Trust
How we handle your data, and what's in place
Rekount isn't certified to anything yet. This page says what we do, what's in place as at 4 November 2026, and when we'd start each certification.
Your data stays in your tenant
Questions, answers and query results stay in your tenant.
AI agents do the analysis
In an engineer-led audit, a real person reviews every finding before it reaches you.
Nothing is certified
No ISO 27001, no SOC 2, no IRAP. Below: what's in place, and when we'd start each.
No tracking on this site
No cookies, no analytics, nothing loaded from other sites.
01 · Your data
How customer data is handled
- It stays in your tenant. Questions, answers and query results stay in your tenant. A first version of the subscription service exists, isn't deployed, and no customer has used it. It is designed to receive scores, run metadata and anonymised traces only: salted hashes and counts, never the text. On recorded runs, we searched its whole database for every wording, answer, rewrite and query, and found none.
- What the subscription service would receive. For each benchmark, the service receives question IDs, wording numbers and category names, the configuration label, the connector's name and the suite hash, random IDs for the run, its schedule and its salt, a one-word verdict for each ask (correct, wrong, defensible, declined or no answer), counts, timings and cost estimates, the stage that decided each wording with counts of its distinct rewrites, sources, queries, results and answers, salted one-way hashes of answers, sources and queries, whether a question's expected answer was out of date when it was asked, and the ambiguity probe's counts. It never receives the wording of a question, an answer, a rewrite, a query, a result, a source, table, measure or term name, or a definition. Question IDs, category names and configuration labels are sent as you write them, so keep anything sensitive out of them. If you switch on email reports, it also holds the addresses you add.
- It is never used to train or prompt agents outside your engagement.
- It never enters our code repository. A customer's folder holds the engagement's runbook and status, and nothing else.
- Access is an explicit decision. A sample run or audit needs an access decision first, and only the founder grants access on our side.
- We follow the Australian Privacy Principles, even where the small-business exemption might apply. You will probably require it, and reform may remove the exemption.
- No secrets in the wrong places. No secret goes in our repository, a prompt, an agent's instructions or a log, and every commit is scanned for them. Our AI agents never handle passwords or banking details.
02 · Model providers
What's sent to a language model
Our AI agents run on Claude, from Anthropic. Before an agent works on an engagement, we check that what it will read is allowed to leave your tenant under your contract. If it isn't, we run the agent inside your tenant or don't use an agent for that step.
The harness's paraphrase step, which proposes extra wordings of a question, sends question text only.
The recorded runs we publish are trimmed of workspace and item identifiers by a script that refuses to write its output if one survives. The raw logs from our own test tenants are never committed.
03 · How the company runs
AI agents do the work. A person answers for it.
Rekount is run by AI agents and remote engineers, under one person's accountability. The agents run questions, trace failures and draft reports. You pick the tier. Self-reported: your team runs Rekount and reports its own results. Engineer-led: one of our remote engineers, a real person, reviews every finding and is the person you deal with, and nothing we send you goes out unreviewed. The founder answers for all of it.
We say this so that nobody has to ask. If your contract or your policy treats AI involvement differently, tell us before we start.
Our outreach follows the Spam Act 2003: we write only to business addresses published for the role, we say who we are, and every message includes a way to unsubscribe.
04 · Security basics
What's in place
The basics buyers ask about, from our security baseline, as at 4 November 2026. Ask us and we'll walk you through the detail behind any of them.
| Step | What we have |
|---|---|
| Secrets scanning on our code repository | Every commit is checked before it is made, and every push scans every line ever added to the repository, on every branch. The first scan of the whole history found none. |
| Least-privilege access for AI agents | Each agent run starts without the founder's sign-ins or tokens, and gets only the tokens its role is granted. A token is written down, limited to one role and to 90 days before it is granted. No agent holds one yet. |
| Multi-factor authentication | On for the accounts that hold our code, email, cloud services and AI agents. Not yet confirmed for every other account. |
| Essential Eight | We assessed ourselves against Maturity Level One and wrote down a fix for each gap. We don't meet the level in full yet. |
| Security questionnaire answers and this page | Answers to the questions buyers usually ask are drafted from the same facts as this page. The founder signs off each questionnaire we return. |
05 · What's certified
Nothing yet
We're not certified to anything, and we won't answer a security questionnaire as if we were. We answer questionnaires only from the facts on this page and in our security baseline. Certification takes months and costs money, so we start each one when a customer needs it.
| Step | When we'd start it |
|---|---|
| ISO 27001 | When a customer's procurement requires it |
| SOC 2 Type I | When we take on customers in the United States |
| IRAP | If we bid for federal government work |
| Professional indemnity and cyber insurance | Before the first paid audit, because the deliverable is advice that customers act on |
If your procurement needs one of these, tell us when we first talk. When a step is done, this page changes and says when.