Operator: Customer Experience Insight Pty Ltd (ABN 61 634 039 759) trading as WA AI Hub
Contact: our contact form
Current notices
No incidents to report as at 11 November 2026.
1. Our safety and security framework
We publish how the Service handles information in our Privacy Policy, Terms of Service, AI Disclaimer, Children's Policy and Accessibility statement.
The protections in place include:
- Sign-in is handled by a dedicated identity provider. Sovereign accounts sign in with an emailed code instead.
- Accounts lock after repeated failed sign-in attempts, and sign-up is protected by an automated bot check.
- Requests to generate content are rate limited.
- Transport security headers tell browsers to use only HTTPS.
- GitHub and Figma access tokens are encrypted before storage.
- Uploads are checked for size, type and length before they are processed.
- Text you supply is marked as data, not instructions, before it is sent to an AI model, as a guard against prompt injection.
- Likely passwords and keys are removed from repository files before Build sends them to an AI model.
- Nothing is written to your repository until you review and apply it.
- Changes to a team are recorded in the team's activity log.
- A daily job deletes old work in workspaces that have chosen automatic deletion.
- Tests and a dependency check run on every change.
This is a description of how the service is built. It is not a certification.
2. AI models and independent evaluation
The Service uses third-party AI models to research, write and edit personas, journeys, templates, requirement documents and prototypes, to read text in images you upload, to generate images, narration and music, and to propose code changes in Build. No person reviews individual outputs before you see them.
No independent third party has evaluated this product or the way it uses AI. There has been no outside audit, certification or penetration test. We will update this page if that changes.
The companies that build the models we use publish their own safety evaluations. Those are their evaluations of their models, not an evaluation of this product.
Our own checks:
- Automated tests, type checks and lint on every change.
- A dependency check for known vulnerabilities on every change.
- Tests of the prompt-injection guard.
- Tests that a Sovereign request can only use the Australian-hosted AI service.
These are run by us and are not independent.
3. Who can access your data
You and your organisation
Your work is kept in your own workspace or in a team workspace. Only you can open your own workspace. Members of a team can see the team's items, and what each member can do depends on their team role. This is enforced by the application. We do not currently offer a second sign-in step (two-factor authentication) of our own.
Us
One person, the owner of the business, can access production systems and data. There are no other staff or contractors with access.
There is no feature that lets us sign in as you. An administrator can join a team to view it. When that happens, the team's members can see the administrator in the team, and it is recorded in the team's activity log.
Our subcontractors
Some of our subcontractors process your information to provide the service. Section 4 lists them by function.
4. Our subcontractors and their boundaries
| Function | What it handles | Where |
|---|---|---|
| Website hosting | All requests to the Service while they are processed, and short-lived logs | Australia (Sydney). The provider is based in the United States, and its logs and support systems may be held there |
| Database | Your library, products, prototypes, teams, Build sessions, credits and plan records | Australia (Sydney) |
| Sign-in and account management | Name, email address, sign-in method, profile image, IP address and device information | United States |
| Sign-in for Sovereign accounts | Email address, name, sign-in sessions and one-time codes | Australia (Sydney), in our own database |
| Payments (paid plans only) | Name, email address and billing details. Card details go straight to the processor | United States and other countries where the processor operates |
| Primary AI text generation | The content you submit and the documents you create or edit | Singapore (storage). Processing may happen in other countries, which may include mainland China |
| Backup AI text generation | The same as the primary AI text-generation service | United States and other countries where those providers operate |
| Web research | Your idea description only, never uploaded files | United States and other countries where those providers operate |
| AI image reading | Images and scanned PDFs you upload | United States and other countries where the provider operates |
| AI media generation (images, narration, music) | Generated persona and journey content | United States and other countries where the provider operates |
| Australian-hosted AI coding service (Build) | Your Build messages, the repository's file list and up to 15 files per request, and your persona and journey | Australia (Sydney and Melbourne). The provider is based in the United States |
| Premium AI coding models (Build, only when you turn them on) | The same as the Australian-hosted AI coding service | United States and other countries where those providers operate |
| Australian-hosted AI text and image reading (Sovereign add-on only) | The same as the primary AI text-generation and image-reading services | Australia (Sydney only). The provider is based in the United States |
| Email delivery | Email address and the message sent | Not stated |
| Contact form handling | What you enter in the contact form | Not stated |
| GitHub (only if you connect it) | Your GitHub identity, the documents you choose to commit, and the repositories you ask us to read | United States |
| Figma (only if you connect it) | The link of each file you ask us to import | United States |
Every subcontractor is engaged on its standard published terms. We have not negotiated separate agreements with them and we do not audit them; we rely on the commitments they publish. A named list is available on request.
The limits we apply ourselves:
- Our application and database are pinned to the Sydney region.
- In a workspace with the Sovereign add-on, writing, editing, template, image-reading and code-trace-suggestion work is done only by the Australian-hosted AI service. If it is unavailable, the request fails. We do not fall back to an overseas service. Web research, portraits, scene images, music, narration, payments and our hosting provider's logs still leave Australia.
- Build uses the Australian-hosted AI coding service unless you turn on a model outside Australia for a session.
- Web-research services receive only your idea description, never uploaded files.
- Likely passwords and keys are removed from repository files before Build sends them.
- Evidence Snap removes email addresses and phone numbers before a report is stored. It does not detect names or health information.
- We do not use your content to train AI models. We cannot make the same promise for every provider. The web-research services may keep your idea description and use it to train or improve their AI models. Our AI text-generation services either have terms that allow this or have not confirmed in writing that they do not. For the Australian-hosted AI services, the provider's published terms state that it does not keep your prompts or results and does not use them to train models.
5. How quickly we would tell you about an incident
If personal information we hold is lost, or accessed or disclosed without authorisation, we will begin assessing it within 72 hours of becoming aware of it. If the incident is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as soon as practicable, and no later than 30 days after becoming aware. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours where that law requires it.
This service is run by one person. There is no round-the-clock on-call team, so an incident that happens overnight or while the owner is travelling may not be seen immediately.
6. How an incident would reach you
- Account holders, including team members: we will email the address on the account.
- People who test a shared prototype, and people who leave an Evidence Snap report on a customer's site: we hold no contact details for them, so we cannot reach them directly.
If we hold no contact details for you, look at the Current notices section at the top of this page. We will post a dated notice there.
We may also post a notice on the What's new page.
To report a problem to us: use our contact form.
7. What we don't publish, and why
We do not publish the prompts, scoring and ranking methods, pricing logic, abuse-detection rules or model files behind this product, or the findings of our internal reviews. Publishing them would make the service easier to copy or to attack. Where we describe a method publicly, the description is linked above.