Trust & Security
Last updated: 22 October 2026
Where we stand
Panaptic is built and operated by Panaptic Pty Ltd (ACN 625 971 075), an Australian company. We're early-stage and this page says plainly what we do today, what we don't do yet and where your data goes. For how the platform itself enforces control, including signed actions, approvals and isolation, see the Platform page.
Data hosting and residency
Panaptic is hosted on Google Cloud in Sydney. Your core data (connections, tasks, your database, and everything you build) is stored and processed in Australia.
Some features use providers outside Australia:
- AI features. When a task uses AI the relevant content is sent to the model provider for processing. If you use Panaptic-managed models, those providers are listed under Sub-processors. If you bring your own API keys, content goes to the provider you chose, under your agreement with them.
- Payments and transactional email are handled by the overseas providers listed below.
Built-in controls
- Isolation. Every organisation gets its own PostgreSQL database.
- Signed audit log. Every action, whether by a person, the agent or the system, is recorded with the actor, the action, its inputs and the time.
- Approvals. By default, actions that move money, contact a customer or change your records wait for a person to approve them.
- Spending caps. Limits per person, team or organisation.
Encryption
- In transit: all traffic to and within the platform uses TLS 1.2 or higher.
- At rest: all data is encrypted with AES-256 (Google Cloud default encryption). Credentials you store for external connections are also encrypted at the application layer with a separate key.
Access to production
Access to production systems is limited to the few staff who need it to operate and support the service. We enforce multi-factor authentication, grant access on a least-privilege basis and remove access promptly when someone changes role or leaves.
Application security
- Code is reviewed before it's deployed to production.
- Deployments are built through an automated pipeline into containerised, access-controlled environments.
- We monitor dependencies and update them in response to known vulnerabilities.
We haven't yet engaged an independent third party for penetration testing. We intend to and will update this page when we do.
Availability and backups
Our production database runs in a multi-zone, high-availability configuration in the Sydney region. It's backed up automatically every day, with encrypted backups retained in the same region. Continuous backups allow point-in-time recovery to any moment within the recovery window. We monitor platform health and alert our operations team to issues. We don't currently publish a formal uptime target.
Sub-processors
We use these third parties to deliver the service. Your data may be processed by them when you use the relevant feature.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud | Hosting, storage, database | Australia (Sydney) |
| Stripe | Payment processing | United States / global |
| Resend | Transactional email | United States |
| Cloudflare | Edge security and bot protection | Global |
| Anthropic, OpenAI, Google Cloud (Vertex AI), Fireworks AI | AI processing for Panaptic-managed models | United States / global |
If you bring your own model keys, your chosen provider processes that content under your agreement with them and isn't our sub-processor. We review this list regularly and update it when it changes.
Privacy
We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). Our Privacy Policy explains what we collect, how we use it, and who we share it with. To request access to, correction of, or deletion of your personal information, email privacy@panaptic.ai.
Incident response and breach notification
We maintain an incident response process for identifying, investigating and responding to security events. We comply with the Notifiable Data Breaches scheme and will notify affected customers and the Office of the Australian Information Commissioner where required, without undue delay.
Responsible disclosure
If you believe you've found a security vulnerability, email security@panaptic.ai. We'll acknowledge your report within five business days and keep you updated as we investigate. We won't pursue or support legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us a reasonable chance to respond before disclosing publicly.
Compliance roadmap
We don't currently hold formal security certifications. We're working towards the ACSC Essential Eight. When that changes, we'll say so here.
Contact
For security questions, questionnaires, or further documentation under NDA, email security@panaptic.ai. We're happy to support your procurement and due-diligence process.