Trust & security
How the ATHEXIS platform protects your workforce data — where it lives, who can reach it, and how every action is accounted for.
Last updated: 11 September 2026
Who runs this service
This workforce-management service runs on ATHEXIS, the platform operated by Ashley Technology Pty Ltd. Each organisation that uses it — the employer, host or agency that engaged you — is the data controller for its own workforce records; the platform holds and secures those records on that organisation's behalf, as its data processor. The posture below describes how that platform is built.
Sovereign by deployment
The platform runs as one codebase in two isolated deployments. The commercial deployment serves general business customers; the IRAP-assessed deployment runs at the OFFICIAL: Sensitive classification entirely within Australian-sovereign infrastructure (ap-southeast-2), with AI inference routed to in-region models. A deployment never crosses the boundary it was provisioned for.
Tenant isolation
Every customer is a tenant. Each database query is scoped to the requesting organisation at the data-access layer — isolation is enforced by the platform, not by individual feature code, so a query that forgets to scope simply fails closed rather than leaking across tenants.
The AI provider boundary
Models are reached only through a single hexagonal port. That port selects the in-region provider for the deployment — AWS Bedrock in Sydney (ap-southeast-2) for the sovereign deployment — enforces a per-organisation spend circuit-breaker, and keeps prompts in a cache-optimal, auditable order. Swapping or constraining a provider is a configuration change at the boundary — never a scattered code change.
Accountable by design
Sensitive domain changes are written to an append-only, hash-chained event log alongside the data they describe, so the record of what happened survives redeploys and resists tampering. Every request carries a correlation id that threads through logs, background jobs, and event metadata for end-to-end tracing.
Reporting a concern
Security issues and platform access concerns reach the platform team at security@agentic-ai.au. Live platform status is published at status.agentic-ai.au. Privacy questions about your own records go to the organisation that engaged you: it is the data controller for them, and the Privacy statement sets out the rights you hold against it.