Security
Your compliance data, protected.
We’re transparent about how we protect your data: what we do, who handles it, and what we will never do.
Data Residency
Your compliance records are stored in Sydney, Australia
Every CDD record, every screening result, every document you generate is stored in Sydney, Australia (ap-southeast-2), encrypted at rest and in transit, for the full seven years required by law.
Some features send data to providers outside Australia so that they can work. The AI assistant and SMR drafting send the content of your request to our AI provider in the United States. Our Privacy Policy lists every provider, what each one receives and where it is located.
Infrastructure
Built on certified infrastructure.
Our infrastructure providers hold SOC 2 Type II and ISO 27001 certifications. These certifications belong to our infrastructure providers. We chose them specifically for their security credentials.
Supabase
Database hosting (Sydney, Australia)
Cloudflare
Application hosting and CDN
Didit
Identity verification via ISO 27001 certified provider
Paddle
Payment processing (Merchant of Record)
Protection
How we protect your data.
Encryption at rest (AES-256)
All data stored in our database is encrypted at rest using AES-256 encryption.
Encryption in transit (TLS 1.2+)
All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
Row Level Security
Row Level Security ensures each agency can only access their own data - database-enforced, not just application logic.
Role-based access control
Access to features and data is controlled by role. Users only see what they need to do their job.
7-year immutable audit trail
Records cannot be modified or deleted. This meets your AML/CTF Act record-keeping obligations automatically.
Regular security updates and dependency scanning
We apply security patches and run dependency scanning on a regular basis to keep your data protected.
Our Commitments
What we will never do.
Some things are non-negotiable. These are not policies we may change. They are commitments built into how the product works.
We never sell your data
Your compliance data is yours. We do not sell it, rent it, or share it with third parties for commercial purposes.
We never train AI on your data
We do not use your client records, compliance documents, or any customer data to train AI models.
Analytics and Tracking
What we measure, and who receives it.
We use a small number of third-party tools to understand how the product is used and to measure our advertising. This is the full list of them. Our Privacy Policy gives the detail for each one.
Product analytics (PostHog, European Union)
On amlsimple.com and in the app, we record page views and clicks. Each record includes the address of the page and the label of the button or link that was clicked, which can include a client name if you click on one. Signed-in users are identified by an internal account ID, not by name or email. PostHog stores this data in the European Union (Frankfurt).
Session recording (off)
PostHog session recording is switched off in the code of both the app and amlsimple.com, so no PostHog screen recordings are made and a setting in the PostHog account cannot turn them on. We would update this page before changing that.
Advertising tag in the app (Google Ads, only if you accepted cookies)
The app does not load the LinkedIn Insight Tag. From 23 November 2026, it loads the Google Ads tag only if you accepted cookies on amlsimple.com before you arrived, and uses it to count one event, a completed sign-up. Until then, and if you did not accept or came to the application directly, no advertising tag loads. The app also loads its fonts from Google Fonts.
Marketing site, after you accept cookies
On amlsimple.com, the Google Ads tag, the LinkedIn Insight Tag and Microsoft Clarity (session recordings and heatmaps of visits to our marketing pages) load only after you accept cookies in the banner. The marketing site also loads Paddle's script, which handles payments and payment recovery, whether or not you accept.
Breach Notification
We notify you promptly.
Data breach notification is handled in line with the Australian Privacy Act 1988 (Notifiable Data Breaches scheme). If we become aware of an eligible data breach, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by law.
We will also notify you directly so you can meet your own obligations as a reporting entity. We will describe what happened, what data was involved, and what steps we are taking.
If a breach occurs, we will:
- Assess the breach within 30 days of becoming aware
- Notify the OAIC and affected individuals if serious harm is likely
- Notify you directly so you can meet your own obligations
- Describe the breach, data involved, and remediation steps
- Take immediate steps to contain the breach
Security Questions
Questions about our security?
If you have questions about our security practices, data handling, or want to report a concern, contact us directly.
hello@amlsimple.comStart for free. No credit card required.
Build your AML/CTF program and verify your first client. Your records are stored in Sydney.