Provider Shield

Security, Privacy & AI Assurance Pack

Assurance Pack version 1.0 · Last updated 14 October 2026

Back to the Trust Center

1. Provider Shield overview

Provider Shield helps NDIS providers review participant documentation: progress notes, service agreements, service records and related files. It points out items that may not line up so a person can check them.

This pack describes the controls implemented in the product. It is written for providers, their boards and their advisers.

2. Data classification

  • Participant information

    Names, goals, progress notes, service agreements, uploaded documents and AI output derived from them

    Handled in: Australian-region infrastructure

  • Service-delivery information

    Worker names, service records and timesheets

    Handled in: Australian-region infrastructure

  • Account and organisation information

    Sign-in details, organisation name, contact details

    Handled in: Application database; sign-in providers where used

  • Billing information

    Subscription and payment details

    Handled in: Stripe

  • Marketing analytics

    Anonymous visits to public pages, with consent

    Handled in: Public pages only; never inside the signed-in product

3. Australian-region infrastructure

Provider Shield uses Australian-region infrastructure for sensitive AI inference, document storage, database hosting and application compute.

  • Australian-region AI

    Azure OpenAI

    Australia East

    Standard deployment

  • Australian-region storage

    Azure Storage

    Australia East · ZRS

    Private container

  • Database hosting

    Neon PostgreSQL

    AWS Sydney

  • Application compute

    Vercel Functions

    Sydney

  • Human review

    AI-assisted findings are labelled

    and left for a person to confirm

  • Explainable findings

    Each finding shows its source evidence

    and why it was raised

4. Data-flow architecture

  • AI analysis

    1. You
    2. Vercel — Sydney
    3. Sensitive AI gateway
    4. Azure OpenAI — Australia East

  • Documents

    1. You
    2. Vercel — Sydney
    3. Azure Storage — Australia East

  • Product data

    1. Vercel — Sydney
    2. Neon — AWS Sydney

5. AI model and routing controls

Sensitive AI processing goes through a single gateway to an Azure OpenAI Standard deployment in Australia East. No other AI provider is part of that path.

If the approved Australian Azure AI service is unavailable, Provider Shield does not silently send sensitive documentation to an alternate external AI provider. The analysis fails safely instead, with a clear message.

6. No-invented-facts policy

Provider Shield AI is allowed to

  • Allowed: Improve the wording of notes using only the facts supplied by your team
  • Allowed: Extract information that is explicitly written in a document, such as agreement dates and goals
  • Allowed: Compare records to point out potential inconsistencies
  • Allowed: Suggest areas that need human review
  • Allowed: Help compare the meaning of participant goals with documentation
  • Allowed: Summarise evidence that is already present in the records you provided

Provider Shield AI is not allowed to

  • Not allowed: Invent activities, outcomes, incidents, participant goals, behaviours or observations
  • Not allowed: Make eligibility decisions
  • Not allowed: Approve or reject NDIS claims
  • Not allowed: Give legal advice
  • Not allowed: Guarantee compliance or an audit result
  • Not allowed: Quietly switch to another AI provider if the Australian service is unavailable

If something is missing, Provider Shield says so. A draft shows a clear prompt such as “[Add observed outcome]” where a fact was not provided, explains what is missing, and will not let that placeholder be saved as if it were a real note.

7. Deterministic vs AI-assisted review

Deterministic check

Based on defined system logic: the same records always give the same result. It does not mean a legal conclusion.

  • Overlapping service records
  • A service date outside the agreement period
  • A duplicate service record
  • Weekly service hours compared with confirmed agreement hours

AI-assisted review

Used where language or meaning needs interpreting. These findings are labelled, show a confidence level where relevant, and always remain open to your review.

  • Comparing the meaning of a participant goal with what documentation describes
  • Reading explicitly stated fields out of a Service Agreement
Illustrative example

Potential inconsistency

Source
  • Service Agreement: Support period ends 30 September 2026.
  • Service record: Service recorded 4 October 2026.
Why it was flagged
The recorded service date falls outside the agreement period currently stored in Provider Shield.
Recommended action
Confirm whether a newer agreement exists, or whether the service record needs review.
Finding type
Deterministic

Invented example for illustration only; it is not customer data.

8. Human review controls

Findings

  • Reviewed
  • Resolved
  • Not applicable

Extracted agreement fields

  • Confirmed
  • Corrected
  • Marked not present
  • Marked incorrect

Reviewing a finding does not change the original note, document or service record. Corrections you make are stored separately from what the AI read, so the original reading stays visible.

9. Data minimisation

Provider Shield sends only the information required for each review task where practical. Full document text is used only for workflows that require the document itself to be analysed.

File Review comparisons send only the goal wording and short note excerpts needed for that comparison, without participant names, identifiers or file names.

10. Security controls

  • Private storage container; anonymous access disabled
  • Secure transfer required; TLS 1.2 or higher
  • Zone-redundant storage in Australia East
  • Download links are issued only for files in our own storage and expire after one hour
  • Private routes require sign-in
  • Records are scoped to your account and participant; other accounts cannot access them
  • Operational logs avoid participant, document and note content
  • No marketing analytics run inside the signed-in product
  • Request bodies are excluded from routing middleware
  • Secrets stay on the server

11. Service-provider table

  • Microsoft Azure OpenAI

    Purpose:
    Sensitive AI inference
    Sensitive participant content:
    Yes
    Region / scope:
    Australia East · Standard deployment

  • Microsoft Azure Storage

    Purpose:
    Uploaded documents
    Sensitive participant content:
    Yes
    Region / scope:
    Australia East · zone-redundant · private access only

  • Neon

    Purpose:
    Application database
    Sensitive participant content:
    Yes
    Region / scope:
    AWS Sydney (backup locations are governed by the provider and are being confirmed)

  • Vercel

    Purpose:
    Application execution
    Sensitive participant content:
    Yes
    Region / scope:
    Functions in Sydney

  • Stripe

    Purpose:
    Payments and subscriptions
    Sensitive participant content:
    No
    Region / scope:
    Global specialist provider; no participant notes or documents

  • Sign-in providers (Google, GitHub)

    Purpose:
    Optional sign-in identity
    Sensitive participant content:
    No
    Region / scope:
    Provider infrastructure; no participant notes or documents

  • Resend

    Purpose:
    Transactional account email
    Sensitive participant content:
    No
    Region / scope:
    Provider infrastructure; no note or document content

  • Axiom

    Purpose:
    Operational logs of route-level metadata
    Sensitive participant content:
    No
    Region / scope:
    Provider infrastructure; no participant, document or note content

  • Analytics tools

    Purpose:
    Public marketing pages only, with consent
    Sensitive participant content:
    No
    Region / scope:
    Not used inside the signed-in product

12. Logging and analytics boundaries

  • Operational logs avoid participant, document and note content.
  • Our logging provider receives route-level metadata, not participant, document or note content.
  • No marketing analytics run inside the signed-in product; public pages use analytics only with consent.
  • Account email never contains participant notes or document content.

13. Data storage

  • Private storage container; anonymous access disabled
  • Secure transfer required; TLS 1.2 or higher
  • Zone-redundant storage in Australia East
  • Download links are issued only for files in our own storage and expire after one hour

14. Known limitations

  • Microsoft’s standard abuse monitoring for Azure OpenAI is governed by Microsoft’s terms; flagged content may be reviewed under that process. Modified abuse monitoring has not been approved for Provider Shield.
  • Where database backup copies are held is governed by the database provider and is being confirmed.
  • Payment, sign-in and account-email providers may operate outside Australia. They handle account, authentication and billing information, not participant notes or documents.
  • Requests reach our Sydney servers through our hosting provider’s network.
  • Files saved before our current storage was introduced may no longer be available for download.

Provider Shield supports your team’s review. It does not:

  • Determine NDIS eligibility
  • Submit or approve claims
  • Replace professional judgement
  • Provide legal advice
  • Guarantee an audit result
  • Treat AI output as unquestionable truth
  • Fix source records automatically

This documentation is based on implemented technical controls and internal verification. Independent security and privacy assurance may be added as the platform matures.

15. Responsible AI principles mapping

Provider Shield’s Responsible AI controls are designed with reference to Australia’s AI Ethics Principles. This is a description of our controls, not a certification or an endorsement by any government body.

  • Human, social and environmental wellbeing

    Provider Shield helps teams review documentation. It does not make participant eligibility or funding decisions.

  • Human-centred values

    People can confirm, correct, or reject what the AI read, and decide what to do about every finding.

  • Fairness

    There is no automated decision about a participant’s eligibility, funding or access to supports.

  • Privacy protection and security

    Sensitive processing uses Australian-region infrastructure, AI payloads are limited to what each task needs where practical, and records are scoped to your account.

  • Reliability and safety

    Many checks are rule-based. AI-assisted findings are labelled with confidence, and the AI path fails safely with no offshore fallback.

  • Transparency and explainability

    Findings show their source evidence, why they were raised, and whether they are rule-based or AI-assisted.

  • Contestability

    Findings can be marked Reviewed, Resolved or Not applicable, and extracted fields can be corrected or marked incorrect.

  • Accountability

    Decisions on findings and corrections are recorded against the account, so people stay responsible for the outcome.

16. Security and privacy contact

For security, privacy or AI questions, contact us through the contact page. Please do not send participant information in a message.

17. Version history

  • Version 1.0 · 14 October 2026 · First published Trust Center and Assurance Pack.

18. Scope and legal disclaimer

This pack describes controls implemented in Provider Shield at the date shown. It is not legal advice, a certification, a guarantee of compliance, or an endorsement by any regulator or government body. Provider Shield helps teams review documentation; people remain responsible for decisions.