Security & trust
Built for operators
who can't take chances.
Critical-infrastructure data deserves more than a checkbox. Here is exactly how Metis handles yours.
- 01
Your data stays in Australia
Platform data is stored in Google Cloud Australian regions: Melbourne for application data, Sydney for uploaded files.
- 02
Encrypted everywhere
Data is encrypted in transit and at rest.
- 03
Isolated per organisation
Every request is checked server-side against your organisation membership. Not client-side filtering.
- 04
People decide, AI proposes
AI suggestions never lower a risk score on their own. Residual risk changes only when a person confirms a real control.
In detail
How it works.
- Access
- Role-based permissions within each organisation. Single sign-on (SAML 2.0) for Okta, Microsoft Entra ID, Google Workspace and ADFS, on request.
- Accounts
- Strong password policy (12+ characters) on production. Sign-in is handled by Google Identity Platform; we never store passwords.
- AI processing
- Only the scenario content needed for analysis is sent to the AI model provider (Anthropic, OpenAI or Google). Processing may happen outside Australia. Organisations can use their own provider key.
- Your controls
- Only controls from your own library count toward mitigation. Nothing is invented to make a score look better.
- Privacy
- We manage personal information under the Privacy Act 1988 and the Australian Privacy Principles.
Questions
Talk to us.
Need answers for a security questionnaire, or found a vulnerability? Email us. We respond to security reports as a priority.