Data Handling

01Data categories

1.1User accounts

1.2Consultation records (held for clients)

1.3Operational records

02Data classification

03Mailbox sync

1. A client owner or admin connects one Microsoft 365 mailbox to a project by signing in with Microsoft (delegated permissions: read and send mail, including in shared mailboxes that person has access to; offline access; basic profile). ProveCONSULT reads and sends only from the mailbox address entered for the project. Klarite never sees the mailbox password.
2. Every 5 minutes, ProveCONSULT reads new messages in the mailbox’s Inbox and Sent Items. The first sync of a mailbox reads back 7 days; reconnecting the same mailbox reads back from shortly before its last sync, up to 30 days, so mail that arrived while it was disconnected is recorded.
3. If Microsoft stops accepting the connection, sync pauses and the client’s owners and admins are emailed once (the mailbox address and the project’s name) until it is reconnected.
4. Messages are matched to relevant persons and stored as consultation events, with attachments up to 25 MB and embedded images up to 1 MB. Tracking pixels are skipped. Messages that do not match are held in an Unmatched list for a member to review.
5. Campaign emails and replies are sent from that mailbox only when a member sends them.
6. Each campaign email carries a personal email preferences link. Only a one-way hash of the link is stored. Opening the page changes nothing; the recipient’s answer is saved only when they submit it, and becomes an event on their record in that project.
7. Disconnecting deletes the stored token immediately. Messages already synced stay in the consultation record.

04AI processing pipeline

AI features are available on the AI processing and Themes and replies plans, and AI claims on public comment with the public comment add-on on any plan.

1. Each AI request is first reserved against the project’s and the client’s AI cost caps. Background AI work pauses at 90% of a cap, and owners and admins are emailed at 80% and 100%.
2. Stakeholder text is de-identified in Sydney before it leaves: email addresses, Australian phone numbers, recorded names and other detected personal names are replaced with placeholders. If a known name or email would still be sent, the request is stopped.
3. The request goes to Anthropic’s API in the United States. Scanned documents and images are not sent: their text is read in Sydney by optical character recognition and sent de-identified like other text. Organisation and titleholder names and project-document text are sent without replacement.
4. Results come back with placeholders, which are not replaced with names in summaries and feedback. Results are stored on the client’s records and in a result cache in Sydney.
5. Outputs are for a person to review: feedback stays marked AI-generated until reviewed, AI event summaries are flagged until reviewed, suggested theme moves wait for a person, and drafts are used only when a person chooses. Themes themselves are applied to feedback automatically as an organising aid and can be changed by a person.
6. No decision that significantly affects an individual is made by the software; decisions about relevant persons are made by the client’s staff.

The AI usage log records the model, token counts and cost of each request, but not the text. Under Anthropic’s commercial terms, API content is not used to train its models.

05Encryption

In transit

All connections use HTTPS (TLS). HTTP Strict Transport Security is set for two years with preload, and insecure requests are upgraded. Connections from the platform to its providers are also encrypted.

At rest

06Access controls and tenancy

Separation between clients

• Every business record carries its client organisation. PostgreSQL row-level security allows a user to read or change only records of organisations they are a member of.
• Roles are enforced in the database: viewers are read-only; officers work on records; owners and admins also manage members, mailboxes and permanent deletions.
• Column-level permissions stop users from changing fields that only the server may set.
• Stored files sit in per-client, per-project folders, and the server checks a file’s folder before reading it.
• Files a member uploads are refused when their type can contain a program (programs and scripts, macro-enabled Office files, disk images, web pages and SVG drawings), judged by the file name and by the file’s contents: its first bytes, macros in Word and Excel files (including old .doc and .xls files), and the names of the files inside a .zip (a zip holding a risky file or another archive is refused). Files are not virus-scanned. Email and public comment attachments are kept as received, because they are the consultation record, and a risky type, or a .zip or old Office attachment found to hold macros or a program, is flagged where it is listed.
• An automated cross-client test, and a role test for every role, run before each release.

Sign-in

• Invitation only: invite links expire after 14 days and are stored hashed.
• Passwords of at least 12 characters, checked against known breached passwords.
• Two-factor authentication (authenticator app) is required for every user and enforced by the database, not just the screens.
• Sign-in sessions end after 24 hours without use, and after 7 days at most; signing in again needs the password and the second factor.
• Optional IP allowlisting is available for the whole deployment.
• An account that has belonged to no organisation and has not been used for 12 months is closed automatically (Klarite platform administrators excepted), and an account is closed the same way when the person asks: its sign-in and email address are deleted, and the person’s name stays against the client’s records they made, shown as a former member.

Klarite personnel

Platform administrators are a named list of Klarite staff. Their console shows account-level information — organisations, member emails and roles, project counts, AI usage and security events. Platform admin rights do not open a client’s consultation records; Klarite works in those only where the client has engaged us or asked for support. Each time a platform administrator who is not a member of a client opens that client’s pages or makes a change in it, ProveCONSULT records who, when and which page or change (a page at most once per 15 minutes); the client’s owners and admins see this on their Members page, and nobody can edit or delete it. Database administration credentials are held by a small number of technical staff for support, security, maintenance and incident response.

07Audit records

ProveCONSULT records security events (invitations, role changes, member removals, two-factor resets, plan, suspension and AI cap changes), permanent deletions of projects and organisations, AI usage and background jobs. Consultation records themselves are archived before they can be permanently deleted, so accidental removals can be undone. Each consultation event keeps a history of who changed which field, with the old and new values, and of documents added or removed; members of the organisation can see it, nobody can edit it, and it is deleted with the event. Owners and admins can see their organisation’s security events, AI usage and Klarite support access. These records are kept for the life of the client account and deleted with the organisation. The sign-in audit trail held by Supabase Auth, Klarite’s record of platform-wide emergency stops and its record of account closings are kept for 12 months, and finished background jobs for 30 days.

08Backup and recovery

The database is backed up daily by Supabase’s managed backup service, and those backups expire on its cycle (currently 7 days). Stored files (emails as PDFs, attachments, documents, reports and public comment files) are held in Supabase Storage in Sydney, and every night new and changed files are copied to Amazon S3 in Sydney, in a separate Klarite account. The copies are versioned and locked against deletion; a changed or deleted file’s earlier copy is kept for 35 days and then removed. The nightly copy can add files but cannot read or delete them. Every night the database is also copied to the same separate account in Sydney, so it can be recovered even if our database provider’s own backups were lost: the copy is taken with a read-only database login, encrypted before it is stored (the key to read it is held only by Klarite, outside AWS), locked against deletion, and removed after 35 days. Deleted data can stay in backups for up to 35 days.

Recovery objectives

09Sub-processor list

Reading uploaded public comment .pst and .msg files is paused for now. When it resumes it will run in Sydney, and this list will be updated first.

Error reporting (Sentry) receives the technical details of an application error only: the error type and message, the stack trace, the route path, the environment and the release; for a background job that failed, only the job’s type, reference number and status, never its content. Request bodies, headers, cookies, query strings and user identity are stripped in the application before the report is sent, and Sentry is configured not to store IP addresses, so no consultation data or personal information is held by it. Performance tracing and session replay are not used.

Microsoft 365 is used through each client’s own account and agreement with Microsoft, not as our sub-processor. We do not use analytics or advertising services. We will give clients notice before adding a sub-processor that handles their data.

The platform’s own access keys and passwords are kept in a secrets manager (Doppler, United States) and passed from there to the hosting service. It holds no client data or personal information, so it is not a sub-processor.

10Breach notification

We follow the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth):

1. Detect and contain — investigate and contain quickly; sessions, invitations or mailbox connections may be revoked.
2. Tell the client — affected clients are told promptly, because the consultation records are theirs.
3. Assess — with the client, assess whether it is an eligible data breach.
4. Notify — where required, notify the OAIC and affected individuals as soon as practicable.
5. Remediate and review — fix the cause and update controls.

11Compliance framework

Privacy Act 1988 (Cth)

Operated in accordance with the Privacy Act and the Australian Privacy Principles. See our Privacy Policy.

Environment plan consultation

ProveCONSULT supports titleholders’ consultation records under the Offshore Petroleum and Greenhouse Gas Storage (Environment) Regulations 2023 (Cth). It is a record-keeping and drafting tool and does not decide whether consultation meets those requirements.

Payments

The platform does not process payments or handle payment card data.

No government affiliation

ProveCONSULT is not affiliated with, operated by or endorsed by NOPSEMA or any government body.

12Contact