Privacy Policy

01Who we are

In this policy, "Metis", "we", "us" and "our" means Metis, trading as Metis AI. We provide the Metis website at metis-ai.com.au and the Metis threat modeling and compliance platform (the Platform).

This policy covers personal information we handle about website visitors, people who contact us, users of the Platform, and individuals whose details appear in content our customers store on the Platform.

02What we collect

The personal information we collect depends on how you interact with us.

Enquiries and demos

• Your name, email address, organisation, role and phone number, if provided
• The content of your messages and any notes from conversations with you

Platform accounts

• Name, email address, organisation, role and permissions
• Authentication details. Passwords are handled by our identity provider and are never stored by us in readable form. If your organisation uses single sign-on, we receive identifiers from your SSO provider
• Records of activity in the Platform, such as who created or changed an assessment, and when
• Billing contact details if your organisation subscribes to a paid plan. Payment card details are handled by our payment processor, not stored by us

Customer content

• Information your organisation enters or uploads, which may include personal information such as the names, roles and contact details of staff, contractors or suppliers, and evidence files

Technical information

• IP address, browser and device type, and server logs created when you visit the website or use the Platform

We do not intentionally collect sensitive information (such as health information or racial or ethnic origin). Please do not enter it into the Platform unless it is genuinely necessary and you are authorised to do so.

03How we collect it

We collect personal information directly from you where reasonable and practicable, for example when you email us, book a demo or create an account. We also collect it:

• from your organisation, when an administrator invites you to the Platform or enters your details into a workspace
• from your organisation's single sign-on provider, when you sign in that way
• automatically, through server logs when you use our website or Platform

If we receive personal information we did not ask for, we will decide whether we could have collected it lawfully. If not, we will destroy or de-identify it where lawful and reasonable to do so.

04How we use it

We use personal information to:

• respond to enquiries and provide demonstrations
• provide, operate, secure and support the Platform, including authenticating users and controlling access
• generate threat models, risk assessments and compliance outputs requested by our customers
• send service messages, such as invitations, account and security notices
• manage subscriptions and billing
• maintain and improve our services, and investigate faults and security incidents
• comply with our legal obligations

We will only use or disclose personal information for another purpose if you consent, if you would reasonably expect it and the purpose is related, or if the Privacy Act otherwise permits it. We do not sell personal information.

05Who we disclose it to

We disclose personal information only as needed for the purposes above, to:

• Cloud hosting and infrastructure: Google Cloud and Firebase, which host the website and Platform, store data and provide sign-in
• AI model providers: providers of the language models used to generate analysis, such as Anthropic, OpenAI and Google (see sections 06 and 07)
• Email delivery and payment providers that send service email and process payments
• Integrations your organisation turns on, such as single sign-on, Confluence or LeanIX. Information is sent to them only when your organisation configures and uses them
• Professional advisers, such as lawyers, accountants and auditors
• Regulators, law enforcement or courts, where required or authorised by law
• a buyer or successor, if our business or assets are sold or restructured, subject to this policy

We require our service providers to protect personal information and to use it only to provide services to us.

06Overseas disclosure

Platform data is stored in Australia. Customer data in the Platform is stored in Google Cloud regions located in Australia.

Some processing happens outside Australia:

• AI analysis. When the Platform generates analysis, the relevant scenario content is sent to the selected AI model provider for processing. These providers may process data in the United States and other countries where they operate.
• Service providers. Some of our providers, such as identity, email and payment services, may process information in the United States or other countries.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including by choosing providers with appropriate security and contractual commitments.

07AI and your data

• We send AI providers only the information needed to generate the analysis you request.
• We use AI providers' business API services. We do not use customer content to train our own AI models.
• Organisations can use their own AI provider account ("bring your own key"), so AI processing runs under an account and terms they control.
• AI output is a draft for human review. Risk scores only change when a person in your organisation confirms a control.

We recommend organisations avoid entering personal information into scenario descriptions unless it is needed for the assessment.

08Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:

• encryption of data in transit and at rest
• access to each organisation's data restricted, server-side, to members of that organisation
• role-based permissions and support for single sign-on
• least-privilege access for our own systems and staff

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately.

09Retention

We keep personal information only for as long as we need it for the purposes in this policy, including to provide the Platform under our agreement with your organisation and to meet legal, accounting and reporting requirements.

When we no longer need it, we take reasonable steps to destroy or de-identify it. An organisation can ask us to delete its workspace data when it stops using the Platform.

10Cookies and tracking

Our website does not use advertising or analytics cookies or tracking pixels. Our typefaces are served from our own website, so no third-party font service receives your details.

The Platform uses browser storage that is strictly necessary to keep you signed in and remember preferences such as theme. It is not used for advertising.

11Direct marketing

We may send you information about Metis if you have asked for it or would reasonably expect it, for example after you request a demo. You can opt out at any time by using the unsubscribe link in a message or by contacting us. Service and security messages about your account are not marketing and will still be sent.

12Anonymity and pseudonyms

You can browse our website and make general enquiries without identifying yourself. To use the Platform or receive a demo, we need to know who you are and which organisation you represent.

13Access and correction

You can ask to access the personal information we hold about you, or to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below.

We will respond within 30 days. We do not charge for making a request. If we refuse access or correction, we will tell you why in writing and how to complain. Many account details can also be updated directly in the Platform, or by your organisation's administrator.

14Data breaches

We follow the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC), and work with affected customer organisations.

15Complaints

If you have a concern about how we have handled your personal information, please contact us first. We will acknowledge your complaint, investigate it and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

16Changes and contact

We may update this policy from time to time. The current version will always be on this page, with the date it was last updated.