Data processing addendum

Your firm is the data controller. Halo Ai Technologies is the data processor for personal information you place into the service.

A current list of subprocessors is maintained at haloai.com.au/subprocessors. We will give you fifteen business days notice of any change. All subprocessors are bound by terms at least as protective as these.

Your data is stored on Australian infrastructure, with backup replicas also within Australia. A limited set of features transfer specific data to subprocessors outside Australia: the text of your documents for search indexing, a sanitised query for optional web research, and billing and email handling. Each of these subprocessors is named in the list referenced above.

AES 256 encryption at rest. TLS 1.3 in transit. Row level access controls scoped per Job and per user. Continuous audit logging. Annual penetration testing.

We will notify your security contact within 24 hours of confirming any incident that may have affected your data.

On reasonable notice and not more than once per year, you may audit our processing of your data, or designate an independent auditor to do so. Costs are borne by you unless a material non compliance is found.