Trust and security

How we protect your data. Your clients stay safe, in Australia.

Built for licensed advisers. Set up in minutes, with nothing for your compliance team to chase.

Built on Google CloudHosted in Australia. The AI that reads client data runs here too.
EncryptedIn transit and at rest, on every page and every record.
You sign offThe desk drafts. Nothing reaches a client until you send it.
Security summary (PDF)One page for your compliance team · Commercial in Confidence · Updated 1 November 2026

Where your data goes

One path, in Australia, from your desk to your firm's screens.

You and your teamGoogle, Microsoft or a one-time email link.
Morning Desk on Google CloudClient books, notes and drafts.
AustraliaEncryptedBacked up daily
Only your firmEach person sees only their desks.
Live voice and deep research may run offshore. They only see a label like Client 1, never names or notes.

The detail

Who can see it

  • Your firm's signed-in people, nobody else.
  • No passwords stored. Your Google or Microsoft two-step sign-in applies.
  • Our staff never browse client data.

How it's protected

  • HTTPS only, encrypted at rest.
  • Keys in Google Secret Manager.
  • Rate limits and cross-site protection.
  • Daily backups, kept 14 weeks.

What the AI does

  • Drafts and summarises, with sources.
  • Checks figures before you see them.
  • Every draft and sign-off in an audit trail.
  • Never sends to a client.
  • No buy, sell or hold advice.

Your control

  • Use initials until compliance is ready.
  • Download or delete everything, any time.
  • Leave, and we delete your data.

Who we use

The full list. Only one of them ever holds client data.

Google CloudHosting, database, AIClient data · in Australia
Firebase AuthAdviser sign-inAdviser email only
StripeBillingNo client data
ResendSign-in emailsAdviser email only
Built on Google Cloud

Your clients' records sit in Google Cloud's Sydney region, on infrastructure the Australian Government has assessed.

Google Cloud's Australian regions meet the Australian Government's IRAP security assessment and its Hosting Certification Framework. The same infrastructure is independently audited worldwide.

IRAPAssessed for the Australian GovernmentGoogle's IRAP page › ISO/IEC 27001Information security managementGoogle's certificate › SOC 2Independent controls reportsGoogle's reports ›

Google secures

  • Data centres, hardware and the network
  • Encryption of everything stored
  • The certified infrastructure above

We secure

  • Sign-in through your Google or Microsoft account
  • Your firm's desk, walled off from every other firm
  • Client records and AI drafting kept in Sydney
  • An audit trail of every draft, sign-off and staff access
  • Your data never used to train AI

The certifications are Google Cloud's and cover its infrastructure, not Morning Desk itself. Your compliance team can request Google's IRAP and SOC reports through Google's Compliance Reports Manager.

Checked every day, not just promised

Inside the desk, the Trust centre checks where your data is and who can reach it, from the system's own settings. Plain rules, no AI.

  • A live data mapGreen, amber or red, from the real settings
  • Alerts that come to youNew-device sign-ins, and a daily check that flags any change
  • A compliance packOne click: the map, the checks and the staff-access log

Quick answers

Is my clients' data used to train AI?

No. Google Cloud's terms for its AI services say customer data isn't used to train its models, and we don't use it either.

Where is it stored?

On Google Cloud in Australia. Only live voice and deep research may run offshore, and they get labels like Client 1, never names or notes. Firms that need everything in Australia can switch on strict residency in the Trust centre, which turns voice, read-aloud and deep research off.

Can Vertical AI staff see my clients?

No. Your firm's desk is open only to your firm's people, and our admin console shows firms, people and plans, never client books, notes or drafts. On early pilot desks, set up by us before your firm's own, support access is possible and every open is written to your audit trail.

Can we start with initials?

Yes. Many firms use initials or nicknames until their compliance team is comfortable. Everything works the same.

What happens if we leave?

Download everything from Account, then ask us to delete it. We delete your firm's data on request, except where the law says we must keep it.

What if something goes wrong?

If a breach is likely to cause serious harm, we tell affected firms and, where required, the Office of the Australian Information Commissioner.

Questions from compliance?

privacy@verticalinc.ai · The privacy policy has the rest.

Download the summary