Security and data

TsquareAI builds and runs AI applications on behalf of building-product brands, merchants and builders. This page explains how those applications are hosted and how we handle the data in them. The specific arrangements for your application are agreed with you.

Our applications run on established cloud infrastructure with data centres around the world. Australian clients are hosted in Australia by default. Clients elsewhere are hosted in their own region, or wherever their project needs, and we confirm the hosting region with you during scoping.

Hosting location is not the same as where data may be accessed or processed. Our team and some of our service providers are located outside Australia, as described in our privacy policy.

Depending on its features, an application may use:

• the product data you provide: your range, colours, finishes, images and the rules for what goes together;
• the photos, designs and enquiry details your customers choose to share while using it;
• usage information, such as which designs are saved or turned into enquiries, so we can run the application and report on it to you.

We use application data to deliver, support and improve the agreed service, subject to your agreement and the applicable privacy notice. We do not sell personal information. How long it is kept and how it is deleted are agreed with you for your application, subject to applicable legal requirements.

• Your data and outputs are yours. Your product data, the photos, designs and enquiries your customers create, and everything your application produces belong to you.
• Models trained on your data are yours. Any model we train on your data for your application is your intellectual property. We don’t use it, or your data, for anyone else.
• Your 3D product assets are yours to use. The 3D models of your products that our AI modelling engine builds can be used anywhere else you need them.
• TsquareAI owns the core platform. Our core models, AI modelling engine, software and know-how are TsquareAI’s intellectual property, and we license them to you to run your application.

The detailed terms are set out in your agreement.

Applications may use third-party AI services. For image-generation features, the images and instructions needed to generate a result are sent to the relevant service. The providers and data-handling arrangements for your application, including provider retention and model-training terms, form part of the scoping discussion.

Our applications are designed and delivered against the following target security baseline:

• Encryption in transit: HTTPS (TLS) for application connections.
• Encryption at rest: encryption for stored application data and backups, using managed cloud encryption.
• Least-privilege access: access limited to operational needs, with multi-factor authentication for privileged access.
• Client separation: logical or physical controls to prevent access across clients.
• Backups and recovery: backups and restore arrangements suited to the application’s recovery needs.
• Logging and monitoring: security-relevant logging and monitoring, with response procedures within the agreed operational scope.
• Updates: security fixes assessed and applied for the software and infrastructure we are responsible for.
• Secure development: changes reviewed and tested before production, with development, testing and production kept separate.

The controls implemented for your application, their coverage and any additional requirements are confirmed with you and handled for each project.

Retention periods, and arrangements for returning or deleting data, including at the end of an engagement, are agreed with you for your application, subject to applicable legal requirements.

If we become aware of a security incident affecting your application or data, we investigate and coordinate the response with you in accordance with your agreement and the law. We assess personal data breaches and notify affected individuals and the relevant regulator where required by law.

Personal information is handled in accordance with the applicable privacy notice and legal requirements. For a particular client application, refer to the privacy notice provided with that application or contact us. Our privacy policy explains how TsquareAI handles personal information collected through this website.

We work through your security questions and procurement requirements as part of scoping, including the controls needed for your application.

If you believe you have found a security issue in this website or one of our applications, email service@tsquare.ai with “Security” in the subject line. Please include the affected URL and the steps to reproduce it, without personal data, passwords or access tokens, and coordinate any public disclosure with us so we have the chance to investigate and address it.