your data, treated like it's mine.

• audited annuallySOC 2 Type IISecurity, confidentiality and availability. Type II means the controls were tested working over months, not on one day. First attained early 2026, assessed every year since.AICPA standard, independent auditor
• privacyEU-U.S. Data Privacy FrameworkCertified under the framework that gives a recognised legal basis for moving personal data out of the EU, UK and Switzerland.U.S. Department of Commerce
• privacyGDPR and CCPAData processing agreement, standard contractual clauses and a published sub-processor list. Export, correction and deletion are built in.EU and UK GDPR, California
• clinicsHIPAA readyA paid add-on for practices handling health information: business associate agreement, encrypted records, audit logging and enforced two-factor sign in. Email us if you need it on.add-on, Business Associate Agreement
• paymentsPCI DSS, through StripeCard numbers never touch the platform. They go straight to Stripe, which holds the highest PCI certification. The platform keeps a token, the brand, the last four and the expiry.Stripe Level 1 service provider
• australiaPrivacy Act and the APPsrevenu is an Australian company. Your account is run to the Australian Privacy Principles and the Notifiable Data Breaches scheme. If something happens, you hear it from Adam, not from the news.Privacy Act 1988, OAIC

Honesty line. These certifications are held by the platform revenu is built on, not by revenu itself. revenu relies on those audited controls and adds its own rules on top. For due diligence, Adam can request the SIG Lite questionnaire or the audit summary from the platform.

• Privacy Act and the thirteen APPsThe Australian Privacy Principles set how personal information is collected, used, kept and secured. APP 11 is the one regulators test first: reasonable steps to protect it. Everything on this page is what reasonable looks like.
• Notifiable Data Breaches schemeIf a breach is likely to cause serious harm, the affected people and the OAIC must be told. Assessment inside 30 days, notification as soon as practicable. revenu's rule is simpler: you hear from Adam the day he knows.
• Penalties, and a new way to be suedSerious or repeated breaches carry penalties up to $50 million, three times the benefit, or 30 percent of turnover. Since 2025 an individual can also sue directly for a serious invasion of privacy. The exposure is no longer theoretical for a small business.
• The $3 million exemptionMost businesses under $3 million turnover are still exempt from the Privacy Act, with exceptions (health providers among them). Government has said it intends to narrow it. revenu runs every account as if it already has, so nothing changes for you when it does.
• Ransomware payment reportingUnder the Cyber Security Act, businesses over $3 million turnover must report a ransomware payment within 72 hours. The better position is never being the business that has to.
• Spam Act, email and SMSConsent, identify the sender, working unsubscribe. The platform enforces all three on every campaign and every automated text, so a workflow cannot send what the law would not allow.
• Sending on your own domainEmail goes out authenticated under your domain with SPF, DKIM and DMARC, set up at onboarding. It is what keeps you out of spam folders and stops someone else sending as you.
• Essential Eight, mappedThe ACSC's eight baseline controls. The platform covers four for your account: multi-factor sign in, patched applications, patched infrastructure, regular backups. Admin access is restricted by role. The remaining three sit on your own computers, and Adam will tell you plainly where you stand.

1. 01EncryptionTLS 1.2 or better for everything in transit. AES-256 for everything at rest. Passwords hashed, never stored as typed.
2. 02Access controlRoles decide what each person sees. Two-factor sign in can be enforced across the whole account. Single sign-on if you run it.
3. 03InfrastructureHosted on Google Cloud. Web application firewall and DDoS mitigation in front, hardened images and automated patching behind.
4. 04MonitoringContinuous logging and alerting on anomalies, error rates and attack patterns. Throttling and shutdowns kick in at set thresholds.
5. 05Backups and recoveryEncrypted backups on a schedule. A recycle bin brings back deleted contacts, deals, fields, tags and notes for thirty days. Pages keep version history.
6. 06Application securityCode review, static and dynamic analysis, gated deployments. Regular third-party penetration testing, automated vulnerability scanning and a responsible disclosure programme.

• What the agents can seeYour agents work inside your account only: your contacts, your calendar, your knowledge base. Nothing from another client, ever.
• Your data is not training dataThe model providers under the agents run on business terms. Your conversations are used to answer, not to train public models.
• Support that asks firstWhen you report a problem, Charlie can offer to look inside your account. He only looks after you say yes, or after Adam passes your issue on, and only for an email address with a login on that account. He shares only what that login can already see, and passes anything that looks like a security risk to Adam. He reads, never changes or exports anything, and notes what he checked on your record.
• Every reply is on the recordEach AI message sits in the same inbox thread as a human one. You can read it, correct it, or take the conversation over mid-sentence.
• He knows what he doesn't knowThe agents are told what they may say and when to hand to a person. A question outside the lines gets a human, not a guess.

• Support access is just in timeWhen platform support needs to look at an account, they request time-limited access. Every request is logged and expires on its own.
• What support can never doEven with access, support cannot change domain or sign-in settings, export your contacts or users, see or create API keys, import data, or delete contacts and deals. Those stay with you.
• People, not just systemsPlatform staff pass background checks before they start and do security training on a schedule. Company laptops are managed and fully encrypted.
• Everything is loggedSign-ins, staff access, security events and content changes are logged and kept for investigation. A small group of engineers can read the logs, nobody else.
• How cards are actually handledSave a card and the number goes to Stripe. The platform gets back a token and charges that token. The raw number never sits in the database, which is why the certified part is Stripe's and the workflow part is the platform's.
• Your keys, held by youThe account is in your business's name. Adam is a user you can remove in two clicks. Your contacts, content and numbers leave with you if you ever go.

• Does revenu hold its own SOC 2 certificate?No. The certifications on this page belong to the platform revenu builds on. revenu relies on those audited controls and adds its own operating rules on top: your keys, no shared data, Australian privacy obligations. If your IT person or accountant needs the documents, Adam can request the SIG Lite questionnaire or the audit summary from the platform.
• Where is my data stored?On Google Cloud, in the platform's infrastructure, with encrypted backups. Australian data residency is used where the platform offers it. Email us for the current region list before you sign if residency is a condition for you.
• Can Adam see my customers?Yes, while he is a user on your account, because he builds in it. He never exports, shares, analyses or markets to them, and you can remove his access at any time. That rule is in the terms.
• What happens if there is a breach?You hear from Adam as soon as he knows, with what happened, what was touched and what to do. revenu helps you meet the Notifiable Data Breaches scheme if it applies. No waiting for a quarterly report.
• Is my customer data kept in Australia?The platform is hosted on Google Cloud and uses Australian data residency where it is offered. Some services, like email delivery and the AI models, run through providers outside Australia under business terms and the Data Privacy Framework. If residency is a hard requirement for your business, tell Adam before you sign and he will show you the current region list rather than guess.
• Does the Privacy Act even apply to me under $3 million?Possibly not yet, unless you are a health provider or trade in personal information. It is being narrowed, and your customers do not read the exemption. revenu runs every account to the Privacy Principles regardless, so you are covered either way.
• Is an AI receptionist a security risk?Less than a shared inbox password. The agents run inside the same audited platform, only see your account, log every message, and hand over to a person when a question is outside what they were told to answer. The bigger risk in 2026 is the forgotten website on an unpatched server next door.

This page was reviewed and updated on 30 October 2026. For documentation requests or a specific compliance question, get in touch. Terms, privacy policy and AI policy are on the terms page.