Trust Center
Your data, your environment, your decisions
How Kreta protects your information, governs its AI agents and supports your risk, security and compliance reviews.
At a glance
Your environment
Kreta runs inside your own cloud tenancy, on your own model accounts.
Australian residency
Australian cloud regions and model endpoints where available, verified at onboarding.
Not training data
Your data is never used to train shared or foundation models.
People decide
Named approvers at every handover, and every agent action logged.
Data and deployment
Deployed inside your environment
Kreta is not a shared hosted platform. The agents are deployed into your own cloud tenancy, so your existing security controls apply from day one.
Your cloud tenancy
Agents, data and logs stay inside your environment, under your organisation's control.
Encryption
Data is encrypted in transit and at rest using your cloud platform's encryption controls.
Access control
Access runs through your identity provider, with multi-factor authentication and role-based permissions.
Audit logging
Every agent action, input and approval is logged, giving a complete trail for audit and review.
Availability and support response times are set out in your support agreement, with tiered service levels.
Responsible AI
AI that works for your people, not instead of them
Kreta's agents draft, read and check. Your people make every decision. These are the controls that keep it that way.
Your model accounts
Agents run on third-party large language models through your own approved accounts. Kreta does not build or train foundation models.
No training on your data
Your data is used only as context for your own workflows. Any customer-specific fine-tuning needs separate written agreement.
Human approval gates
Requirements, scores, supplier selection and contract terms are approved by named people before anything moves on.
Tested before release
Access, data leakage and prompt-injection tests are agreed with your security team before any pilot goes live.
Documented in plain language
Every agent is documented before launch: what it does, how it works, how to monitor it and how to fix it.
Incident response
Prepared for the unexpected
We maintain an incident response plan to identify, contain and resolve security events quickly.
Monitoring and alerting
Agent activity and system health are monitored, with response times set by your support tier.
Contain and investigate
Security events are contained, investigated and documented, with root cause shared with you.
Clear communication
We notify affected customers promptly, in line with our contract, so you can meet your obligations under the Notifiable Data Breaches scheme.
Report a security issue
If you find a security vulnerability, please report it to our security team. We acknowledge every report and keep you updated until it is resolved.
infosec@kretaai.comLegal and policy documents
Our terms, ready for your review
The documents your procurement, legal and privacy teams will ask for.
Questions about security or privacy?
Our security and privacy teams are here to help with your review.
Prefer to talk it through?