Security, in plain words.
Data ownership, encryption, Australian residency, access locked to each role, the full record of who did what, and the release review — stated plainly, as numbered declarations. Where an operational commitment belongs in a signed agreement rather than on a marketing page, this page says so instead of rounding up.
How your data is held.
Eight declarations. Each one is how the system is built today — not a roadmap item.
Your data is yours
Every record — customers, jobs, quotes, invoices, documents, history — exports any day, in open formats. Leaving is allowed to be easy; ownership that can't leave isn't ownership.
Encrypted, both states
In transit and at rest. No unencrypted copies sitting around for convenience.
Australian residency, available
Your data can stay onshore. Residency is agreed at the fitting and written into the agreement.
One permission system
Humans and agents log in under the same roles — access is locked down to individual fields, and an agent can never see what its role can't. There is no side door for the AI.
Everything written down
A full record: every action — human or agent — written down as it happens. Who, what, when, on whose say-so.
Consequential actions wait
Outbound emails, payments, anything you flag — held for a human OK. You choose what counts, per agent and per action.
Alterations never touch live
Every change to your system is built on a practice copy — never your live data — human-reviewed on our side, released as its own numbered change, and changes are reviewed before release.
Never training material
Your data is never used to train anyone else's AI. Full stop.
Written where it's enforceable.
Uptime, backups and continuity are commitments, not adjectives — so they live in the agreement you sign, where they bind us. Here is the shape of what goes in writing.
Hosting
The system is hosted and operated for you — no servers of yours to run, patch or babysit. Hosting arrangements, including where your data physically sits, are documented in the agreement.
Backups
Backups run as part of hosting. Frequency, retention and restore testing are stated as numbers in the agreement — figures you can check, not the word “regular”.
Availability
Formal SLA terms are provided with larger-scale agreements. Every customer on every tier gets the same thing when something goes wrong: prompt, honest status communication while it's happening — and a straight account afterwards.
Third parties
The third-party services the system relies on are disclosed in the agreement, and changes to that list are notified — not slipped in.
The honest answer today: no badges.
We don't print certification logos we don't hold — and today we hold none. What exists instead is the substance those frameworks audit for: access locked to each role, a full record of every action, changes proven on a practice copy, numbered, and reviewed before release.
The controls and the record-keeping are built for that path, so when a customer's compliance requires the paperwork, the groundwork is already in place.
The badge comes after the audit. Never before.
Not a moat
of adjectives.
“Military-grade” appears nowhere on this page, on purpose. Security here is an engineering posture: AI can be wrong and people can misclick, so the system assumes both — a human OK before consequences, a record after every action, a practice copy before release, an undo after mistakes. Wrong is designed to be cheap to catch and cheap to undo.
Interrogate
the controls.
Book a 30-minute demo and put your IT adviser on the call — the role locks, the record and the undo demonstrated on the live system, not asserted on a slide.
Tell us about your business: colin@easydone.studio
Tell us what you need and we can discuss the next step.