How We Handle Your Data — Client Overview

When you run operational workflows through Qadence, your business documents and records remain strictly under your control. This overview explains, in plain language and at an outcome level, who can see your data, how payloads travel through our service, and what happens after a workflow finishes.

Entity: Qadence Pty Ltd (qadence.tech) ABN: 69 702 704 667 / ACN: 702 704 667 Audience: Prospective & Current Qadence Clients Version: October 2026

Note: Detailed technical and cryptographic specifications are covered separately in the Qadence Security Whitepaper.

1. Who Has Access to Your Data (Zero Human Access to Payloads)

Our team never sees your incoming data: When you or your users submit a document, image, or payload into a Qadence extraction or workflow tool, the process runs automatically from start to finish. Qadence founders, operators, and support personnel do not view, inspect, or manually handle incoming payloads—we only ever see that a workflow completed and the resulting status.
No manual review by Qadence staff: Any review, confirmation, or approval step in your workflow is presented exclusively to your own authorised team inside your workspace, never to Qadence staff.
Strict identity-only workspace login: Access to client portals (such as crm.qadence.tech and dedicated client workspaces) is gated exclusively by verified user identity authentication. We do not allow shared passwords, generic desk logins, or password-fallback access.

2. Encrypted in Transit in Both Directions

Client to Qadence: Every document, image, form, or request sent from your device or website to a Qadence server is encrypted in transit from the moment it leaves your endpoint.
Qadence Back to Client: Every extracted field, populated form, and workflow response returned from a Qadence server back to your browser or system is equally encrypted in transit all the way to your endpoint.
No unencrypted transit paths: At no point does your payload or result travel across a network in readable form.

3. Zero Retention After Processing

Processed and immediately discarded: Payloads submitted for document extraction or form population exist in our workflow only for the moments required to produce your result. Once the structured result or populated document is returned to you, the submitted payload is gone.
No archives or shadow copies: We do not keep historical copies, backups, or caches of the documents you submit for extraction.
Never used for training or secondary purposes: Your payloads and business records are never used to train AI models, shared with other clients, or repurposed for any other service.

4. Plaintext Exists Only at Your Own Endpoints

Readable only where you work: Unencrypted, human-readable source documents and completed outputs exist solely at your own authorised endpoints—on the device where you upload or view the document, and inside the authenticated destination you control.
100% client ownership: All business records, confirmed entries, and completed outputs belong entirely to your organisation and can be exported by your authorised users at any time.

5. Summary at a Glance

Question	Qadence Outcome Commitment
Do Qadence staff see the documents we submit?	No. Processing is automated; operators never see incoming payloads, only completion results.
How is data protected between our systems and yours?	Encrypted in transit in both directions (from your endpoint to Qadence, and from Qadence back to your endpoint).
How long does Qadence store submitted documents?	Zero retention after processing. Payloads are discarded as soon as the result is returned.
Where does readable (plaintext) data exist?	Only at your own authorised endpoints.
How is workspace login protected?	Verified identity access only—no shared logins or password fallbacks.
How are supplier details and invoices verified?	ABR public-registry verification and mandatory human operator confirmation before any extracted field is written to client records.
Does Qadence handle payment card numbers?	No. Zero cardholder storage (out of PCI DSS cardholder data scope).

6. Compliance & Regulatory Alignment

Qadence aligns its privacy, data-handling, and operational practices with the following Australian statutory obligations and security control principles:

01 · Statutory PrivacyPrivacy Act 1988 (Cth) & Australian Privacy Principles (APPs)

Full adherence across all 13 Australian Privacy Principles, with particular focus on APP 11 (zero-retention disposal of client operational payloads immediately after processing completes, so nothing is retained to be breached) and OAIC Notifiable Data Breaches (NDB) scheme readiness.

02 · Security ControlsASD ISM & ACSC Essential Eight Control Alignment

Operational security practices aligned with Australian Cyber Security Centre (ACSC) Essential Eight and Australian Signals Directorate (ASD) Information Security Manual (ISM) principles—including strict identity-only workspace access, no shared logins or password fallbacks, encrypted transit in both directions, and change-controlled infrastructure.

03 · Commercial RecordsSupplier & Invoice Integrity (ABR Verification & Mandatory Human Confirmation)

Public-registry verification against the Australian Business Register (ABR) and mandatory human operator confirmation inside the client workspace before any extracted supplier quote, invoice, or enrichment field is written to client records.

04 · Payment BoundaryZero Cardholder Storage (Out of PCI DSS Scope)

Qadence does not store, process, or transmit payment card numbers across its workflow tools or client workspaces, keeping workflows outside PCI DSS cardholder data scope.

05 · Communications & ApprovalsSpam Act 2003 (Cth) & Electronic Transactions Act 1999 (Cth) Compliance

Full compliance across all business communications, consent and unsubscribe handling, and electronic workflow confirmations and approvals.

Questions or Security Due Diligence

If your procurement, legal, or compliance team requires our technical Security Whitepaper or would like to review our Privacy Policy, please reach out to your Qadence account contact or email [email protected].

Read the Privacy Policy Back to Privacy & Data Overview