CustodryBack to home

Privacy Policy

Last updated: 13 September 2026

Custodry ("Custodry", "we", "us") provides a platform that helps organisations discover, assess, approve and govern the AI systems they use. This policy explains what personal information we collect through the Custodry platform (currently offered as an early-access / beta service), how we use it, and the choices you have. It is written to describe the product as it actually works today, and is intended to align with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. Who this applies to

This policy covers two groups of people: (a) individuals at a customer organisation who create an Custodry account, administer a workspace, or are named as a system owner, approver or reviewer within it, and (b) employees of a customer organisation who submit a self-report through Custodry's employee reporting feature. If you are an employee using a customer's Custodry workspace, your employer is the data controller for that workspace and its own policies may also apply.

2. Information we collect

We collect the following categories of information:

  • Account information: name, work email address, and organisation name, provided when you sign up or are invited to a workspace.
  • AI register data: information you or your organisation enter about AI systems in use — vendor, category, business owner, department, business purpose, data classification, hosting provider, and related notes.
  • Risk, approval and review records: risk scores and ratings, approval decisions and conditions, and review schedules and outcomes entered by your organisation's users.
  • Connector data: if your organisation chooses to connect Microsoft 365/Entra ID, Google Workspace, or AWS, we retrieve a limited set of information through those providers' APIs — such as registered enterprise applications, service principals, organisation/tenant name, and application-related activity records — using the access your organisation's administrator explicitly grants. We request read-only access wherever the provider allows it, and we never receive or store your Microsoft, Google or AWS account password.
  • Connection credentials: OAuth access and refresh tokens needed to maintain a connector are stored encrypted at rest and are never displayed in the product.
  • Employee self-reports: the tool name, purpose, and sensitivity information an employee submits, along with the name and email they choose to provide (self-reports can be submitted without identifying information where your organisation allows it).
  • Audit and usage information: a record of actions taken in the product (such as who approved or changed a system's status and when), and standard technical logs (IP address, browser type, timestamps) generated by using a web application.

3. What we don't do

Custodry is built around a principle of not overclaiming what we actually observe. Where a connector detects that an application was authorised or accessed, we record that as an observed signal — we do not attempt to read the content of your communications, documents, or AI prompts, and connector access is scoped to the metadata described above, not the underlying content those platforms hold.

4. How we use information

  • To provide, maintain and secure the Custodry platform for your organisation.
  • To populate and keep your organisation's AI register, risk assessments and review schedule up to date.
  • To communicate with you about your account, including service and security notices.
  • To respond to support requests sent to the contact address below.
  • To improve the product, including fixing errors and understanding how features are used, while the service is in early access.

We do not sell personal information, and we do not use your organisation's data to train third-party AI models.

5. Sharing and sub-processors

We use a small number of infrastructure providers to operate Custodry, each acting as a service provider under contract:

  • Supabase — database hosting and authentication.
  • Vercel — application hosting.
  • Microsoft, Google and AWS — only insofar as your organisation connects them, to retrieve the connector data described above.

We do not otherwise share personal information with third parties, except where required by law, to protect our rights, or with your consent.

6. International data storage

Our infrastructure providers operate data centres in multiple regions. Where personal information is stored or processed outside Australia, we take reasonable steps to ensure it continues to receive an appropriate standard of protection.

7. Data retention and security

We retain account and register data for as long as your organisation's workspace is active, and connector credentials only for as long as a connector remains connected — disconnecting a connector removes its stored credentials. Connection tokens are encrypted at rest. We use industry-standard technical and organisational measures to protect information, but no system can be guaranteed completely secure.

8. Your rights

You may ask to access, correct, or request deletion of your personal information, or ask us how it has been handled, by contacting us at the address below. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

9. Cookies

Custodry uses only the cookies necessary to keep you signed in and to operate the application securely. We do not currently use advertising or cross-site tracking cookies.

10. Children

Custodry is a business product and is not directed at, or knowingly used by, children.

11. Changes to this policy

We may update this policy as the product develops, particularly as it moves from early access toward general availability. We will update the date at the top of this page when we do.

12. Contact us

Questions about this policy or your information can be sent to info@aigf.com.au.