Confidence, designed into the work
Rune-AI builds workspaces that sit across a firm's email, files and systems. Each one keeps client information confidential, handles only what is needed, and keeps access and activity accountable.
Last updated 11 October 2026
Controls first. Assurance earned independently.
Client confidentiality and data minimisation shape how we design and run every workspace. We collect and handle only the information reasonably needed to provide, secure and support the service.
Our security and privacy program is being developed with reference to recognised frameworks.
Protection that follows the work
The strongest safeguards are part of the everyday workflow, not a separate admin layer.
Client-scoped access
Permissions follow the firm, client, person and work they are authorised to see.
Default-deny sharing
External access is limited to the relevant client or engagement, and can expire or be revoked.
Recorded activity
Document views and access changes are designed to leave an accountable history.
Reviewable AI
AI-proposed changes stay visible for a person to review before they become work product.
Deliberate about every piece of information
Least necessary access
People see only the clients and material their role requires, for only as long as they need it.
Collect with purpose
Information is collected or generated only when it serves a clear product, security, support, contractual or legal need.
Confidentiality follows the client
Client information stays with the authorised firm, client and people. It is never repurposed for advertising or sold.
People stay in charge
AI assists the work. It does not replace a professional's responsibility to review advice, documents and decisions.
Boundaries you can see
Sharing, client visibility and AI-proposed changes are explicit enough to inspect, understand and reverse.
Assurance is a practice
Policies matter when they have owners, evidence, review cycles and a clear account of what is and isn't verified.
Recognised standards, reflected in our direction
These frameworks guide how our program develops. Because every system we build is bespoke, each one is considered independently against the standards that apply to it.
Framework informedAustralian Privacy Principles
For customers in Australia, our privacy program is being developed with reference to the Privacy Act 1988 (Cth) and the APPs: transparent handling, purposeful collection, controlled use and disclosure, information security, and individual access and correction rights.
Framework informedSOC 2
The SOC 2 Trust Services Criteria inform how we develop controls for access, change management, operations, risk and confidential information.
Framework informedISO/IEC 27001
ISO/IEC 27001 informs our risk-led approach to security governance, control ownership, access, operations, incident management and continual improvement.
Framework informedHealth information
For US customers whose work may involve protected health information, HIPAA's administrative and technical safeguards inform our assessment of the controls and contracts required.
What firms ask before they sign
Is client information sold or used for advertising?
No. We don't sell personal information or use customer content for advertising. It stays with the authorised firm, client and people.
Is our data used to train AI models?
Never without your explicit consent. Nothing your firm places in a Rune-AI workspace is used to train models unless you have expressly agreed to it.
Where is our data kept and processed?
Your data is stored onshore in Australia, New Zealand or the United States. By default that covers storage only, so AI processing may happen offshore. Onshore AI processing is available on request.
Can AI change our work without a person?
No. AI-assisted changes are proposals. They stay visible and reversible, and become work product only when a person accepts them.
Does it work with our email and documents?
Yes. You can connect a Gmail, Outlook.com or Microsoft 365 mailbox and disconnect it at any time. Drafts export as Word documents and PDFs.
Do we have to replace our existing systems?
No. We connect the systems you already run and build the workspace around them.
Which AI providers do you use?
AI-assisted features run on models from OpenAI and Perplexity.
Trust is a conversation we're ready to have
For privacy questions, security reviews or procurement diligence, talk to our team. Some information may be shared under appropriate confidentiality arrangements.
team@rune-ai.co