How AppliedAgents handles data and AI on client projects

How AppliedAgents handles data, AI providers, testing, ownership and support on client projects, and what stays a decision for the client.

This page sets out how AppliedAgents handles data, AI providers, testing, ownership and support on client projects, and what stays a decision for the client. It is not a contract, a certification or legal advice. The terms that apply to a particular project are the ones agreed in writing for that project. Information handled through this website is covered by the privacy policy.

Where systems and data live

Systems AppliedAgents builds, and the data they hold, are hosted in an Australian cloud region by default. They are built in the client’s own accounts: the cloud account, automation platform, CRM and other business applications are the client’s, and AppliedAgents works inside them rather than running the client’s system on its own infrastructure.

The AI models are a separate matter. AppliedAgents works with OpenAI, Anthropic Claude and Google Gemini models, reached through their APIs or through automation platforms such as n8n, Make, Zapier and Power Automate. Depending on the provider, the product, the region and the account settings, the prompts sent to those models, and the replies that come back, may be processed outside Australia. AppliedAgents agrees the model provider and region with each client. Where a client needs data kept in Australia, it uses Australian-region model endpoints where the provider offers them. AppliedAgents does not claim that all AI model processing happens in Australia. The website’s own assistant is an example: the privacy policy says messages to it are processed by OpenAI and that processing may occur outside Australia.

This matters because of Australian Privacy Principle 8. The OAIC’s APP 8 guidelines say an organisation that discloses personal information to an overseas recipient is accountable for how that recipient handles it, and that providing personal information to an overseas contractor performing services on its behalf is, in most circumstances, a disclosure. A client covered by the Australian Privacy Principles carries that obligation itself. The OAIC’s guidance on commercially available AI products also asks organisations to consider where servers are located and whether personal information could be disclosed outside Australia, and recommends a privacy impact assessment.

The choice of provider, product, region and settings is agreed with the client before the build, and the client can choose to keep a step away from an AI model entirely. Which data the system holds, where it is stored and how long it is kept are agreed per project and also depend on the providers involved. There is no single retention period that applies to every build. A model provider may also keep its own logs for a period under its own policies; the privacy policy gives that detail for the website assistant.

For a plain explanation of what is safe to put into an AI tool, see Can I paste a customer’s email into ChatGPT?

How AppliedAgents maps the work

A project starts with an audit of the business carried out with the people who do the work, including in-person workshops and mapping sessions. The point is to find the actual problems and bottlenecks, not to find places to put AI. Each step of the process is written down, and for each one a decision is made: should it stay as a fixed rule, which runs the same way every time and can be checked, or is it a step where AI genuinely helps, such as reading an unstructured message, drafting a summary or extracting fields for review?

Many steps in a business process can stay as fixed rules. Keeping them that way makes the system cheaper to run, easier to test and easier to explain, and AI is kept for the steps where it helps. Important decisions stay with the people responsible for them. The map produced in this stage becomes the basis for the build, the tests and the handover documentation.

Testing before go-live

Every build is tested on the client’s real examples. Testing covers the ordinary cases that make up most of the work, and then the cases that break systems: missing information, conflicting records and failed connections between applications. For each one, AppliedAgents and the client agree what the next person should receive and what the system should do when a step cannot finish.

Before go-live, AppliedAgents and the client agree acceptance checks: the cases to test and the result expected for each. They also agree a way to pause the system or recover work if something goes wrong. The service page on AI consulting and implementation describes where this sits in a project.

Ownership and access

Systems are built in the client’s own accounts, so the accounts and the data in them stay with the client. AppliedAgents is given the access it needs to build and support the system. At handover, the client receives full documentation, which AppliedAgents walks through in person with every client. The handover covers operating instructions, a list of who has access to what, ownership and the ongoing responsibilities: who handles exceptions, what support covers and which running costs continue after go-live.

Clients own the code, prompts, workflows and data built for them once the project is paid for, and everything runs in their own accounts. The written agreement for each project sets out these terms, and a buyer should ask to see it before signing, as they should with any supplier.

Review and support

Senior engineers review all work to check that it does what the map and the acceptance checks say it should. For clients on ongoing support, AppliedAgents aims to respond within one hour, 24/7. What support covers, and for how long, is set out in the support agreement.

AppliedAgents also trains the client’s team to run the system day to day. It treats the relationship as an ongoing partnership rather than a build that is handed over and left: as AI tools and models change, it keeps working with the business to improve how it uses them. Where a client wants an internal policy to go with the system, the AI policy template is a starting point.

Security questionnaires and certification

AppliedAgents has completed client security and risk questionnaires for production systems. A buyer with its own questionnaire should raise it early in the conversation. AppliedAgents does not currently claim ISO 27001 or SOC 2 certification. A buyer whose policy requires a certified supplier should raise that early too, as it may rule AppliedAgents out. Certifications held by cloud or model providers cover those providers’ services, not AppliedAgents’ own work.

How this lines up with the Guidance for AI Adoption

The National AI Centre published the Guidance for AI Adoption on 21 October 2025. It sets out six essential practices for safe and responsible AI governance, and the government describes it as evolving the earlier Voluntary AI Safety Standard. The practices apply to the organisation using AI, which on a client project is the client. The more detailed implementation guidance also marks some actions for developers, the teams that build or customise AI systems, so on a project some responsibilities are shared with the supplier. The table is AppliedAgents’ own summary of its project work under each practice, not an assessment by the National AI Centre.

Questions to ask any AI supplier, including AppliedAgents

The National AI Centre publishes a checklist of questions to ask AI suppliers. The questions below draw on it, with a few added. Most are answered for AppliedAgents above; ask for the rest, such as the data-use settings on each provider account, in writing.

• Where is our data stored, and where are the AI models that process it? Which providers are involved?
• Will any of our data be used to train AI models, now or in the future, and what setting controls that?
• Whose accounts is the system built in, and who holds the access?
• Can we see evidence of testing on our own examples, not just assurances?
• Which steps are fixed rules and which use AI? Which actions still need a person?
• What happens when information is missing, records conflict or a connection fails?
• How do we pause the system, and how do we recover work if it goes wrong?
• What does the handover include, and what are your responsibilities across setup, running, fixing and exit?
• What is the support commitment, and is it in the contract?
• Have you completed security questionnaires before, and do you hold any certifications?

Last reviewed and how to ask about a project

This page was last reviewed on 3 November 2026 and will be updated when AppliedAgents’ practices change. If you want these points answered for a specific process in your business, start with a free business audit and ask for them in the first conversation.