Patient data that lives in Australia.
Australian hosting, record-level encryption, and a permanent record of everything.
Four promises we build in.
Not policy documents. Each promise is enforced by how aurii is built, and each one can be checked.
- Residency
It stays in Australia
Primary in Sydney, backup in Melbourne. Capture, transcription and storage all happen in Australia, encrypted and isolated to your practice.
- Encryption
Encrypted & isolated
Every record is sealed with its own key before storage; those keys are wrapped by a master key in Australian Key Vault.
- The ledger
Everything is recorded
Every action and actor is written to an append-only, hash-chained record, kept for seven years and independently verifiable.
- Sign-off
A doctor signs it
The doctor decides; aurii only drafts. Nothing is final, sent or billed until a specialist has signed it.
What happens to your words.
One path from the bedside to the seven-year mark, with a doctor's signature as the gate. Every consult follows it.
A pipeline with a gate in it
The stages on the left aren't chapters; they're the order the system enforces. The signature stage is the one act software cannot perform: aurii records a signature, it never applies one.
The same lifecycle, evidence attachedYour data, encrypted, your country.
Patient data stays inside the Australian border its whole life: captured, transcribed, stored, backed up and, if you ask, purged.
- Sydney: primary processing & storage
- Melbourne: encrypted geo-redundant backup
- Capture · transcribe · store, in Australia
Keys, backup and purge
The detail below: keys, backup, and why a stolen database is useless.
A record that can't be quietly changed.
Every action is written to an append-only ledger: drafted, edited, reviewed, signed, sent. Each entry carries a hash of the one before it, so changing or removing one breaks the chain.
Why the ledger is hash-chained
An ordinary log can be edited after the fact and no one would know. A hash chain links each entry to the fingerprint of the one before it. Reorder or delete an entry and every link after it breaks.
- Append-only Entries are added, never overwritten. The full history of a document stays intact.
- Who & when Action and actor, with a timestamp: drafting, edits, the review, the signature, the delivery.
- Check it Re-compute the chain yourself. That's a clean answer for an MDO, an insurer or an auditor.
- Seven years Kept in line with Australian clinical record-keeping expectations, in-region the whole time.
The day-to-day controls.
Behind the four promises sit the day-to-day controls: who sees what, encryption at every step, processing that stays in Australia.
You see only your own patients
Specialists see their own patients, and each role is limited to what the work needs. There's no standing access and no broad admin reach over clinical content. Every grant is deliberate and logged.
Encrypted in transit & at rest
Every connection is encrypted in transit. At rest, encryption covers everything aurii holds: audio, transcripts, notes, letters and backups.
Append-only retention
The ledger is write-once. Records are never silently edited or purged. The history of every document is kept and chained.
If something goes wrong.
Here is what happens when something needs a response.
- First response Handled by the people who built it. A suspected incident goes straight to the engineers who built the system, not into a tiered ticket queue. Every report is treated as real until we've proven otherwise.
- NDB scheme The Notifiable Data Breaches scheme. If a data breach is likely to result in serious harm, we notify the affected practices and the OAIC, as the scheme requires. You hear it from us directly: what happened, what data, what we did. Our privacy policy carries the same commitment.
- Report it Found something? Tell us. Report a weakness, or anything that looks wrong, to [email protected]. A person reads it and a person replies. Good-faith security research gets a thank you, not a lawyer's letter.
Held, inherited, and the law.
One certification is ours. The rest belong to the platforms underneath and the law we answer to, and each card says which. That includes the ones we don't yet hold.
- Built on Microsoft Azure, Australian regions. Azure's infrastructure is IRAP-assessed to PROTECTED and holds ISO 27001 and SOC 2. These cover the underlying cloud platform; the security of our application and your data is our responsibility.
- Drafting engine An enterprise AI provider runs the drafting itself. It drafts only from what you dictate; a named specialist reviews and signs every output and remains responsible for the clinical content.
- The law The Australian Privacy Principles bind aurii under the Privacy Act 1988. Health information is handled as sensitive information, with clear collection notices, access and correction, and any cross-border disclosure set out plainly in our Privacy Policy.
The trust page is the reference copy of this one: every claim on this page against its source, with the full subprocessor list, in a form you can forward.
The questions your IT team will ask.
The detail your governance, IT and medico-legal teams want, answered plainly. The wider set, for clinicians and reviewers, lives on the FAQ.
In Australia, all of it. Audio, transcripts, drafts and backups sit in Sydney, with an encrypted geo-redundant copy in Melbourne. No clinical record is stored offshore, and recovery from backup never sends one there either.
No. The contracted drafting service is bound by contract not to train its models on your content, and patients' clinical information is never used to train general-purpose AI models. The privacy policy states this in full.
A small engineering team holds the operational keys. There is no offshore support desk and no broad admin reach over clinical content. Every access lands in the hash-chained ledger you can verify, so who read what, and when, always has an answer.
Export comes first. We set it up at onboarding, so your records leave in a usable form and their audit ledger goes with them. Then, on your instruction, we purge, and purged means destroyed for good, not just hidden. The mechanics are in the privacy policy.
Re-compute the hash chain for that document. If a single entry had been changed, reordered or removed, the chain would break. An unbroken chain is your proof the record is exactly as it was made.
Never automatically. No note, letter, billing item or discharge is issued until a named specialist has reviewed and signed it. The signature, and who applied it, is written to the ledger.
As a documentation tool, aurii drafts from what you say at the bedside; it does not diagnose, triage or make clinical decisions. The treating specialist reviews and signs every output and remains responsible for the clinical content, in line with the RACGP's guidance on AI scribes. The full position is on clinical safety.
Seven years, append-only, in-region the whole time, in line with Australian clinical record-keeping expectations.
We'll walk your IT, governance and medico-legal teams through how it works and answer the detail, at [email protected].
Data that stays home.
See aurii on your ward.
Bring your security questions, the kind your governance and IT teams ask.