Security & data protection
Your clients’ data deserves the same care as your advice
AML Mate uses Australian database and document storage, business-scoped access and identity masking for AI features. Some service providers may process information outside Australia. Here is how these protections work, what they cover and where your practice remains responsible.
Explore the safeguardsReviewed
Product description and linked sources. Not an independent security audit.
Where is your data stored?
Account data, client records and uploaded client documents are stored with Supabase in Sydney, Australia (AWS ap-southeast-2). Storage location and third-party processing are different things.
Australian primary storage
Our database and client document storage use the Sydney region. Supabase provides the database, authentication and file storage services. We do not sell client information or use it for our own marketing.
Other services have their own data flows
Providers used for hosting, payments, identity checks, AI and analytics may process information outside Australia. The Privacy Policy describes these providers and overseas disclosure.
Encrypted connections
The public service uses HTTPS to encrypt traffic between your browser and AML Mate. Supabase also documents encryption at rest and in transit for its hosted services.
Who can access client records?
Client record and document requests are checked on the server against the signed-in user and their business. A client ID or file path alone does not grant access.
Business-scoped access
Workspace permissions and business ownership checks control access to client records. Manage team membership carefully and remove access when someone leaves your practice.
Private client documents
Uploaded client documents use private storage. An authorised document download receives a signed link that expires after 60 seconds. Treat downloaded copies as sensitive records too.
Managed sign-in
Supabase Auth handles password hashing and sessions. Protected server routes verify the user before applying business and permission checks. Use an individual account for each team member.
What information reaches AI?
AI-assisted guidance and drafting use Google Gemini. The application masks known client identifiers and common personal-information patterns, and uses presence flags in structured identity fields where only completeness is needed.
Reduce identifying details
Structured identity values can be replaced with a presence flag. Known names and common email, date, phone and long-number patterns in free text are masked before model requests.
Keep the relevant context
Guidance can still use details such as client type, occupation, nationality, risk factors and transaction amounts. This is data minimisation, not a guarantee that a narrative is anonymous.
Review the answer
AI output is guidance to check against your records and applicable requirements. It does not make the compliance decision for your practice.
Automated masking has limits. Do not paste unnecessary client identities, document images or confidential material into chat. Under Google's paid Gemini API terms, prompts and responses are not used to improve its products, but limited safety logging and overseas processing can still occur.
Screening is separate from AI drafting
Sanctions and PEP screening need identifying information to match a client against source records. The AI masking controls do not mean identity information is withheld from screening or identity-verification providers.
Sanctions and PEP checks
DFAT sanctions data and OpenSanctions PEP data support screening. OpenSanctions queries can include a client name, nationality and date of birth. Potential matches need review.
A failed check is not a clear result
If a sanctions or PEP source fails and no match is found, the screening result is marked as an error rather than clear. A returned match remains visible even if another source fails. No screening service can guarantee every match will be found.
Identity and adverse media
Hosted identity verification uses Stripe Identity. Optional RapidID checks are available where enabled. These services process identity details for verification. Automated adverse-media screening is not provided; the product prompts a manual review.
What happens when you export or leave?
Export the records your practice needs before deleting a client or closing the workspace. Deleting data from AML Mate does not remove your own record-keeping responsibilities.
Export before deletion
The dashboard provides client CSV exports and document/report exports, subject to the relevant access and plan conditions. Program and Audit Pack downloads unlock with your first payment.
ID-document images
The retention job targets uploaded ID-document images after 90 days from CDD completion, or 365 days from upload if CDD is never completed. Verification metadata is kept separately. These are product retention windows, not statutory deadlines for every document.
AI conversation history
Stored AI conversations become eligible for deletion by the scheduled retention job after 12 months. This is separate from any processing or retention by AI service providers.
Your account and your team
Deleting your account removes your team membership. When the last member deletes their account, the application also deletes the team's business and client data. A remaining team keeps its workspace. The local account record is scheduled for removal or de-identification after 30 days.
Understand whose assurance you are reading
AML Mate does not hold its own SOC 2 or ISO 27001 certification. Our infrastructure providers publish their own assurance information. Their certifications do not certify AML Mate or your practice.
Supabase
Database, authentication and storage. Publishes SOC 2 Type 2 and ISO 27001 assurance information.
Vercel
Application hosting. Publishes SOC 2 Type 2 and ISO 27001 assurance information.
Stripe
Payments and hosted identity verification. Stripe reports PCI Service Provider Level 1 certification for its payment infrastructure; this is not an identity-verification guarantee.
Amazon Web Services
Underlying Sydney infrastructure for our Supabase storage. AWS publishes compliance programs and service-specific assurance scope.
We monitor application errors to help investigate failures. Our Privacy Policy sets out breach-response commitments. Where the Notifiable Data Breaches scheme applies, eligible breaches require notification to affected individuals and the OAIC.
Report a security issue
Email support@amlmate.com.au with a description of the issue and steps to reproduce it. Please do not include passwords, full identity documents or client records in your first message. We can discuss an appropriate way to share further details.
support@amlmate.com.auTake a closer look at AML Mate
Explore the workspace or check which services may be covered.