Know where your work lives, and who can see it.

Each organisation's data is kept apart by access rules enforced in the database, and the app checks them again. Every day, automated tests try to reach one organisation's data from another's account.

Inside your organisation, you decide who sees what:

• Roles and permissions: owners, admins, team leads, members, editors and viewers, with permissions on each item when you need them.
• Signing in: two-step sign-in for every account, and single sign-on with Entra ID, Okta or Google Workspace on Pro and Enterprise.
• Keys for agents and tools: each key is limited to the workspaces, projects, folders and permissions you choose. Every call is recorded against its key, and you can revoke a key at any time.
• Agents: a job never goes beyond what the person who started it could do. By default, an agent sends an email only after someone approves that exact message.
• Every change has a name: history and audit for every database record, and an activity log for every connector, on every plan. Enterprise adds organisation audit logs.

Our Security and access guide shows how access is decided in each part of Stable Baseline, with pictures.

Only named people in our company who need it to run and support the service can reach your data. They must use two-step sign-in for administrative access, and sign in again before any destructive operation.

Encryption

Every connection is encrypted in transit, with TLS 1.3 on every endpoint. HTTPS is enforced with HSTS, so browsers use only secure connections. Your content is encrypted where it's stored, and sign-in tokens, keys and other secrets are stored encrypted.

Most of what you keep can be opened only by signing in. A few things open with a link, such as your profile picture, and exports for a limited time. Our Privacy Policy lists them.

Your content is never used to train AI models, ours or anyone else's.

When you use Orbit, an agent or another AI feature, the AI model gets what that piece of work needs: your instructions and the relevant content. Orbit answers only from what you can open.

Our AI, including Orbit, agents, the AI that works on documents and diagrams, and the company brain, processes your content and runs its models in Australia. Pictures you make or change with our AI are processed outside Australia.

Your organisation can connect its own AI provider account. That work is handled by your provider, under its terms. If your provider can't do a piece of work, that work stops: we don't send it to our own AI instead. We store your key encrypted and use it only for your organisation's requests.

On Enterprise, the company brain shows each person only what they may open, and never reads connected mailboxes.

The company brain's facts and answers are AI estimates made from your content, and they can be wrong. Your organisation checks them before it acts on them, and is responsible for what it does on their basis. Switching the brain on, or using it, means accepting that: our Terms of Service have the detail.

We don't use AI to make decisions about you or your people.

Our own systems protect the service: our limits refuse or queue work that goes over them, and a connector that keeps failing pauses itself. Ending someone's access is always a person's decision. Our Privacy Policy explains what these checks use.

If your organisation uses agents

Agents work for your organisation, so the decisions they make or help make are your organisation's. If you use them to decide things about people, such as approving a refund or answering an application, you may need to say so in your own privacy policy. In Australia, many businesses must describe these decisions in their privacy policy from 10 December 2026.

To help you describe them, this is what an agent can use and do:

• What it reads: the message or record in front of it (who sent it, who received it, what it says, and up to 4 pictures in it), its notes on the conversation, the documents and records your organisation lets it read and, unless it sends replies on its own, other messages in the mailbox.
• What it can do: sort and summarise messages, draft and send replies, update records and start other work, within the access and approvals your organisation sets.
• Who checks it: by default, a person approves each email before it's sent, and your organisation can see, check and undo what an agent did.

Our Terms of Service don't allow anyone to use agents or other AI features to make a decision with a legal or similarly significant effect on a person, such as about their job, credit, housing or insurance, unless a person makes the final decision. The same care applies to the company brain: its facts are estimates, so check them before they help decide anything about a person.

These options are for Enterprise customers, by agreement.

Dedicated database

By agreement, we run a dedicated database for your organisation: your organisation's data and files in a database of its own, in Australia, reachable only through a private network. Sign-in, the app's services, AI and live editing stay on our shared service.

Your own encryption key

By agreement, you can add your own encryption key, kept in your own account with your key service provider. On our shared service, it protects your connector sign-ins. On a dedicated database, it encrypts the whole database, its files and its backups.

If you withdraw our access, or the key is disabled, deleted, expired or can't be reached, we lock your organisation within minutes. Nothing is lost unless the key is deleted for good. If it is, the data it protects and its backups are lost for good.

Every change to our code is checked for leaked secrets and for dependencies with known weaknesses, before it's saved and again before it's released.

Every day, an automated suite of about 500 offensive and defensive security tests runs against the live service:

• Our dependencies are checked against public lists of known weaknesses.
• Our code is analysed with security rules and scanned for leaked secrets.
• Our secure connections and security headers are probed.
• Live attacks try to reach one organisation's data from another's, the way an intruder would.

Its findings go into a security report we review every day.

Stable Baseline has been penetration tested, with a white-box review of our code and live probes made while signed in. Every confirmed finding was fixed and verified in production. A full-codebase security audit closed all critical and high findings.

Your database is backed up continuously, in Sydney: we can restore it to any point in the last 7 days. Restores are verified every year, and each verification is recorded.

Our recovery targets are to restore the service within 24 hours, losing no more than 1 hour of data. These are targets: an Enterprise agreement can make them commitments.

We run on fully managed, serverless-first infrastructure, so hardware failure is absorbed by our cloud providers. If our AI or diagram rendering is disrupted, your documents stay readable and editable. You can check the service's health at any time on our status page.

If we confirm a security incident that affects your content, we tell your organisation without undue delay, and within 48 hours of confirming it, or sooner if your Enterprise agreement says so. We won't hold off confirming an incident to put off telling you.

We keep you updated until it's resolved, then tell you what caused it and what we changed.

If a data breach is likely to cause serious harm to anyone, we tell the people affected and the Office of the Australian Information Commissioner, as the law requires, and help your organisation with any notices it must give.

Found a security problem? Report it to us.

Our Privacy Policy lists the rest, including the mail agents work with.

Stable Baseline is run from Australia, and your content is stored here. If your organisation is in the European Union or the United Kingdom, this is what's in place today:

• We handle your workspace content for your organisation, on its instructions. Business customers can ask for our Data Processing Addendum at support@stablebaseline.io.
• Our Subprocessor list shows who helps us run the service, and where.
• People can see, correct, export and delete their information, as our Privacy Policy explains, and we help your organisation answer requests about its workspace.
• We tell you within 48 hours of confirming a security incident that affects your content, so you can meet your own deadlines.

We don't claim certification under the GDPR, the UK GDPR or any other law or standard.

Suppliers

We use suppliers for hosting, storage and processing, delivery and security, payments, email and AI. They may use your information only to provide their services to us, and they're bound by contract to keep it confidential and secure. Our Subprocessor list names them, and we announce a new one at least 30 days before it starts.

Policies

Customers can read the full text of our policies on request:

• Information Security Policy
• Access Control Policy
• Asset Management Policy
• Cybersecurity Incident Response Plan
• Business Continuity and Disaster Recovery Plan
• Vulnerability and Patch Management Policy
• Secure Development Policy
• Data Retention and Deletion Policy
• Third-Party Risk Management Policy
• Code of Conduct
• Anti-Bribery and Corruption Policy
• Modern Slavery Statement
• Whistleblower Policy
• Sanctions and Export Controls Policy

Certification

Stable Baseline operates under ISO/IEC 27001-aligned technical and organisational controls. We're not certified under SOC 2 or ISO 27001, and we don't claim to be.

Each supplier behind our database and file storage, document processing, delivery and payments holds SOC 2 Type II or ISO 27001 attestations, or both. The controls they provide are inherited by Stable Baseline.

Stable Baseline's compliance readiness features help you prepare for audits and standards. They don't certify you or make you compliant.

Privacy and data requests, contracts and security questionnaires: support@stablebaseline.io. Security problems: security@stablebaseline.io.

Orixian Solutions Pty Ltd (ABN 40 627 250 186), Melbourne VIC 3149, Australia.