What we collect, where it goes, and what we don't do
Plain facts about Shadow Guardian. If something here changes, we update this page.
What this page covers
On managed Chrome and Edge, Shadow Guardian records which AI tools are used and blocks AI tools you've marked Prohibited. Staff are told before monitoring starts. Prompt checks are switched off, so Guardian doesn't read what staff type. Guardian's production app, database and file storage are hosted in Australia. Some providers, including Replit (USA) and our email provider, may access or process data outside Australia to run the service.
Who you're dealing with
- Aura8 Pty Ltd, Sydney NSW
- ABN 99 691 970 779 · ACN 691 970 779 · Registered for GST
- General enquiries: hello@aura8.ai · Privacy: privacy@aura8.ai · Security: security@aura8.ai
Certifications
We don't hold SOC 2 or ISO 27001 certification yet. We provide a security overview and a Data Processing Addendum on request.
What Guardian records, and what it doesn't
Staff are told before monitoring starts.
Guardian records
- which AI websites on Aura8's list are visited in a managed work browser profile, and which AI tool each one matches
- the full page address, the page title, and the date and time
- the work email of the browser profile (and a user ID, if the browser provides one)
- department, if your organisation's admin sets it
- on supported AI tools, when a file is attached or uploaded: the file's name, type and size, the time, the site, and whether the upload appeared to start or complete
- warnings and blocks shown, what the person chose, and any access request, including the reason and any manager name and email they type
- technical details about the extension: install ID, version and last check-in
- standard technical server logs, which may include the network (IP) address a request came from
Guardian does not record
- screens, keystrokes or mouse movements
- browsing outside the listed AI sites
- personal browser profiles, other browsers, apps outside the browser, or phones
Prompt checks are switched off, so Guardian doesn't read what staff type.
About page addresses and titles: some AI sites put words from a search or chat into the page address or title, so these can contain parts of what someone typed.
Where your data is processed
Guardian's production app, database and file storage are hosted in Australia. Some providers, including Replit (USA) and our email provider, may access or process data outside Australia to run the service.
Who we use
| Provider | What for |
|---|---|
| Replit | Application hosting |
| Google Cloud | Underlying cloud infrastructure for Replit |
| Amazon Web Services (AWS) | AI model services for some features |
| Replit AI Integrations | Weekly AI-tool discovery |
| Stripe | Payments and tax invoices |
| Resend | Transactional email |
| Calendly | Booking kickoffs and Risk Checks |
How we protect it
- Each organisation's data is separated by access controls in the application; all organisations share one database.
- Independent testing: an independent security test of the browser extension is scheduled. No customer's monitoring starts until it has passed. Ask us for a summary once it's complete.
Who can see it
Your organisation's Guardian admins and viewers can see it. Authorised Aura8 staff can also access it to set up, support and secure the service, and to prepare reports your organisation asks for.
How long we keep data
During your subscription: as set out in your agreement. When you leave: we export your AI tool list and events as CSV on request within 30 days, and delete your data 30 days after your agreement ends, or sooner if you ask.
Staff are told first
Every rollout includes a 14-day staff notice period before monitoring starts. In NSW and the ACT, staff notice requirements apply; the ACT also requires consultation during the notice period. Our kit helps you do both. General information, not legal advice.
How we build the tool catalogue
Aura8 keeps a catalogue of AI tools across a range of categories. We build it from open-licensed public lists and open data, check that each site is live, and give each tool a provisional risk rating based on the kind of data people share with it, whether the vendor may train on inputs, and where the vendor is based. Ratings are Aura8's own assessment, not vendor facts, and you can change any default. Out of the box, Guardian detects the most-used of these tools; we share the full detected list at kickoff.
Questions about trust and privacy
Where is Shadow Guardian data stored?
What does Shadow Guardian collect?
Do you hold SOC 2 or ISO 27001?
What happens to our data if we stop using Shadow Guardian?
Who can we contact about privacy or security?
Found a security issue?
Email security@aura8.ai. We'll reply to let you know we've received it.