Security

Last updated: 6 October 2026

Client systems and data are handled with care on every engagement. These are the principles we work to.

Least-privilege access

• We request only the access needed for the agreed work, scoped to specific systems, workspaces or datasets.
• We prefer read-only or time-limited access where it is enough for the task.
• Access is reviewed during an engagement and removed or handed back when the work is finished.

Client-owned accounts

• Automations, integrations and cloud resources are built in accounts your organisation owns and controls, including Zapier, Azure and other SaaS platforms.
• We work as an invited user under your account, not through shared logins, so you keep full visibility and can revoke access at any time.
• Subscriptions and billing stay in your name, so there is no lock-in when an engagement ends.

Data handling

• Client data stays in your systems wherever possible. We avoid copying it to personal devices or external storage.
• Where data has to be shared, we use the secure channels you specify and the minimum data needed, de-identified where practical.
• Credentials are never shared over email or chat, and are stored only in a password manager or your own secrets vault.
• Any working copies are deleted at the end of the engagement, or earlier on request.
• We follow your organisation's security, privacy and acceptable-use policies, and will sign confidentiality agreements where required.

Reporting a concern

If you have a security question or want to report a concern, email anil.nagaraju@catalytiqsystems.com.au. See also our Privacy Policy.