builders
Reply within one business day. Real humans, no chatbot.
