Trust and security

How we protect your data. Kept in Australia, seen only by your firm.

Your clients' information stays in Australia, is seen only by your firm, and never goes to a client without your sign-off.

Built on Google Cloud · AustraliaEncrypted in transit and at restAdviser signs off

Security summary (PDF)One page for your compliance team. Updated 29 October 2026.

Stored in AustraliaOn Google Cloud's Australian infrastructure. The AI that reads client data runs here too.
Only your firm sees itEach firm is kept separate. Our staff console shows firms and people, never your clients.
EncryptedIn transit and at rest, on every page and every record.
Not used to train AIUnder Google Cloud's terms, your data is not used to train its models. We don't either.
You sign off every messageThe desk drafts. Nothing reaches a client until you approve and send it.
Yours to take or deleteDownload everything, or delete your firm's data, at any time.

Where your data goes

One path, in Australia, from your desk to your firm's screens.

You and your teamSigned in with Google, Microsoft or a one-time email link.

Morning Desk on Google CloudClient books, notes, call notes and drafts.

AustraliaEncryptedBacked up daily

Only your firmMembers see only the desks they have been given.

Live voice and in-depth research may run outside Australia. They only ever get a label like Client 1 and holdings, never names or notes. Names go back on your screen, not theirs.

The detail

What a compliance team usually asks.

Who can see it

Only signed-in members of your firm, and only the desks they have been given.
No passwords stored. Your firm's two-step sign-in on Google or Microsoft applies here too.
Signing out ends the session on our side, not just in your browser.
Our team does not browse client data. The admin console shows firms, people and plans only.

How it is protected

HTTPS only, and encrypted at rest.
Keys and credentials held in Google Secret Manager, never in code.
Requests from other sites are refused, and the app can't be framed.
Rate limits, so a stolen session or runaway script can't do much.
Daily backups, kept for 14 weeks.

What the AI can and can't do

Drafts and summarises, and shows its sources.
Figures in drafts are checked against the desk's data first.
Every draft, check and sign-off goes in an audit trail your licensee can export.

Never sends anything to a client.
No buy, sell or hold recommendations.
Never suggests saving health, religious or political details.

Your control

Use initials or nicknames until your compliance team is happy for real names to go in.
A firm owner can download all the firm's data, or delete it, from Account.
If your firm leaves, we delete its data on request.

Built on Google Cloud

Morning Desk runs on Google Cloud, which is independently audited.

ISO/IEC 27001Information security certification

SOC 2Independent controls reports

IRAPAssessed under the Australian Government framework

These certifications are Google Cloud's and cover its infrastructure. Morning Desk is built on that infrastructure; they are not certifications of Morning Desk itself.

Questions from compliance?

Ask us anything about how the desk handles data: privacy@verticalinc.ai. The privacy policy has the rest.

Download the summary