Data handling
Where your data goes
You're trusting Safety Month-End with safety data. Here's exactly what happens to it.
| What | Where | Notes |
|---|---|---|
| This website | Cloudflare | Static pages. Your safety data never touches it. |
| Your exports | Amazon S3, Sydney region AU | Encrypted. Uploaded by a link that expires, or kept in a folder in your own SharePoint. |
| Calculations | Amazon, Sydney region AU | A script. The same one every month. |
| AI drafting | Amazon Bedrock, Australian inference profile AU | Requests handled in Sydney or Melbourne only. Not used to train models. |
| Microsoft 365 | Packs are sent to you only. | |
| Payments | Invoice or card payment provider | No safety data. |
| Prompt pack requests | The business Microsoft 365 mailbox | Your email address only. A mailing list provider may be added later, and this row will say which one and where it stores data. |
The path, step by step
- 01
Your exports
Whatever your system produces. Spreadsheets are fine. No names or medical details.
Your side - 02
Secure upload
A link that expires, or a folder in your own SharePoint.
Sydney - 03
Code does the maths
A script calculates every KPI against your written definitions.
Sydney - 04
AI drafts the words
Amazon Bedrock with an Australia-only setting. Not used for training.
Sydney or Melbourne - 05
A human checks every figure
Against your source data. Every [CHECK] answered or passed to you.
Human review - 06
You sign off
The pack goes out under your name, after your review.
Human
What never happens
- Nothing is sent to anyone but you.
- Your data isn't used to train any model.
- Your safety data isn't processed outside Australia.
- Clients' data is never mixed, compared or shared.
- The AI doesn't decide anything. A person checks, you sign off.
What I ask you not to send
Names, dates of birth, medical details, claim numbers. Roles and IDs are enough for reporting. If they turn up anyway, the file is deleted, you're told, and a clean one is requested.
Retention
Raw files are deleted after delivery, on a schedule agreed at setup and written into your agreement. Monthly KPI tables are kept for trends while you're a client and deleted when you leave. You can ask for deletion at any time.
Governance
Built to the same rules used on regulated work: draft-only AI, human approval on every output, region-pinned infrastructure, and governance aligned to the NIST AI Risk Management Framework.
Your security team will have questions.
Good. Send them through for a written answer, or join the call.