Trust Centre
It won’t bluff you.
We tell you what we can’t see.
Command reads only what you connect to it, and only with your permission. This page says what it reads, where your records are kept, which AI providers see your text, and which of our commitments are in place. Every commitment below has a status and a target month, and we update this page as each one lands. A target is what we’re working to. Only “Done” means done.
Where things stand
Done means in place, with the evidence held. In progress means work has started. Planned means not started. A target is what we’re working to, not a result.
| Item | Status | Target | What it means for you |
|---|---|---|---|
| Provider list | In progress | 30 Nov 2026 | You’ll see every provider, what it does, and where it processes data. The list is a draft, and each row is being checked. |
| Data location | In progress | 30 Nov 2026 | We’re confirming that our main system runs in Azure’s Australia East region (Sydney), and where every copy of your records is held. |
| No sale and no AI training on your data | In progress | 30 Nov 2026 | Our rule: we never sell client data, and we never use it to train AI models. We’re checking each AI provider’s business terms before we say that they agree. |
| Guidance for AI Adoption practice statement | In progress | 27 Nov 2026 | Our own statement against the Australian Government’s voluntary AI guidance, showing what we do against each of its six practices. It isn’t a certificate. |
| Essential Eight self-assessment | Planned | 4 Dec 2026 | We’ll check ourselves against the government’s eight cyber strategies, aiming at Maturity Level One. It’s a self-assessment, not a certificate. |
| SMB1001 cyber security standard | Planned | 4 Dec 2026 | A recognised small-business cyber standard, issued by a third party at the tier we earn. We won’t use the name until a certificate is issued. |
| Insurance: professional indemnity and cyber | Planned | 20 Nov 2026 | Owners ask this first. Once the policy is bound, we’ll give you a certificate of currency on request. |
| Legal pack reviewed by an Australian firm | Planned | 20 Nov 2026 | An Australian firm will review our privacy policy, terms and data processing terms. We name the firm only with its written consent. |
| Escrow: records and code held by an independent agent | Planned | 4 Dec 2026 | We’re arranging an independent escrow agent. We’ll publish what it holds once it’s signed and the first deposit is verified. |
| Google CASA security assessment | Planned | 29 Jan 2027 | Google requires an annual independent security assessment before an app can read Gmail at scale. Reading Gmail for clients other than the first account waits on it. Until the letter is issued, we don’t say Google has approved us. |
| Independent privacy impact assessment | Planned | 29 Jan 2027 | An Australian privacy firm assesses how Command handles personal information. We’ll publish a short public summary. |
| Opted in to the Privacy Act | Planned | Nov 2026 | Small businesses can be exempt from the Privacy Act. We’re choosing to be covered anyway, and to be listed on the OAIC’s public Opt-In Register, once our privacy policy is final. |
| Incident process, written and tested | In progress | 4 Dec 2026 | The steps we follow if something goes wrong with your data, and the clock we work to. We’ll test them before we rely on them. |
| SOC 2, ISO 27001 or ISO 42001 | Planned | No date set | We hold none of these today. We won’t call ourselves certified or SOC 2 compliant. We’ll start one when clients need it. |
If something goes wrong
Each line says what we do, and where the work behind it stands.
- If it makes a mistake: it goes on the record, we’ll show it on your scorecard, and we fix the cause first.In progress · target Dec 2026
- If there’s a data breach: we’ll tell you within 24 hours of confirming it, and notify the OAIC when the Notifiable Data Breaches scheme requires it.In progress · target Dec 2026
- If we stop trading: we’re arranging an independent escrow agent to hold your records for you.Planned · target Dec 2026
- If you want to leave: at the end of any month, with your records, and we delete our copy within 30 days.Planned
- If you’re unhappy: write to us and the founder replies within two working days; for privacy complaints you can also go to the OAIC.Planned
- Insurance: professional indemnity and cyber.Planned · target Nov 2026
Confirmed, best guess, or can’t see it
Our rule is that every answer carries one of these three labels. The examples below are illustrative, not taken from a client file.
Contract exchanged 9 October
Read straight from the contract note. The answer would name that source.
Illustrative example · source: contract note
Settlement in about 60 days
From the usual terms for this kind of sale. It isn’t in the contract, so the answer would be labelled a guess.
Illustrative example · source: usual terms, not confirmed
Whether the buyer’s agent is stalling
Nothing in the records supports that, so the answer would say it can’t see it, and not guess.
Illustrative example · nothing to cite
Misses stay on the record
When it gets something wrong, we put it on the record, and we tell you what we changed.
The miss record is built and tested. We’re confirming that each client sees their own misses before we say they do.
Questions to ask any AI firm, including us
- “Show me the logs.”
- We will record a receipt for each approval, each reply we send, and each change to a client record. Each one shows what it was and who said yes. The Security page says which receipts are live today.
- “What happens when it makes a mistake?”
- We’ll put it on the record, we’ll show it on your scorecard, and we’ll fix the cause first. Be wary of anyone who says theirs rarely makes mistakes.
- “Do I own the accounts, or do you?”
- You connect Command with your permission, and only with your permission. Ownership of your records, and your right to switch Command off, will be written into the client agreement before we connect anything.
- “What makes the bill go up?”
- We’ll put every charge in writing before you agree to it.
The detail, page by page
Each page carries its own status, so you can see what’s running today and what isn’t.
- Trust CentreYour dataWhat Command reads, where your records are kept, which providers handle them, and how long we keep them.
- Trust CentreAIWhich models do what, our no-training position, and our practice statement against the government’s voluntary AI guidance.
- Trust CentreSecuritySign-in, how sends are approved, and where our Essential Eight, SMB1001 and Google CASA checks stand.
- Trust CentreContinuityHow you leave, how your records come back to you, how escrow works, and what happens if we stop trading.
- Trust CentreIncidentsThe steps we follow if something goes wrong with your data, and the clock we work to.
Things we won’t say about it
- Never wrong
- Fully autonomous
- Set and forget
- Replaces your judgement
None of them are true, of Command or of anything else.
Last reviewed 15 October 2026.