Enterprise-grade security. Australian data sovereignty by design.
Your data never leaves Australian infrastructure. Not just hosted here built, owned, and operated here.
Your data stays in Australia. Every step.
All processing runs on Data Craftsman owned GPU servers in Newcastle, NSW. No third-party cloud. No offshore routing.
You
Send a message from anywhere in Australia
Encrypted Transit
TLS 1.2+ with HSTS. Your data is encrypted end-to-end.
Newcastle Servers
Self-hosted GPU infrastructure. Not AWS. Not Azure. Ours.
Response
Your answer comes back. Your data stays here.
Aligned with Australian and international security frameworks.
We take an honest approach to compliance. Here is where we stand on each framework.
Australian Privacy Principles
Compliant with the Privacy Act 1988. Data collected, stored, and processed entirely in Australia.
- Transparent data collection with published privacy policy
- No cross-border data transfer — all AI processing in NSW
- Data export and account deletion available
- No data sold or used for model training
- Third-party services (payments, OAuth) disclosed in privacy policy
- Formal complaints process with OAIC escalation path
ASD Essential Eight
Strong application hardening and access controls. MFA enforcement and automated backups on the roadmap.
- Application hardening with CSP, WAF, and DOMPurify
- Multi-factor authentication available (TOTP)
- Dependency scanning and containerised deployments
- Admin privilege restriction with role-based access
- MFA enforcement for privileged accounts — in progress
- Automated backup strategy — in progress
APRA CPS 234
Strong transport encryption and access controls. Encryption at rest and formal incident response being implemented.
- TLS 1.2+ with HSTS preload and OCSP stapling
- Per-user data isolation and access controls
- Suspicious activity detection with alerting
- Activity audit trail with user, IP, and timestamp
- Field-level encryption at rest — in progress
- Formal incident response plan — in progress
ISO 27001
Good Annex A control coverage. Backup procedures and MFA enforcement being finalised.
- Documented security policies and development patterns
- Strong cryptographic controls (PBKDF2-SHA256, TLS)
- Incident detection with email alerts
- Data export and right-to-deletion support
- MFA enforcement for privileged access — in progress
- Documented backup and recovery procedures — in progress
PSPF
Protective Security Policy Framework alignment for Australian government deployments. Strong technical controls with MFA enforcement in progress.
- Full data sovereignty on Australian infrastructure
- Comprehensive security headers (HSTS, CSP, X-Frame-Options)
- Session management with absolute TTL enforcement
- CrowdSec behavioural threat detection
- MFA enforcement for all users — in progress
OWASP Top 10
Comprehensive web application security protections across all OWASP Top 10 categories.
- ModSecurity WAF with OWASP Core Rule Set v4
- CSP with per-request nonces prevents XSS
- SQLAlchemy ORM — parameterised queries throughout
- Password hashing (PBKDF2-SHA256) with strength validation
- Containerised deployments with dependency scanning
OWASP Top 10 for LLM
Purpose-built protections against the OWASP Top 10 for Large Language Model Applications.
- Prompt injection isolation — system prompts separated from user input
- DOMPurify output sanitisation on all AI-generated content
- Self-hosted open-source models — no external API calls for inference
- Tool scope limits — no code execution, no filesystem access
- Per-tier rate limiting with token caps and thinking time cutoffs
- Per-user vector embedding isolation prevents cross-user data leakage
Transparent, ethical AI you can trust.
We believe you should know exactly what happens with your data and how our AI works.
We Never Train on Your Data
Your conversations, documents, and files are never used to train AI models. Period. Your data exists to serve you, not us.
Open-Source Models
We use open-source AI models with published architectures. No proprietary black boxes. You can verify how our AI reasons.
Self-Hosted Inference
All AI processing runs on our own GPUs in Newcastle. Nothing is sent to OpenAI, Google, Anthropic, or any third party.
Transparent Model Selection
We select the best open-source model for each task. We are transparent about what models we run and why we chose them.
Deploy where it works for you.
Run Crafty AI on our infrastructure, your cloud, or your own servers. Your choice.
Cloud Deployment
We host it. You use it. Data stays in Australia.
- Hosted on Data Craftsman servers in Newcastle
- Fully managed — we handle updates and monitoring
- Dedicated instances for enterprise customers
- Integrates with your existing SSO provider
On-Premise Deployment
Your servers. Your network. Complete control.
- Deploy to your own infrastructure
- Data never leaves your network
- Integrates with your existing SSO provider
- Full customisation and branding available
Sovereign AI for every level of government.
Aligned with Australian Government AI goals. Suitable for federal agencies, state departments, and local councils.
The Australian Government's commitment to responsible AI adoption requires sovereign infrastructure that keeps data onshore. Crafty AI is built for this from the ground up — not retrofitted.
Whether you are a federal agency working within the APS AI Plan, a state government department with PSPF requirements, or a local council looking for an affordable sovereign AI solution, we can help.
Ready to discuss your security requirements?
Tell us about your compliance needs. We will give you honest answers about what we can deliver.
Disclaimer
The information provided on this website does not constitute professional advice, and should not be relied upon as such. No client relationship is formed by accessing or using this website. Users are advised to seek their own professional advice before acting on any information provided or generated herein. datacraftsman.com.au and its contributors accept no liability for any loss, injury or damage caused by reliance on the information provided or generated.