Trust & security
Built for firms that answer to a regulator.
Your records are stored in Australia. Tax file numbers and bank details are masked before AI reads them. And you decide what an agent can do on its own.
Your own org, in your own country.
Every firm gets its own Salesforce org. Your client records never share a database with another firm’s.
- Salesforce Hyperforce, Sydney: your firm’s own org
- Workato Australian data centre: integrations and automation
Salesforce and Workato hold their own security certifications (including ISO 27001 and SOC 2). These are theirs, not rubica’s; the Trust Centre sets out what each party is responsible for.
Redaction
The model never sees the numbers that matter.
Before rubica sends a note or message to an AI model, it runs through masking rules. Tax file numbers, BSBs, bank account and card numbers become placeholders. The model works with the meaning, not the identifiers.
Agents work like team members, with a team member’s limits.
Each role-based agent has its own identity, email address and role. It sees and does only what that role allows, and everything it does is logged under its name.
Who sees what
Locked down by default. Every look on the record.
Tax file numbers and government IDs stay masked until someone with a reason to see them asks. Sensitive households can be restricted to the people who look after them. And every view is logged.
Access, privacy and compliance.
Questions firms ask us.
Is our client data used to train AI?
No. The AI providers rubica uses don’t train their models on your data.
Where is our data stored?
In your firm’s own Salesforce org on Hyperforce in Australia (or the UK for UK firms), with automation in Workato’s Australian workspace. Some supporting services, such as AI models, may process data outside Australia. Our privacy policy covers this, and our subprocessor list is available on request.
What does the AI actually see?
The text it needs for the task, with tax file numbers, BSBs, account and card numbers replaced by placeholders first. For AI reviews of emails and messages, you can see the exact masked text that was sent.
Can an agent send something to a client on its own?
No. Agents are designed to work as digital team members who communicate internally. They draft, update the record and hand back to your team, and a person sends anything that goes to a client. Everything an agent does is logged on the record.
Can we see your policies and reports?
Yes. Our Trust Centre lists our controls, policies and subprocessors, and you can ask for anything else under NDA. ISO 27001 certification is under way.
The detail, for your compliance team.
Our Trust Centre sets out our controls, policies and subprocessors, and is where you can ask for anything under NDA.