Privacy Policy - SafeForge AI

This Privacy Policy explains how SafeForge AI ("SafeForge AI", "we", "us", "our") collects, uses, stores, discloses, and protects personal information in connection with SafeForge (the "Service").

SafeForge AI (ABN 89190664116) operates SafeForge. We are based in Victoria, Australia; our full registered postal address is available on request via support@safeforge.ai.

We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). Where the General Data Protection Regulation (GDPR) applies to you, the additional provisions in Section 8 apply.

This Policy should be read together with our Terms and Conditions.

1. Who This Policy Covers

This Policy covers:

Visitors to our website.
Account holders and Authorised Users of the Service.
People invited to join an Organisation.
Workshop participants — people who open a workshop's shared link and sign in with their name, job role and organisation. They have no account with us.

A note on roles. For the data you and your team enter into the Service — your hazard logs, controls, comments, and so on ("Customer Data") — your Organisation is the controller of any personal information within it, and we act as a processor on your Organisation's behalf and on its instructions. For the account, billing, and usage information we collect to run the Service and our business, we are the controller. This Policy describes both.

2. What We Collect

Account information. When you or your Organisation create an account, we collect your name and email address. Authentication is handled by our identity provider (Clerk) using passwordless sign-in; we do not collect or store passwords for your SafeForge account. If your Organisation connects an external system that requires a stored sign-in credential, that credential is handled as described under "External system connection credentials" below.

Billing information. Subscriptions are billed through our payment processor (Stripe). Stripe collects and processes your payment card details directly. We do not receive, store, or have access to your full card number. We receive a customer reference, your subscription status, plan, and seat count.

Usage and technical information. When you use the Service we collect technical information necessary to operate and secure it — including your IP address, browser and device information, log timestamps, and records of actions taken in the Service (which feed the audit trail). To list your most recently opened projects on your Home page, we also record, for each project, when you last opened it.

Customer Data. You and your Authorised Users enter and import content into the Service: hazards, controls, threats, causes, consequences, requirements, assumptions, risk ratings, comments, and audit history. This is structured safety and risk data. It may contain personal information if you choose to put personal information into it (for example, the name of a risk owner). What Customer Data contains is determined by your Organisation, not by us.

External system connection credentials. If your Organisation connects an external system (for example, a requirements management system such as IBM DOORS Next), we store the connection settings and the sign-in credential of the dedicated, read-only service account your Organisation creates for that connection. The credential is encrypted at the application layer before storage, with the encryption key held in a separate system from the database; it is never displayed back or returned by the Service; it is decrypted only at the moment of each sync; and it is deleted immediately when the connection is disconnected. It remains encrypted inside our database backups. Your Organisation controls the account and can revoke it in its own system at any time.

Workshop participants (people with no account). An Organisation can share a risk workshop by a password-protected link. A person who opens that link can sign in to the workshop by typing three things: their name, their job role and their organisation. We do not ask for an email address, and no account is created.

Who is responsible for it. The Organisation that runs the workshop (the facilitator's Organisation) decides to collect this record and is the controller of it. We hold it for that Organisation, as its processor, as part of that workshop's record.
Who sees it. The facilitator and the people in that Organisation who can open the workshop. Unless the facilitator turns it off, the other people who have signed in on the same link also see the list of names, job roles and organisations. Someone who opens the link without signing in sees how many people have signed in, not who they are. The sign-in page says which applies before you type anything.
Account holders' names on a shared link. The shared page lists the changes made to the workshop. Each change made by an Authorised User (for example the facilitator) is shown with that person's name to everyone who opens the link.
What else is recorded. When you first signed in and were last seen on the page, and the days your page was open while a workshop session was running. The version of the conditions "Using a shared workshop" that you signed in under, and when. The facilitator can correct the entry and add a note of your competency (for example "signalling"). The facilitator confirms the list as the workshop's attendance record.
What you send. If the facilitator has turned it on, a signed-in participant can leave notes on the workshop and suggest additions to it. Each note or suggestion is kept with your name as you typed it and the time you sent it, as part of that workshop's record, held for the facilitator's Organisation. The facilitator and the people in that Organisation who can open the workshop see it with your name. Unless the facilitator has turned off the list of who has signed in, the other people signed in on the same link see it with your name too; with that list turned off they see it with your initials. Someone who opens the link without signing in sees it with your initials, not your name. Nothing you send changes the workshop by itself: the facilitator decides what is done with it, and you see the outcome on your own page. If the facilitator adds your suggestion to the workshop, the added row is part of the workshop's content from then on, marked "suggested by" with your name, and goes wherever that content goes (for example the worksheet and the Organisation's hazard log).
How we recognise your device. The page keeps a random identifier in your browser's storage so you are not asked to sign in again on the same device. It is used for that workshop link only. We also keep a short-lived, one-way-hashed record of the device and network address behind wrong-password attempts and unusually frequent requests, to protect the link.
How long it is kept. With the workshop's record, until the facilitator's Organisation removes your entry or deletes the workshop, and in any event no later than the deletion of that Organisation's data (Section 7).
How it is removed or corrected. You can correct your own entry from the same device. The facilitator can correct or remove any entry. For a person the facilitator added by hand, who never signed in from a device, a removed entry is deleted, not hidden. For a person who signed in from a device, removing them takes them off the list and the attendance record and stops that device opening the link. Their job role, organisation, competency note and the days they were present are deleted. What is kept, out of sight, is the name they sent under and the one-way-hashed record of the device, only so that the device stays refused and so that what they sent can stay in the record, marked as from a removed person. The facilitator can remove a note or a suggestion: its text is deleted, and the record keeps only that one was removed, by whom and when. To have your entry, or something you sent, removed, ask the facilitator or their Organisation; if you contact us, we will pass your request to them.
Where it does not go. These details are not included in the worksheet a participant can download, are not sent to any AI provider, and are not returned to an AI assistant connected to the Service. The notes and suggestions you send are not sent to any AI provider by SafeForge AI and are not used to train any model. The facilitator may ask their own AI assistant to read notes and suggestions: SafeForge AI then sends that assistant the text of each, what it is on, its state and your initials only, never your name, job role or organisation. The facilitator is shown exactly what will be read first, and can leave any note out. That assistant and its provider are chosen by the facilitator's Organisation and act under its agreement with that provider. Your notes and suggestions are not sent to any AI otherwise.

Watching a workshop without signing in, where the facilitator allows it, creates no participant record.

Communications. If you contact us for support, we keep a record of that correspondence.

We do not use third-party advertising or analytics trackers, and we do not build behavioural profiles of you.

3. How We Use Personal Information and Our Lawful Basis

We use personal information to:

create and administer accounts and Organisations;
provide, secure, maintain, and support the Service;
process subscriptions, trials, and payments;
operate the audit trail and other security and integrity features;
communicate with you about your account, service changes, and support requests;
send one reminder the day after you sign up: if you create an account and do not come back within a day, we send you one email with a link to your SafeForge home page. We send it once. It has an unsubscribe link; if you use it we record that and do not send reminder emails to that address again. It is not sent to a person who joined by an invitation. Emails about your own account, such as an invitation or a billing notice, are not affected;
detect, investigate, and prevent fraud, abuse, and security incidents; and
comply with our legal obligations.

Lawful basis. Our primary lawful basis for processing the personal information needed to run the Service is contractual necessity — the processing is necessary to provide the Service you have signed up for. We also rely on our legitimate interests in securing and improving the Service, on consent where you have given it (for example, by enabling AI Features), and on legal obligation where the law requires us to process information.

We do not sell personal information. We may use Customer Data in aggregated and de-identified form — from which you and your Organisation cannot be identified — to maintain and improve the Service, in particular its import and column-mapping heuristics. We do not use Customer Data to train AI models, and our AI provider is contractually committed not to train on it either (see Section 4).

4. AI Features and the Data Sent for AI Processing

AI Features are optional and disabled by default. They are enabled only when an Organisation Admin turns them on at the Organisation level, and then per project.

What is sent. When an Authorised User uses an AI Feature, the Service sends the minimum content needed for that task to our third-party AI provider (Anthropic, the Claude API):

AI checks and suggestions send the textual content of the specific entities being analysed (for example hazard, control, threat, consequence and requirement titles and descriptions) and the project's industry context, such as its jurisdiction and regulatory framework.
AI-assisted import and guided project setup send each column's heading and a few sample values, and summary counts and check findings about the file's structure. Whole rows and the rest of the file are not sent.
The in-app assistant reads the project through the same permission-checked tools the user has, and sends what those tools return for the question asked. Depending on the question, that can include project names, entity content, dates, change-request records and comments, recent change history, the names of connected documents, and document excerpts a user has confirmed for AI use.
Workshop notes and transcripts are used only if a user brings them in. A meeting transcript requires a recorded consent basis first. Only short excerpts are sent, never the whole record.

How people are protected. Names in structured fields (for example owners, reviewers, change-request authors and workshop attendees) are replaced with placeholders such as "Person A" before anything is sent, and are restored only in the answer shown back to the user. Speakers in workshop transcripts are replaced with role labels. Names typed into free text (for example inside a hazard description) cannot be reliably detected and may be sent as written.

What is not sent. The Service does not send your Organisation name, user email addresses, sign-in or billing details, or whole files to the AI provider. AI requests are assembled by dedicated code paths so that these limits are enforced consistently, and the main AI features show what they will see before they run.

Your own AI assistant. If you connect an AI assistant of your own choosing, content it reads from the Service is sent to the provider you chose, under your agreement with them, not to ours. The assistant can see only what the signed-in user could see.

No training on your data. Our AI provider does not train its models on data submitted through its API. This is a contractual commitment in the provider's API terms — it is not a setting we toggle and not a special arrangement.

Consent. Enabling AI Features is an explicit, recorded decision made by an Organisation Admin, who acknowledges the AI provider's API terms on the Organisation's behalf. AI Features can be disabled again at any time, which immediately stops any further data being sent for AI processing.

Advisory only. AI output is advisory and is never automatically applied to your Customer Data — see our Terms and Conditions for the full position.

5. Sub-processors and Disclosure

We use a small number of trusted third-party service providers ("sub-processors") to run the Service. Each is bound by its own terms and data protection commitments.

Sub-processor	Purpose	Processing location
Clerk	Authentication and identity management (passwordless sign-in, SSO)	United States
Neon	PostgreSQL database hosting (stores Customer Data and account data)	Australia (Sydney region)
Fly.io	Application hosting (runs the Service backend)	Australia (Sydney region)
Cloudflare	Content delivery, web application firewall, temporary file storage, and encrypted database backup storage (R2)	Global edge network
Stripe	Payment processing and subscription billing	United States / global
Anthropic	AI processing for optional AI Features (Claude API)	United States
Resend	Transactional email delivery (sign-in links, billing and account notices)	United States
Sentry	Application error monitoring	United States

Systems your Organisation chooses to connect to the Service — such as your own SharePoint tenant or your own requirements management server — are controlled by your Organisation and are not SafeForge sub-processors. Data the Service reads from or writes to them is handled on your Organisation's instructions under our Terms.

We disclose personal information to these sub-processors only as needed to provide the Service. We may also disclose personal information:

to comply with a law, regulation, court order, or lawful request;
to protect the rights, property, or safety of SafeForge AI, our customers, or others, including to investigate fraud or security incidents; and
in connection with a merger, acquisition, or sale of assets, in which case we will give notice before personal information becomes subject to a different privacy policy.

We do not otherwise sell, rent, or trade personal information.

6. Data Storage and Security

Location. Customer Data and account data are stored in Australia (Neon and Fly.io, Sydney region). Some sub-processors that support the Service operate in other countries (see Section 5 and Section 8).

Encryption. Personal information is encrypted in transit (TLS) and at rest (AES-256 at the database and storage layers).

Structured data only. The Service stores structured data only — it does not operate as a document store. Reports and exports are generated on demand and streamed to your browser rather than retained on our servers. Uploaded import files are held only transiently while they are being processed and are then deleted. This design deliberately limits the amount of data at rest and reduces the impact of any compromise.

Access controls. Access to production systems is restricted. Multi-tenancy is enforced at multiple layers, including database row-level security, so that one Organisation cannot access another Organisation's data.

Audit trail. Significant actions in the Service are recorded in an append-only audit trail, which supports both your safety assurance needs and our security monitoring.

No method of transmission or storage is completely secure. While we take reasonable steps to protect personal information, we cannot guarantee absolute security.

7. Data Retention

Account and Customer Data are retained for as long as your Organisation maintains an active Subscription.
After a Subscription ends, Customer Data is retained for a wind-down period of 30 days to allow reactivation and final export, after which it is permanently deleted from our active systems.
External system connection credentials are deleted immediately when the connection is disconnected, and in any event no later than the deletion of your Organisation's data after your Subscription ends.
Backups. Our routine encrypted backups follow their own rolling retention cycle and age out automatically after that period.
Workshop participant records (Section 2) are kept with the workshop until the Organisation that runs it removes the entry or deletes the workshop, and are deleted with that Organisation's Customer Data after its Subscription ends. The notes and suggestions participants send are kept the same way; the text of one the facilitator removes is deleted at once.
Audit trail records are retained for the life of the Organisation as an integrity and assurance feature.
Billing records are retained as required by tax and accounting law.

You should export any records you are legally or contractually required to keep before your access ends.

8. Your Privacy Rights

Under the Australian Privacy Principles, you may:

request access to the personal information we hold about you;
request correction of personal information that is inaccurate, out of date, or incomplete; and
make a complaint about how we have handled your personal information.

Where the GDPR applies to you, you additionally have the right to erasure, restriction of processing, objection to processing, and data portability, and the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us using the details in Section 11. We will respond within the time required by law. Note that where we act as a processor for Customer Data on behalf of your Organisation, we may need to direct your request to that Organisation, which is the controller of that data. The Service also provides self-service export and deletion functionality for much of this. If you signed in to a workshop as a participant (Section 2), the Organisation that ran the workshop is the controller of your entry and of the notes and suggestions you sent: ask its facilitator to correct or remove them, or contact us and we will pass the request on.

International transfers. Some of our sub-processors are located outside Australia (see Section 5). Where the GDPR applies, transfers outside the EU/EEA — including to the Anthropic API in the United States when AI Features are enabled — are made under appropriate safeguards, including the sub-processor's data protection agreement and standard contractual clauses, and, for AI processing, only with the explicit consent described in Section 4.

9. Cookies

The Service uses only functional cookies that are strictly necessary to operate it — principally to keep you signed in. We do not use advertising cookies, tracking cookies, or third-party behavioural analytics. Because we use only strictly necessary cookies, no cookie consent banner is required. If you block functional cookies, the Service will not be able to sign you in.

A shared workshop link (Section 2) sets no cookie. It keeps a random device identifier and your sign-in details in your browser's local storage, for that link only, so the same device is recognised when you come back. Clearing your browser's site data removes them.

10. Data Breach Response

We maintain an incident response process. If a data breach occurs that is likely to result in serious harm, we will contain and assess the incident and notify affected Organisations within 72 hours, consistent with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) and the GDPR. We will also notify the relevant regulator where required, remediate the root cause, and conduct a post-incident review.

11. Contact Us

For privacy questions, requests, or complaints:

SafeForge AI — Privacy Email: support@safeforge.ai

SafeForge AI · ABN 89190664116 · Victoria, Australia · support@safeforge.ai

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or, where the GDPR applies to you, your local data protection supervisory authority.

12. Children's Privacy

The Service is a business tool intended for use by professionals. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will give reasonable notice — for example, by email to Organisation Admins or by a notice in the Service — before the change takes effect. The "Last updated" date at the top of this document reflects the most recent version.