Data, systems and agents, under control
How we handle access, data and AI on your behalf. Security and governance are built into every engagement from the first week.
Our commitments
Your data stays yours
Your system of record remains the single home for your data. We do not use client data to train AI models. [Confirm]
Least access
We access your platforms as authorised users with only the permissions the work needs, and remove access when an engagement ends.
Agreed before building
Where a tool needs a working copy of data, where it is held and how long it is kept are agreed in writing first. [Confirm]
People approve what matters
Agents cannot take irreversible or consequential actions without a named person approving them.
Every action logged
What each agent does is recorded, so you can always see what happened and why.
Ownership throughout
You own what we build for you: your configuration, your code, your agents and your data.
How we govern agents
Every agent has a named owner, a defined autonomy tier, scoped permissions and technical controls, and is monitored after launch.
Agent register
Name, owner, purpose and permissions for every agent in your business.
Threat model before launch
Each agent is assessed against known agentic risks before it goes live.
Controls and monitoring
Approval gates, spending limits, logging and a tested way to switch any agent off.
AI ethics
Our position on how AI should change a business, written as commitments you can hold us to.
People stay
AI makes existing staff more productive. Role redesign moves people into judgement and relationship work, and success is measured in capacity and redeployment, never headcount reduction.
A named owner
Every AI output has a person accountable for it.
Human checkpoints
High-stakes and client-facing outputs pass a human review before they ship.
Engineering discipline
Agents, prompts and skills sit in version control. Builds are tested in private deployments against live systems, and every output traces to its inputs.
Prototypes kept separate
Lovable supports rapid co-discovery and clickable prototypes. Production builds run under the same engineering discipline as everything else.
Frameworks that inform our approach
Australia's Guidance for AI Adoption
Six practices for accountable, safe AI use from the National AI Centre.
ISO/IEC 42001
The international standard for AI management systems.
NIST AI Risk Management Framework
A structured approach to identifying and managing AI risk.
OWASP Top 10 for Agentic Applications
The leading taxonomy of security risks specific to AI agents.
[Confirm wording on alignment versus certification]
Security questions and reviews
If your IT, security or procurement team needs our policies, a completed questionnaire or details of our incident process, we will provide them early in the conversation. [Confirm incident response and policy documents available]