Your data, protected.

Security is built into how dexIQ works, not bolted on. Your data is encrypted in transit and at rest, access is tightly controlled and logged, we connect through secure OAuth rather than holding your passwords, each customer is fully isolated, and a human approves every action the AI takes by default (you can turn on autopilot for predictable, low-risk work within your limits). dexIQ was built by a finance practice, for finance teams, so controls and auditability come first. We are happy to share our control mapping and answer your risk team's questions in detail.

No. Your data is never used to train, fine-tune or develop AI models. We use the standard commercial APIs of our AI providers, whose published terms state that API inputs and outputs are not used for training. Content is retained by the provider for up to 30 days for abuse monitoring, then deleted. A zero data retention arrangement is available and we are in the process of formalising it. We do not currently hold executed data processing agreements with our AI providers.

No. You connect your accounting system and inbox through secure OAuth, so dexIQ never sees or stores your passwords. We hold only scoped access tokens for the connection you authorise, kept in a managed secret store, encrypted at rest and access-controlled. No third-party provider is ever given your credentials, and you can disconnect at any time.

Yes. All traffic to and from dexIQ is served over HTTPS, with TLS 1.2 as the enforced minimum and TLS 1.3 used wherever your browser supports it. Data at rest is encrypted: the database, the invoice documents and attachments in object storage, and the backups. Staff devices are full-disk encrypted.

dexIQ runs on Amazon Web Services in the Sydney region, and client data is stored there. Resilience is a Multi-AZ deployment within that region, meaning separate sites inside Sydney. There is no separate disaster recovery region. Your systems of record remain yours: Microsoft or Google for the mailbox, Xero for the ledger. dexIQ reads from them under the connection you authorise. Storage is onshore, but some of the services we use sit overseas. Sub-processors receiving client content: our AI providers (United States), PostHog (United States, session replay capturing on-screen content), Marker.io (bug report screenshots), and ABN Lookup (Australian Business Register, onshore) for supplier verification. Sub-processors receiving telemetry only: BetterStack (Germany, monitoring and logging) and Stripe (United States, subscription billing). The full sub-processor register is available on request.

Scope is folder-level and set by you. dexIQ syncs only the mailbox folders you select, and nothing outside them is read. For classification, each message in those folders sends the subject, sender, recipients, the first 3,000 characters of the body, and attachment filenames. Attachment contents are sent only where a message proceeds on the transaction path, not for every message. There is no content-level filter. Any message in a synced folder is processed, including payroll or personal correspondence if it is filed there. You control scope by controlling which folders you sync. Every AI call is stateless and scoped to a single organisation, with no shared context between customers.

No. The AI is allowed to prepare, validate, recommend and explain, never to execute an irreversible action. dexIQ never releases a payment on its own, never changes a supplier's bank details without human verification, never approves above your threshold without sign-off, never overrides an existing control or approval chain, and never sends an external message of financial weight without a human. A human confirmation costs seconds; an unwanted payment can cost weeks.

Our handling is aligned with the Australian Privacy Principles under the Privacy Act 1988. We do not store card data: subscription billing runs through Stripe, which is PCI DSS Level 1 certified. Minimisation is achieved by folder scope rather than by filtering content within a folder, so see the answer above on what is actually sent to the AI.

Access is least-privilege and logged. You sign in through Microsoft, Google or Xero and inherit the multi-factor authentication those providers enforce; internally, MFA is mandatory and shared logins are prohibited. Only the engineers required to support the service can reach production, under role-based access control. Every action on invoices, approvals and connections is written to an audit log with the user, the action, the outcome and a timestamp. Secrets and tokens are never written to logs.

dexIQ is in active SOC 2 Type II readiness with Vanta; we do not claim certifications we do not hold. Our controls are designed against the recognised standards your auditors will know: ISO/IEC 27001 and ISO/IEC 42001, the NIST AI Risk Management Framework, the OWASP Top 10 for LLM Applications, APRA CPS 230 and the Australian Privacy Principles. We are glad to share our control mapping and sub-processor register with your audit or risk team on request.

An invoice or an email can carry text aimed at the model. We do not rely on being able to spot it. Our position is containment and the absence of capability, not detection. dexIQ cannot release a payment, approve a bill or move money. Those capabilities are not in the product, so an instruction asking for one has nothing to act on. Bank detail changes are a hard rule: never auto-actioned, always escalated to a person, enforced in the agent's own instructions and not only in the interface. Deterministic checks against authoritative sources (the ABN register, GST arithmetic) run outside the model, and every proposed action carries an audit record.

Amazon RDS with daily automated backups and 30 day retention, Multi-AZ deployment and deletion protection enabled. Point in time recovery gives a recovery point objective measured in minutes. Backups are held within the Sydney region only, with no copy outside it. We do not operate a second region, and we will not publish a recovery time objective for total region loss until we have tested one.

We maintain a data breach response plan aligned to the OAIC Notifiable Data Breaches scheme, covering assessment, containment and notification. If an incident affected your data, we would notify you promptly on becoming aware of it. A formal, exercised incident-response runbook is part of our current SOC 2 workstream.