Security & data handling, the answers procurement and IT actually ask for.

Google Workspace + Cloudflare Access SSO

Identity is centralised through Google Workspace. Internal tools (BigQuery dashboards, deployment platforms, agency-internal sites) are gated by Cloudflare Access requiring SSO from @121group.io. Role-based access enforced at the SSO layer.

Australian regions where the platform supports it

Production AI processing occurs in australia-southeast1 (Vertex AI, Gemini regional endpoints, BigQuery datasets). Customer-facing client websites are hosted on Cloudflare's Australian edge or on Australian-resident WordPress hosts (Kinsta, Cloudways). GCS buckets created in australia-southeast1.

Per-engagement client-data isolation

Client data is isolated per engagement. We do not pool client data across accounts for AI training or inference. Access to a client's data is restricted to the engagement team, not the agency-at-large. Audit logging on all access events.

We use yours, never share ours

For platforms (Google Ads, Meta Business Manager, Shopify, Klaviyo, GA4, etc.), we operate as authorised users on your accounts using your authentication. We don't share credentials with third parties. We don't keep credentials longer than the engagement requires.

Patient + sensitive data excluded

For healthcare clients, patient personal information is excluded from AI processing at the boundary level. Where engagement involves pathology data, patient-record data, or clinical encounter data, we operate under a separate written data handling protocol with the client compliance officer.

Documented response & disclosure model

Documented incident response procedure with escalation paths to client compliance officers. Notifiable Data Breach scheme awareness for healthcare clients. Privacy Act 1988 (Cth) alignment throughout. We've been operating since 2005 without a notifiable breach event.