Buy Australian AI Partnership · Digital Track · AI processed in Australia →
Command Centre Powered by CanTicket
← Home Governance Book a look
Security and trust

How we protect your business.

Last updated 9 October 2026
Pilot versionCommand Centre is in its pilot. This page describes how it works today. We will update it, and tell the businesses we work with, before anything here changes.

Command Centre runs a business’s AI team: agents that draft, plan and report, with a person approving what goes out. It is provided by CanTicket Pty Ltd, an Australian company, and is a product of House of Can Pty Ltd, our parent company (the publisher name Microsoft shows when you connect Microsoft 365). You are trusting us with client lists, emails, figures and your brand, so this page sets out how that information is looked after, including the parts that are not finished yet.

Your own Command Centre

Separate, not shared
Each business that runs its own Command Centre gets its own application, its own database and its own encryption key. Your information is never stored in the same tables as another business’s.
Encrypted
Every connection uses HTTPS. Disks are encrypted. Passwords are hashed, never stored as text, and connection secrets (for example your Google sign-in) are stored encrypted.
Two-factor sign-in
On owner and team logins, and always for the screens that manage customer instances.
What our team can see
You choose, in Settings, Support access: on (the default, so we can help you set up), only when you let us in, or off. Our team never sees money (finance, bills, invoices, AI cost, Xero, payments or pipeline values) or your inbox, and never sends, approves or posts anything or runs your agents. Every visit and change is listed for you to read.

Where your information lives

WhatWhere
The application and its databaseSydney, Australia
BackupsEncrypted storage in Sydney, updated continuously, kept 30 days
Daily disk copies kept by our hosting providerUnited States, encrypted. We are replacing these with copies kept in Sydney
Sign-in accounts (businesses running their own Command Centre)Clerk, United States. Names, emails and sign-in history only, never business data

AI, processed in Australia

Amazon Bedrock · Sydney & Melbourne

For businesses we serve directly, AI runs in Australia on Amazon Bedrock in Sydney and Melbourne. Amazon states it does not use prompts or answers to train models and that the model makers cannot see them.

Your own account, your choice
A business running its own Command Centre uses its own AI account. We recommend Amazon Bedrock in Australia. Any setting that could send information outside Australia is flagged, and used only after the business confirms it understands that, which is recorded. Free AI accounts that allow training are not accepted for business information.
No middlemen
The AI layer, its tools and its safeguards are our own code. No outside AI framework, prompt-logging or tracking service sits between your information and your AI provider.
Only what the task needs
Only what the task needs is sent to the AI, and we never train AI models on your information.

People stay in charge

Agents draft; people decide
Emails wait in an inbox for a person to press Send. Sending to a client, deleting, publishing a scheduled post and changing who can log in each wait for a person to confirm. An email, web page or another AI cannot confirm on your behalf.
An off switch on every agent
A switched-off agent does nothing and spends nothing.
Spending limits
Limits on AI use, with a daily stop.
Tested safeguards
Each safeguard is backed by an automated test that fails if it stops working, run before every release.
Governance
Built on Australia’s Guidance for AI Adoption.
ISO 27001 · In preparationWhat we are working onRead our governance →

Each business has its AI governance papers (who is accountable, its AI policy and register, how complaints and incidents are handled), pre-filled from its Command Centre and signed electronically. Our own are signed by our board.

An AI board reviews how the agents are performing every week. It advises; people decide.

Our governance evidence pack, supplier list and data processing terms are available on request.

What we are working on

Where we are on the way to being ready for a bank or insurer’s supplier assessment. We say what is done and what is not.

ISO 27001, information security
In preparation
Our policies and Statement of Applicability are written. Next: the records that prove them, an internal audit, then certification.
ISO 42001, AI management
Mapped
Mapped against our ISO 27001 work, so one set of controls covers both.
Independent penetration test
Being scoped
A test of the app and of the agents themselves, by a firm we do not run.
Bank supplier assessment
Under way
Taking part in the Buy Australian AI Partnership Digital Track (Stone & Chalk and the National AI Centre), October to December 2026: supplier assessments, safe and responsible AI, and regulation in financial services.
Our AI6 ladder
On request
How far we are through each of Australia’s six essential AI practices, with the evidence. Shared with a preview password with businesses assessing us.

Who else handles information

A small number of providers run Command Centre. Each sees only what it needs.

ProviderWhat forWhere
Fly.ioHosting and deploymentSydney (a US company)
TigrisEncrypted backupsSydney
Amazon Web Services (Bedrock)AI processingSydney and Melbourne
ClerkSign-in for businesses running their own Command CentreUnited States
StripePayments (we never see your card number)Global
Your chosen AI providerIf your business picks a provider other than BedrockSet by that provider
Services you connectOnly if you connect them: Google, Microsoft 365, Meta, Xero, your CRM. For mail and calendars, we read only the mailboxes and calendars you tickIn your own account with each service, under your own contract
If something goes wrong
01We investigate and contain it straight away, and work out what information and which businesses are affected.
02We tell affected businesses within 72 hours of confirming an incident that affects them, and regulators where the law requires.
03We fix the cause and share what we found.
Report a security concern: manager@mycommandcentre.com. We acknowledge reports within 2 business days and welcome responsible disclosure.
Your part
✓Keep two-factor sign-in on, and give admin access only to people who need it.
✓Remove logins when someone leaves.
✓Connect only accounts you trust, and choose an AI provider whose terms suit your business.
✓Tell us straight away if something looks wrong.