Legal

Privacy Policy

Last updated: 16 July 2026

Cassandra AML ("Cassandra AML", "we", "us") provides an AML/CTF compliance workspace for Australian tax agents and accounting practices. This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Two kinds of information we handle

Account information is information about you and your practice that you give us to operate your account: names, work email addresses, practice name, ABN, Tax Practitioners Board registration number, roles and security settings.

Practice compliance records are records your practice enters while performing its own AML/CTF obligations: client identities, beneficial ownership, screening outcomes, risk assessments, reports and supporting evidence. Your practice is the custodian of these records and decides what is collected. We process them solely to provide the service and never use them for any other purpose.

2. What we collect and why

• Account and practice details — to create and administer your workspace.
• Authentication data (hashed passwords, multi-factor enrolment, session and device records) — to secure access.
• Audit records of actions taken in the workspace — to provide the tamper-evident history the service exists to provide.
• Technical logs (IP address, browser type, timestamps) — to operate, secure and troubleshoot the service.
• Email delivery events for the messages we send you — to make sign-in, invitations and security notices reliable.

We do not sell personal information, use it for advertising, or use tracking pixels in our emails.

3. How information is stored

Data is stored in managed cloud infrastructure. Our core providers are Vercel (application hosting) and Neon (database). Where your practice enables them, we also use transactional email and identity-verification and screening providers; each integration is clearly labelled inside the product as live, sandbox or not connected, and no data flows to a provider your practice has not enabled. Some providers store data outside Australia (including in the United States). Where information is disclosed overseas we take reasonable steps, consistent with APP 8, to ensure it is handled in accordance with the APPs.

4. Security

• Encryption in transit for all connections, and encryption at rest provided by our infrastructure providers.
• Mandatory multi-factor authentication, with step-up verification for sensitive areas.
• Enforced row-level separation between practices at the database layer.
• A hash-chained, tamper-evident audit trail.
• Access to restricted reporting records limited to authorised roles within your practice.

5. Retention and deletion

AML/CTF record-keeping obligations generally require records to be kept for seven years, and the service applies retention periods designed around that requirement. Account information is retained while your account is active. If you close your account we will, at your written direction, export your practice's records to you and delete them from the live service, except where law requires retention.

6. Access, correction and complaints

You may request access to, or correction of, personal information we hold about you by emailing privacy@cassandraaml.com. We will respond within 30 days. If you are unsatisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7. Data breaches

We assess suspected data breaches under the Notifiable Data Breaches scheme and will notify affected individuals and the OAIC where an eligible data breach occurs.

8. Changes to this policy

We will post updates to this page and, for material changes, notify account owners by email before the change takes effect.

9. Contact

Privacy questions: privacy@cassandraaml.com