Security and your data

Komiti does two things. We build systems for small businesses, which means working inside your software for a while. And Komiti's own software can read a business's Xero payroll every morning. That is a lot to hand a small company, so here is exactly what happens, including the parts that aren't finished.

When we build systems in your business

You know what we can see, and why. Before we start, we tell you in writing which accounts we need access to and what for.
Read-only where possible. Admin access only where a build step needs it.
Access ends at handover. Every account stays in your name, and any admin access we used is removed at handover.
No client details in public AI tools. Your clients' personal or health information is never pasted into public AI tools. AI products are chosen for their data terms, for example business plans that don't train on your data.
Clinics. We treat beauty and health clinics as health service providers under the Privacy Act.
The enquiry form sends what you type to us by email. It isn't stored on this site.

Where the software keeps your data

Not "the cloud". Here are the specific answers, checked rather than assumed:

What	Where	How we know
Your account, business profile and obligations	Cloudflare D1, region-pinned to Oceania (Sydney)	The database reports region `OC`, colo `SYD`. Verified 6 Sep 2026.
Your Xero connection	Cloudflare D1, Oceania (Sydney)	Stored: an encrypted access key, your organisation's name, your settings, the jobs you've ticked off (a Xero ID and a date), the award line you've picked for each employee (a Xero ID, an award code and a line number), a note of which paydays and payroll findings we've already emailed you about (Xero IDs and dates), and a daily check log of outcomes only (such as "a calendar was 2 paydays behind" or "1 person has no super fund"), with no names or amounts. Payroll details (employees, pay runs, amounts) are read fresh each morning and never stored.
Documents you upload to the vault	Cloudflare R2, Oceania	The bucket is created with location `OC`. Verified 6 Sep 2026.
The website itself	Cloudflare's global edge	Pages are served from wherever you are. This is delivery, not storage. Your data isn't copied there.
Sign-up lists and what you type into the free tools	Cloudflare KV, global network	Unlike the database, this storage isn't pinned to Oceania. Named in the privacy policy.
Anything you type into an AI tool	Sent to Anthropic (United States) to generate the answer	Not used to train models. Named in the privacy policy.
Your sign-in emails	Sent via Resend (United States)	Named in the privacy policy.

How signing in works

There is no password. You enter your email, we email you a link, and you press the button it opens to sign in. The link works once and expires in twenty minutes. There is no password for anyone to leak, guess or reset, and Komiti never stores one. Opening the link alone doesn't sign anyone in, so an email security scanner that checks links can't use yours up.

Two-step sign-in. You can turn on a second step: after the email link, a 6-digit code from an authenticator app on your phone, with single-use recovery codes if you lose it. Then someone who gets into your email still can't get into Komiti. It's required to connect Xero payroll and to view payroll in Komiti. Turn it on from Security in your account.

The honest limitation: two-step sign-in is optional unless you connect payroll. Without it, your Komiti account is exactly as strong as your email account, so turn it on (and on your email too) before you put anything sensitive in the vault.

What Komiti will never do with payroll access

Payday Watch reads your Xero payroll. These limits are written into the code as rules that throw errors, not as promises in a document:

It will never move money. Paying wages or super, approving a super batch, posting a payment and transferring funds are all blocked at the code level. A person does those.
It will never post or finalise a pay run. Posting a pay run in Xero reports it to the ATO, so that click is always yours. Every request Komiti makes to Xero passes a check that allows only three things: reading payroll, creating a draft pay run for a pay calendar, and removing its own connection. Anything else is refused before it leaves Komiti.
It will never post to a closed financial year. Attempting to write into a finalised period raises an error rather than touching lodged accounts.
Everything it writes is a draft. Offer letters, pay runs, emails: all drafts for you to check and send yourself. Komiti does not send email on your behalf.
What it asks Xero for, plainly. Read access to payroll settings and employees, and Xero's pay-runs permission. Xero bundles viewing and creating pay runs into that one permission, so Komiti needs it even if you only want reminders. Komiti only uses it to create a draft, and only if you switch that on or press the button.
Your payroll data never goes to AI. Komiti doesn't send Xero data to an AI provider and doesn't use it to train AI models. It's also a commitment Komiti made to Xero.

These are covered by automated tests, so a future change that breaks one of them fails the build rather than shipping quietly.

When Komiti can't see something, it says so

A specific example, because it matters more than a general assurance. If Komiti can read your pay runs but cannot read your super payments, it will not tell you that you have a super shortfall, because "no payments visible" and "no payments made" are different facts, and only one of them is a problem. Reporting the wrong one would tell a director they are personally exposed when they may have paid on time. It reports the gap in the data instead.

What Komiti does not have yet

Listing these is more useful to you than omitting them:

No professional indemnity insurance in place yet. It is being arranged. No systems map, build work or monthly fee will be invoiced, and no one will be charged for the software, until it is in place. Worth knowing if you are weighing how much to rely on the output.
No independent security audit or certification. No SOC 2, no ISO 27001, no privacy certification. Komiti is early and small, and claiming otherwise would be the exact kind of thing this page exists to avoid.
Two-step sign-in is optional except for connecting payroll, as above.
The privacy policy and terms have not been reviewed by a lawyer yet. They are written honestly, but they are not a lawyer's work and they say so.
One person operates this. There is no team with separate access, which is good for exposure and bad for bus factor. Be aware of both.

Deleting your data

Ask and it's deleted: the whole account, or any single document. Email [email protected]. Under Australian privacy law you can also ask what's held about you and have mistakes corrected; the privacy policy sets out that process and the complaint path to the OAIC if you are not satisfied.

Reporting a security problem

If you find a vulnerability, email [email protected] with the details. You'll get a human reply, not a form. There is no bug bounty, but the report will be taken seriously and fixed, and you'll be told when it is.

Last reviewed 31 October 2026. If anything on this page stops being true, it gets changed rather than quietly left.