Your data. Kept here, kept safe.

For Australian clients, the software and its data are hosted on servers located in Australia. For clients served from our Indonesian office, the hosting location is written into their Order.

Some features rely on specialist providers, such as AI models, telephony or email delivery, that may process limited data overseas to do their job. When that’s the case, your Order names them before anything is built.

Your team, and only the people you give a login. On our side, staff and contractors (including our Indonesian team) can access it only when they need to: to support you, fix a problem or meet a legal requirement. Access is role-based, logged, reviewed regularly and removed when people leave.

We never sell data, rent it or hand it to anyone for marketing. And we don’t use one client’s data to build or train anything for another client unless that client agrees in writing.

Data is encrypted in transit and at rest. Passwords are hashed, never stored as plain text. Systems are monitored, kept up to date with security patches and backed up regularly. Server and security logs are kept for up to 90 days.

Software built for schools follows the Safer Technologies 4 Schools (ST4S) framework.

AI goes where it’s useful: answering calls, reading documents, marking work, summarising data. We choose AI providers that don’t use our clients’ data to train their public models, and your Order says which ones are involved.

AI can be wrong, so we design for a person to stay in the loop where it matters. Calls keep their recording and transcript; marked work keeps the original.

If we find a breach that’s likely to cause serious harm, we follow the Notifiable Data Breaches scheme: contain it, assess it, and notify the people affected, the Office of the Australian Information Commissioner, and you, without undue delay. We’ll be straight with you about what happened and what we’re doing about it.

No lock-in. Give 30 days’ notice and you’re done. For 30 days after that you can ask for a full export of your data in a common format like CSV or JSON, at no charge. After that we delete it, subject to backup cycles and any legal hold.

If you think you’ve found a security issue in anything we run, please tell us before telling anyone else: hello@zaur.com.au. We’ll acknowledge it quickly, keep you updated, and fix it.