Security, data and safe automation
Automation and AI touch the systems and information your business depends on. This is how we handle access, credentials, personal information and AI services on every project.
How we build
The same controls apply to every automation, integration and AI agent we deliver.
Least-privilege access
We ask only for the access a project needs, use separate accounts or API keys where systems allow it, and ask you to remove our access at handover.
Credentials kept out of code
Passwords, API keys and tokens live in a password manager or the platform's secret storage. They are never written into code, documents or email.
Your accounts, your ownership
Where possible, automations and software run in accounts you own, so you keep control of the systems, the data and the bill.
Personal information minimised
Workflows move only the personal information each step needs and avoid storing copies in extra places.
Human approval where it matters
Sending to customers, changing financial records or acting on personal information can require a person to approve before it happens.
Logging, alerts and an off switch
Automations record what ran, raise alerts when something fails, and can be paused or removed quickly.
How we use AI
AI is used only where a rule cannot do the job, and always with limits and oversight. Read more about our approach to AI safety and governance.
No training on your data
We choose AI services and settings where business data is not used to train models, and confirm this for each tool during scoping.
Grounded and limited
AI agents work from approved sources and have a written list of what they may and may not do.
Tested on real examples
AI steps are tested against your real documents and questions, with confidence thresholds that send uncertain results to a person.
Privacy obligations
We design workflows around the Australian Privacy Principles and the New Zealand Privacy Act 2020. From 10 December 2026, organisations covered by the Australian Privacy Principles must also explain certain automated decisions in their privacy policy. We can help you map where your systems make automated decisions, and our plain-English guide explains the change. This is general information, not legal advice.
Our privacy policy explains how we handle personal information when you visit this site or contact us.
Security questions
Usually in the systems you already use. Where we build something new, we host it in accounts you own where possible and agree the hosting region with you during scoping.
Only when a task genuinely requires it. We prefer dedicated, limited accounts or API keys, and we ask you to revoke our access when the work is handed over.
We design workflows to use the minimum personal information needed and to support your obligations under the Australian Privacy Principles or the New Zealand Privacy Act 2020. Your legal adviser confirms the obligations that apply to you.
We choose AI services and settings where business data is not used for model training, and we confirm this for each tool before using it on your project.
23Labs is a small studio and does not currently hold formal certifications such as ISO 27001 or SOC 2. If your organisation requires them, tell us early and we will work within your security requirements and supplier process.
Yes. We are happy to work under your NDA or data handling terms.
Email hello@23labs.co with the details. We will acknowledge it and follow up as quickly as we can.
Have security requirements we should know about?
Tell us early. We will work within your policies, supplier process and approval steps.