Security & data residency

Consystence supervises and operates industrial equipment, so the way we handle your data is part of the product, not an afterthought. This page describes the concrete measures we build in. It complements our Privacy Policy andTerms of Service, and reflects a platform in early access — we call out what is architectural today and what is still maturing.

Data residency

Your platform data and your AI prompt content are processed in Australia by default.

Platform data: Hosted in Azure Australia East — accounts, tenant data, the provenance historian, and operational records.
AI inference: Production advisory inference runs on AWS Bedrock in Australia — Sydney (ap-southeast-2), with routing constrained to Australian regions. A direct Anthropic US path exists but is disabled by default.
On-premises: The site server runs on your own infrastructure. For strict or air-gapped sites the AI tier can be disabled entirely, keeping everything on-site.
Cross-border: Billing (Stripe), website contact-form email (Resend), Cloudflare's global network, and Microsoft identity operate overseas. See the subprocessor register.

How your data is protected

Single-tenant isolation is architectural. Each organisation's tenant runs against its own isolated data; an account never spans a tenant boundary, and internal infrastructure host names never appear in customer-facing URLs, emails, or tokens.
Encryption in transit (TLS) across every service.
Credentials are never stored in a usable form. Site PINs are salted and hashed (PBKDF2), programmatic API keys are HMAC-hashed with a separately-held pepper, and invitation and activation codes are stored as one-time SHA-256 hashes — with constant-time comparison throughout. Plaintext secrets are shown once and never retained.
Secrets at rest are encrypted with rotating data-protection keys.
Defensive session handling — HttpOnly, SameSite session cookies, failed-sign-in lockout, and rate limiting on authentication.

Identity and access

Sign-in is delegated to Microsoft Entra External ID (OpenID Connect) — we never see or store your password. Identity is keyed on your stable Microsoft object identifier, not an email string. Cloud and on-site authentication are two independent authorities by design: no site credential (such as an operator PIN) can ever authenticate cloud access, and no cloud credential reaches into a site. Access within an organisation is role-based (owner, admin, member), enforced server-side on every privileged action.

Advisory-only AI

It advises; it does not act. The AI tier reads plant state and recommends — it has no pathway to command equipment. Every command and every code deployment requires an explicit human confirmation the AI cannot bypass, and all control actions reach equipment only through your controllers on their established deterministic paths.
Processed in Australia, by default. As above, production inference runs on AWS in Australia.
Never trained on your data. We do not use your data or prompts to train machine-learning models, and our model providers operate under API terms that do not permit training on customer content.
Content-minimising audit. Our AI gateway holds no database, authenticates to AWS with short-lived federated credentials (never static keys), and its audit trail records cryptographic hashes of prompts and completions — never the text — with token and cost metering.

Operational accountability

Because the platform operates plant, it records who did what: equipment commands, alarm acknowledgements, and AI usage are attributed to the acting user, giving your organisation a durable operational audit trail. These records are described in thePrivacy Policy.

Compliance and assurance

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we assess suspected breaches under the Notifiable Data Breaches scheme. Our in-Australia residency and on-premises/air-gapped options are designed to support customers in critical-infrastructure sectors — such as mining and water — that carry their own regulatory obligations.

In the interest of being straight with you: Consystence is in early access and does not yet hold formal third-party certifications such as ISO 27001 or SOC 2. We are happy to walk enterprise security teams through our architecture and controls in detail — contact us below.

Reporting a vulnerability

If you believe you have found a security vulnerability, please tell us at[email protected]. We welcome good-faith reports, will acknowledge them, and ask that you give us a reasonable opportunity to remediate before any public disclosure. Please do not run intrusive testing against production tenants or other customers' data.

Subprocessor register — who processes data on our behalf, and where.
Privacy Policy — what we collect and how we handle it.
Terms of Service — including the industrial-safety responsibility model.