Australian hosting
The platform runs in Microsoft Azure’s Australia East region.
Trust centre
What is in place, what is in progress, and how to check it.
Your clients trust you with their records. This page shows where each certification stands and how to request the documents behind it.
Last reviewed 28 October 2026
Where each certification stands.
We don't wear badges we haven't earned. Here is where our security programme stands. We update it as each milestone lands.
Practitioner sign-off
Nothing reaches a client or the ATO without a registered practitioner’s sign-off.
ISO/IEC 27001:2022
Our information security management system is being built to the standard.
ATO Digital Service Provider
Registered with the ATO as a Digital Service Provider. The Operational Security Framework assessment is in progress. Not yet approved for production lodgement.
Independent penetration test
An independent firm tests the platform before public launch.
SOC 2
A SOC 2 examination is on our certification roadmap. It is not held today.
Four
commitments.
01
We never train general models on your client data
Your clients’ books make your practice’s AI accountants better at serving your clients. They are never used to train models that serve anyone else.
02
Nothing lodges without a registered practitioner’s sign-off
There is no autonomous path to the ATO. Every lodgement passes a named human approval gate. That is an architectural constraint, not a setting.
03
Your data stays in Australia, and so does access to it
The platform runs in Microsoft Azure’s Australia East region. Client financial data is not shipped offshore for processing or storage, and access to production is limited to team members located in Australia.
04
We never sell or share your data
No data brokers, no advertising use, no sharing with third parties beyond the infrastructure required to run the service.
How we protect your data.
These are the controls we run. The policies and evidence behind them are available on request.
Hosting and network
- Application servers and databases run in Australia.
- A web application firewall sits in front of the app and the API, with TLS 1.3 as the minimum.
- Production servers accept traffic only through that firewall.
Access
- Production access is limited to named team members located in Australia, on a need-to-know basis.
- Every grant of access is approved, and all access is reviewed every six months.
- Every staff account signs in with multi-factor authentication.
- Each practice is a separate tenant, with role-based access inside it.
- The public demo is read-only, enforced on the server.
Monitoring and audit
- Every action in AccuMate is recorded against the one named person who took it.
- Audit records are kept for at least 12 months.
- When our team works inside a practice’s account to give support, the start and end are recorded, and every action carries their name.
- Production runs threat detection, and alerts go to a named owner.
AI
- AI model calls for production are processed in Australia.
- Client data is never used to train general AI models.
People and resilience
- Every team member signs a confidentiality agreement.
- Written information security policies, each with a named owner.
- Database backups are kept, and restore was tested in September 2026.
Each rule, and our answer.
Using AI doesn't change who answers to the TPB, the ATO and your clients. You do. So here is each rule, and what AccuMate does about it.
01TPB draft AI guidance: TPB(I) D62/2026
Using AI never reduces or transfers your responsibility. The registered practitioner stays fully accountable for the accuracy and quality of every service, and confidentiality obligations follow client data into any AI tool.
Read the sourceHow AccuMate answers it
- Three named practitioner sign-off gates: nothing reaches a client or the ATO without your approval
- Client consent captured at onboarding before their data enters the platform
- A full audit trail of every AI action, reviewable at any time
02ATO Digital Service Provider framework
Software that interacts with ATO systems must meet the Operational Security Framework: ISO 27001-grade controls before direct lodgement is allowed.
Read the sourceHow AccuMate answers it
- Registered with the ATO as a Digital Service Provider
- Operational Security Framework assessment in progress, and direct lodgement waits for it
03Privacy Act & Australian Privacy Principles
Personal and financial information must be protected, handled transparently, and kept under appropriate control.
Read the sourceHow AccuMate answers it
- Australian data residency, hosted in Azure Australia East
- Per-practice tenant isolation: your clients’ data is never visible to another firm
- We never train general AI models on your client data
04APES 110 Code of Ethics
Independence, confidentiality, and professional competence sit with the member. They cannot be delegated to software.
Read the sourceHow AccuMate answers it
- AI drafts, and a registered practitioner approves
- White-labelled under your firm’s brand, so your client relationship stays yours
- Per-practice tenancy and role-based access inside the practice
TPB(I) D62/2026 is an exposure draft (consultation closed April 2026). We track it as it is finalised and will keep this page current.
Documents.
Some documents are public. The rest we share with practices on request.
- Privacy policyHow we collect and handle personal information.Public
- Information security policiesThe policies our security programme runs on.On request
- Architecture and data-flow overviewWhere client data goes, and what touches it.On request
- Subprocessor listEach service we use, what it does, and where it runs.On request
- Your security questionnaireSend us yours. We answer it.On request
- Security whitepaperBefore public launch (February 2027).Not yet available
- Penetration test summaryAvailable after the test, before public launch (February 2027).Not yet available
- ISO/IEC 27001 certificateAvailable once issued.Not yet available
Request documents.
Email it@accumate.ai with your name, your practice and the documents you need.
Updates.
Changes to our security programme, newest first.
Trust centre published
This page replaces /security. It shows where each certification stands and how to request our security documents.
Report a security issue.
If you find a security problem in AccuMate, email it@accumate.ai. Please give us time to fix it before you share it publicly.
Ask us what this page does not answer.
Email it@accumate.ai with any security question.
Trust it with one client first.
AccuMate is invite-only while we work closely with a small number of Australian practices. The pilot is free for three months during alpha, and we reply to every request within 48 hours.