Security & data handling

Security you can explain to your board.

DataFlight is built for companies that cannot treat customer and internal data as disposable. Every tenant runs on its own isolated stack, every user's app connections stay their own, and everything is hosted and operated in Australia.

Physically isolated tenancy

Every company gets its own dedicated stack — own database, own vector store, own AI runtime. Not row-level filters in a shared database: separate containers per tenant.

Per-user app connections

Each person connects their own accounts (Microsoft 365, Google, Xero and more). Their tokens are encrypted at rest and scoped to them — Captain acting for one user can never see another’s data.

Accountable automation

Every Flight run is recorded: who owns it, when it ran, what it used and what it cost in credits. Failures pause the Flight and notify the owner — "the system did it" is never a mystery.

Australian AI residency

Hosted on Australian infrastructure and operated by a Melbourne team (Cloudploys). Your documents and connections are processed onshore.

Bring your own OAuth apps

Admins can register their company’s own OAuth applications, so consent screens, scopes and revocation stay under your IT team’s control.

Least-privilege by default

Captain only reaches apps a user has connected and scopes they approved at consent time. Admin policy can restrict tools per team.

i

Specific certifications, regions and subprocessors should be confirmed for your contract. Email us to go deeper — no automated intake forms, no offshore call centres. Start a conversation →

Take our security posture to your review team.

We'll walk through tenancy, access control and Australian operations directly.

Request a security briefing