Privacy Policy | Consystence

1. Who we are and what this policy covers

Consystence Pty Ltd (ABN 88 683 701 359) ("Consystence", "we", "us", "our") provides an industrial operations platform for monitoring and operating industrial facilities. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy covers the services we operate:

this website (consystence.com) and our documentation and status sites;
the account service at account.consystence.com, including sign-in through id.consystence.com;
cloud-hosted tenant environments at yourorg.consystence.com andyourorg.consystence.dev;
our AI advisory services;
the Consystence software you run yourself — the site server, edge runtime, andcsy command-line client.

Two roles, two kinds of data. We collect some personal information for our own purposes (your account, billing, and website enquiries). Separately, the platform processes industrial and operational data — and the personal information embedded in it, such as operator identities on audit records — on behalf of the customer organisation that owns the tenant. That organisation controls that data; we process it to provide the service, on its instructions. Where Consystence software runs on your own servers, the data it holds stays on your infrastructure and under your control unless you configure it to sync to your cloud tenant.

2. Personal information we collect

Account and sign-in

Sign-in is provided by Microsoft Entra External ID at id.consystence.com. We never see or store your password. When you sign in, our account service stores a directory record keyed on your stable Microsoft identifier (the oid) together with your email address, account type, status, and creation date. We do not store your sign-in tokens server-side.

Organisations, invitations, and roles

When you create or join an organisation we record the organisation name (free text you choose), your membership and role (owner, admin, or member), and which tenants your account may access. If an owner invites someone by email, we store the invitee's email address together with a hashed one-time invitation token; pending invitation emails are visible only to the organisation owner. Delivery of the invitation link is up to the inviter — we do not send it.

Billing

Payments are processed by Stripe. We pass your account email address to Stripe when you first check out, and we store the resulting Stripe customer and subscription identifiers, subscription status, and billing-period dates. We never receive or store card numbers. Our webhook records keep only an event id, type, and timestamp — not the payload.

Site operator accounts (held on your site server)

Site servers support local operator accounts for offline-capable sign-in: email address, display name, role, a salted PBKDF2 hash of the numeric site PIN (never the PIN itself), verification and lockout state, and per-session records that include the session's IP address and browser user-agent. This store lives in the site server's own database — on infrastructure operated by the customer organisation, which administers these accounts. One-time email verification codes are held in memory only and expire within minutes.

Operational records that identify users

To provide accountability for industrial operations, the platform records who did what:

Command audit: every equipment command records the executing user's identifier, the command, its parameters and tag writes, timestamp, and outcome. Each organisation's audit trail keeps the most recent 10,000 entries.
Alarm acknowledgements: the acknowledging user's identifier is stored with the event in the historian. This field is not synced to the cloud.
AI usage metering: per-request records of tenant, site, user identifier, model, token counts, and cost — aggregated into monthly usage and retained for 12 months. No prompt or response text is included.
API keys: we store a peppered hash of each key (the plaintext is shown once and never kept), plus its label, creator, expiry, and last-used time.

Plant and process data

Telemetry from industrial equipment — tag values, historian time-series, alarms, process models — is customer data processed on the owning organisation's behalf. It is not normally personal information, though it can identify operators where your organisation embeds identities in it (for example, acknowledgement records above).

AI advisory content

When your organisation uses the AI advisory tier, prompts sent to the model include the operator's typed messages, the site and organisation identifiers, the operator's role, and live plant state fetched by the assistant's read-only tools. Conversation context is held in memory for the session only. Our AI gateway's audit trail storescryptographic hashes of prompts and completions — never the text — together with token counts, model, region, and cost. See section 4.

Website, documentation, and enquiries

If you use the contact form we collect your email, name, company, phone, and message, and deliver it to our sales inbox via an email-delivery provider; we do not store the submission in a database. Our documentation and status sites set no cookies and run no analytics. Website analytics on consystence.com is cookieless and aggregate-only (see section 11).

Service logs

Our cloud services keep structured operational logs (which can include user identifiers appearing in audited actions) for approximately 30 days. Sign-in endpoints apply IP-address-based rate limiting transiently; our account service does not log or store visitor IP addresses.

The csy command-line client

The CLI stores its configuration on your machine (~/.consystence/config.json), including access and refresh tokens; storage of refresh tokens in your operating system keyring is planned. This data stays on your device.

3. How we use personal information

to provide, operate, secure, and support the platform;
to authenticate you and enforce role-based access and tenant isolation;
to maintain the operational audit records described above;
to administer subscriptions, licences, and billing;
to send service communications to your account email (for example, security notices or expiring API-key reminders) — we do not send marketing email;
to respond to enquiries and support requests;
to monitor, troubleshoot, and improve service reliability and security;
to comply with legal obligations.

We do not sell personal information, and we do not use it for advertising.

4. AI processing

Advisory-only by design. The AI tier reads and explains; it has no pathway to command equipment.
Where inference runs. Our production advisory path runs on AWS Bedrock in Australia — anchored in Sydney (ap-southeast-2), with inference routing constrained to Australian regions — so prompt content is processed in Australia. A direct integration with Anthropic's API (served from the United States) exists as a configurable path and is disabled by default in production; where a tenant's configuration enables it, prompt content is processed in the United States.
What we keep. Hash-only audit records and token-level usage metering, as described in section 2. We do not store prompt or completion text.
No model training. We do not use your data or prompts to train machine-learning models, and we engage model providers under API terms that do not permit them to train on customer content.

5. Who we share personal information with

We share personal information only with the service providers that run the platform. The current, maintained list — with each provider's purpose, the data it handles, and where it operates — is our subprocessor register:

Microsoft Azure — cloud hosting for customer platform data, in the Australia East region.
Microsoft Entra External ID — sign-in and identity for cloud accounts.
Stripe — payment processing (receives your billing email).
Amazon Web Services — AI model inference via Bedrock in Sydney.
Anthropic — AI models (served via AWS Bedrock in Australia; via Anthropic's US-hosted API only where that path is enabled).
Cloudflare — DNS, content delivery, hosting for our websites, and cookieless web analytics.
Resend — email delivery for website contact-form enquiries.

Within the platform, your organisation's owners and admins can see the membership roster (member identifiers and emails) and audit records for their organisation. When an organisation provisions a tenant, the first administrator's email and identifier are passed to the tenant environment to seed access. We may also disclose personal information where required by law, or as part of a corporate transaction with safeguards.

6. Overseas disclosure

Customer platform data is hosted in Azure Australia East, and production AI inference runs in AWS Sydney. The disclosed overseas flows are: Stripe (billing, United States); Resend (contact-form email delivery, United States); Cloudflare (global network; aggregate, non-identifying analytics that may be processed in the United States); Microsoft (identity services); and Anthropic's US-hosted API where a tenant enables that AI path. We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.

7. Security

Concrete measures we build in, rather than generic assurances:

single-tenant isolation is architectural: each organisation's tenant runs against its own isolated data, an account never spans it, and internal host names never appear in customer-facing surfaces;
encryption in transit (TLS) across all services;
credentials are never stored usable: site PINs are salted-and-hashed (PBKDF2), API keys are HMAC-hashed with a separately-stored pepper, invitation and activation tokens are stored as one-time SHA-256 hashes, and comparisons are constant-time;
secrets at rest are encrypted with rotating data-protection keys;
our AI gateway holds no database, authenticates AWS by short-lived federated credentials (no static cloud keys), and audits by content hash only;
the authenticated console loads no third-party scripts, fonts, or CDNs, and ships a strict content-security policy;
failed sign-in lockouts, rate limiting, and same-site, HttpOnly session cookies.

No system is perfectly secure; we cannot guarantee absolute security.

8. Retention

Account directory records: kept while your account is active (see section 9 for deletion requests).
Command audit: most recent 10,000 entries per organisation.
AI usage metering: 12 months of billing periods.
Cloud service logs: approximately 30 days.
Spent invitation, activation, and revoked API-key records: retained in hashed form as audit evidence.
Historian and plant data: retained under the owning organisation's configuration; organisations can request a complete tenant-wide purge.
Billing records: retained as required by tax and accounting law.

When a tenant is deleted, its directory entry, account-to-tenant associations, and elevated roles are removed immediately. Deletion of associated operational stores is completed on request as part of offboarding.

9. Access, correction, and deletion

You may request access to or correction of the personal information we hold about you, and you may request deletion of your account. Contact[email protected] and we will respond within a reasonable period, verify your identity, and action the request unless we are required to retain specific records (for example, billing or safety-relevant audit entries, which we will tell you about).

For personal information embedded in a customer organisation's data — such as operator accounts and audit records in that organisation's tenant — please direct your request to that organisation; we will assist it in responding.

If you believe we have mishandled your personal information, complain to us first and we will investigate. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Data breaches

We assess suspected breaches under the Notifiable Data Breaches scheme and will notify affected individuals and the OAIC where a breach is likely to result in serious harm. Where a breach affects a customer organisation's tenant, we will notify that organisation promptly so it can meet its own obligations.

11. Cookies and analytics

consystence.com sets no first-party tracking cookies. Analytics is Cloudflare Web Analytics: cookieless, no fingerprinting, aggregate page-view data only (which Cloudflare may process outside Australia). Fonts are served from this site's own domain — visiting it makes no requests to third-party font services.
docs.consystence.com and status.consystence.com set no cookies and run no analytics.
account.consystence.com sets one first-party session cookie (consystence.account; HttpOnly, Secure, SameSite=Lax, 8-hour sliding expiry) plus a first-party load-balancer affinity cookie (acaAffinity) set by its hosting platform's ingress, and loads nothing from third parties.
Tenant environments set one first-party session cookie (csy_session; HttpOnly, Secure, SameSite=Lax) holding an opaque random identifier.

12. Sensitive information and children

We do not seek to collect sensitive information (such as health or biometric data), and our services are directed at industrial organisations and their personnel, not children.

13. Changes to this policy

We will post updates to this page and revise the date above. For material changes affecting platform customers, we will notify organisation owners at their account email.

14. Contact

Privacy questions and requests:[email protected], or by post: Consystence Pty Ltd, GPO Box 2120, Brisbane QLD 4001, Australia.