Trust centre
Security you can put in front of your board.
Diolog is purpose-built AI for investor communications. The security, privacy and AI governance behind it are documented here, with the full policy set available on request.
Where your data lives, and how it is protected.
The controls a security or diligence reviewer asks about first.
| Area | What we do |
|---|---|
| Certification | ISO/IEC 27001:2022 certified (Global Compliance Certification). ISO 27001 |
| Data location | Customer data is stored in Australia under our customer agreement Agreement 7.3.4, on cloud infrastructure located in Australia Agreement 4.1.2. Providers that process it are listed below. |
| Encryption at rest | All customer data and backups are encrypted at rest by default with MongoDB Atlas. |
| Encryption in transit | Data is encrypted in transit using TLS. |
| Investor communications | Private to the company it is sent to. Staff access for support is limited, and the security pack describes it. |
| Model training | Our customer agreement limits us and our providers to using your data, prompts and outputs only to provide the service Agreement 7.1.3. Content goes to a model provider only as far as the task needs. |
Where each claim comes from.
Every claim on this site that a reviewer would rely on links here. The documents themselves are in the security pack.
- ISO 27001ISO/IEC 27001:2022 certificateIssued by Global Compliance Certification. The certificate names its scope; the security pack carries it in full.
- Agreement 4.1.2General customer terms, clause 4.1.2Diolog provides hosting on cloud infrastructure located in Australia.
- Agreement 7.3.4General customer terms, clause 7.3.4Customer data, AI inputs and AI outputs within Diolog and its sub-processors' control are stored in Australia.
- Agreement 7.1.3General customer terms, clause 7.1.3Neither Diolog nor its sub-processors may use customer data, AI inputs or outputs except to provide the service.
Five areas of control.
Run under our ISO 27001 information security management system.
Infrastructure security
The systems the workspace runs on - scoped, hardened and monitored.
Organisational security
Policies, roles and the internal governance that keeps the programme accountable.
Product security
Authentication, access and the controls around your workspace.
Internal security procedures
Onboarding, access reviews and incident response.
Data and privacy
Handled, minimised and protected under the Privacy Act and the APPs.
AI that is grounded and answerable to you.
The drafting and review agents are useful precisely because they are constrained.
| Principle | How it works |
|---|---|
| Grounded | Outputs draw from your knowledge base, your public record and the regulatory feeds you approve - nothing else. |
| Answerable | Diolog surfaces risk and uncertainty rather than asserting a compliance call is settled. Judgement stays with your team. |
| Human sign-off | What Diolog writes is a draft for review. Replies and releases wait for your team's approval. |
| Audited | Every draft, edit, approval and send is logged against the person who made it. |
Who we rely on.
The third parties in scope for the service, and what each is used for.
| Category | Provider | Used for |
|---|---|---|
| Cloud infrastructure | Amazon Web Services | Cloud provider |
| Data storage | MongoDB Atlas | Data storage and processing |
| AI and model providers | Anthropic, Google, OpenAI | Drafting, checking and answering, under enterprise terms |
| Email and notifications | Listed in the security pack | Transactional email delivery |
| Identity and authentication | Listed in the security pack | Sign-in and single sign-on |
Common questions.
Is our data used to train AI models?
No. We use enterprise APIs with zero-retention settings where available, and we do not opt in to sharing your data for training public models.
How do you stop the AI making things up?
Diolog retrieves passages from your approved documents before it answers, cites them, and says when it cannot find a source rather than guessing.
Where is our data stored?
In Australia, with encryption at rest and in transit. AI model providers may process a request elsewhere; each one is listed in the providers table.
Can Diolog staff read investor questions?
Investor communication is private to the company it is sent to. Support access is limited, and the security pack describes when it happens.
Request our security documentation.
Our policies and reports are available to customers and prospects under review.
We'll send the documents under NDA within two business days.