Neighbourhood works inside the platforms, data and increasingly the software of businesses across Australia and New Zealand. This page is the public record of how we do it, what we host, what our agents are allowed to touch, and where to find the documents your security team will ask for.
- Diamond HubSpot Solutions Partner.
- 11 years trading, since 2015.
- 300+ businesses since 2015.
- $2m professional indemnity per claim ($6m aggregate a year), $20m public liability and cyber cover capped at $1m, with Berkley Insurance Australia, renewed February 2026.
- 24 hour breach notification window.
Where your data lives
Updated 02.10.2026
Your CRM stays in your platform. Anything we host sits in Sydney, one instance per client.
Most of it stays in your platforms. Some of it lives with us, on the record. Your CRM is your source of truth, and it stays that way. We access client platforms as authorised users under least privilege and revoke at project end. Where we operate software of our own, we list it openly.
A. Client platforms: we work as an authorised user, not a data extractor
We do not migrate your CRM into Neighbourhood-owned infrastructure, and HubSpot stays your source of truth. When a tool we build for you needs a working copy of some records, like the deal fields a forecast reads, that copy sits on a Neighbourhood server in Sydney, kept separate for each client. On written request, we delete or return it within 30 days of the engagement ending. For Australian and New Zealand clients, HubSpot data is hosted in Sydney, inside Australian data centres and under Australian data sovereignty.
| Client platform | Certification held by the platform |
|---|---|
| HubSpot | SOC 2 Type II · ISO 27001 · GDPR |
| Google Workspace | SOC 2 Type II · ISO 27001 · IRAP |
| Xero | SOC 2 Type I · ISO 27001 |
Working in your portal
- Each Neighbourhood person has their own named login in your HubSpot. No shared accounts.
- Super Admin only when the work needs it, scoped to that work, and removed when that work ends.
- Our AI agents never write to your CRM without a person approving the change.
B. Hosted by Neighbourhood: where we run software in-house
Five services of our own, listed openly. Some are internal only, and we run our agency on them. Others are client-facing, where you log in or your data flows through them.
| Service | What it is |
|---|---|
| NBHOS Platform | Internal operating system |
| NBH Billing | Client invoicing portal |
| NBH Solutions | Brief and proposal builder |
| NBH Audits | audit.nbh.co |
| Client tool instances | Per-tenant deployments |
The infrastructure underneath
| Hosting | DigitalOcean, Sydney region |
| Edge | TLS 1.3 on every service. Cloudflare WAF and DDoS protection on selected services |
| Database | Postgres, with no database port open to the internet |
| Backups | Daily server backups for NBHOS, Billing and Solutions, last seven kept, so the recovery point is at most 24 hours. Client tool servers: set per engagement |
| Region | Servers we host are in Sydney. AI inference (Anthropic) and meeting transcription (Fathom) run in the United States |
| Isolation | Per-tenant for client tool instances |
AI and autonomous agents
Updated 23.06.2026
No training on your data. Dedicated API keys for every client.
We use AI heavily, and here is exactly what it is allowed to do. Most agencies use AI in private and explain nothing. We use it in production, name the providers, and publish the rules our agents operate under, including the things they are required to ask permission for before doing.
A. AI in our internal work
Code review, documentation, research, drafting and most client delivery work, performed on encrypted, centrally-managed Apple devices in Brisbane. Our Macs are supervised under Mosyle MDM with enforced firewall, screen lock, passcode policy and remote wipe. Providers operate under commercial terms with no training on inputs.
| Provider | What it does for us | Terms |
|---|---|---|
| Anthropic (Claude) | Primary reasoning, code and agent runtime. Most work on the commercial Claude Team plan, with the Anthropic API for AI features in client tools. | No-training commercial terms · SOC 2 Type II |
| Fathom | Meeting transcription. | SOC 2 Type II · HIPAA |
| Google (Gemini) | Internal Neighbourhood work only, never on client engagement data. | Internal use only |
B. AI features inside the products we build for you
When a client tool we build for you uses AI, we mint a dedicated API key, scoped to that tenant. Your data is not visible to any other client’s instance, and no client’s data is used to train or fine-tune any model. Evaluation suites and output checks are documented per project in the relevant AI specification.
C. Autonomous agents on our staff
Some of our work is performed by autonomous AI agents. They operate under a published action policy. Agent actions in NBHOS are logged, and a senior team member reviews the Red queue before anything in it proceeds. Every action in every tier is listed below.
Green, routine
Acts autonomously. Logged but not flagged.
- Code edits inside their own services
- Raising pull requests on any repo
- Cloudflare DNS records, read-only queries
- Slack and Drive read operations
Amber, notify first
Alerts the team first, then proceeds unless someone objects.
- Edits to shared environment files
- Restarting or redeploying shared services
- SQL backfills on shared production tables
- Provisioning new infrastructure
- Changing client-facing config
- Changing a shared scheduled-job schedule
- Rotating shared secrets
Red, wait for approval
Stops and waits for an explicit human go.
- Destructive database operations
- Schema changes on production
- nginx, systemd, system-level cron
- Deploy script or rollback edits
- GitHub org-admin settings
- Adding or removing org members
Reserve controls, and what the policy binds
A narrow set of org-control actions, account-level settings with our providers and adding or removing organisation members, are reserved for the Director and cannot be performed by any agent, at any tier.
Every commitment here traces to our Information Security Policy, the document of record that binds our staff, contractors and autonomous AI agents alike.
Security controls
Updated 02.10.2026
MFA everywhere, managed and encrypted devices, hardened GitHub.
Four areas, and the same standard at each: devices, access, source code and the development workflow. Where a control is still being rolled out, it says so rather than being listed as finished.
Devices: Mosyle MDM, fleet wide
- FileVault. AES-256 disk encryption enforced; recovery-key escrow being completed.
- MFA required across all team accounts.
- 1Password password manager.
- Five-minute automatic screen lock.
- Patching. Enforced OS and app updates being added.
- Remote wipe on loss or theft.
- BYOD. Personal devices stay unenrolled; company-account access is secured at the account layer, with remote sign-out and revocation.
Access: least privilege, formal off-boarding
- Scoped credentials. Only the minimum needed.
- Environment separation. Development versus production.
- Off-boarding checklist. Seats, keys, repos, Slack, project tools.
- People. Everyone at Neighbourhood with access is employed in Australia and works onshore. None of them work overseas.
- Training. Everyone with access completes security and AI training.
- Logging. We log agent actions in NBHOS, repository activity in the GitHub audit log, and access to our servers.
Source code: GitHub, hardened
- Private by default across the nbh-co organisation.
- MFA enforced on every member.
- Branch protection on main in every repo: a pull request is required before merge, with no force-push and no direct pushes, including for admins.
- Copilot review auto-runs on all pull requests.
- Dependabot security alerts active.
- Supply-chain screening. Dependencies checked for malware before install (rolling out).
- No secrets in code, ever, scanned at push.
- GitHub audit log records repository activity.
Development workflow: local-first, sandbox-first
- Local builds on encrypted Brisbane devices.
- Sandbox first, when the client provides one.
- Scoped API tokens, rotated regularly.
- No client data in repos. Code only.
- Tests, lint and type check run on every pull request.
Incident response
Updated 02.10.2026
You hear from us within 24 hours of a confirmed breach.
A real plan, written down. It follows the Australian Notifiable Data Breaches scheme under the Privacy Act 1988.
- Identify and contain. Isolate affected systems, revoke compromised credentials, stop further exposure.
- Notify. Affected clients informed within 24 hours of a confirmed incident. This is our contractual commitment to clients. It runs alongside the statutory Notifiable Data Breaches duties below, not instead of them.
- Investigate. Root cause analysis, scope of exposure, forensic timeline.
- Remediate. Patch the root cause, rotate all potentially affected credentials, post-mortem.
- Report. Where required, notification to the OAIC under the NDB scheme.
Reporting a vulnerability, and our safe harbour
To report a suspected vulnerability or security concern, email weare (at) nbh.co or get in touch via our contact page. We acknowledge within one business day.
We will not pursue or support legal action against security researchers who act in good faith: avoid privacy violations, data destruction and service disruption, only interact with accounts you own or have permission to test, and give us reasonable time to remediate before any public disclosure.
Privacy
Updated 02.10.2026
Privacy Act 1988 and the APPs. Your data returned or deleted within 30 days.
Australian Privacy Act, applied plainly. Neighbourhood operates under the Australian Privacy Act 1988 and the Australian Privacy Principles. The full policy is our Privacy Policy.
- We only collect personal information necessary for the services we provide.
- We do not sell, rent or disclose personal information to third parties except where required by law.
- Individuals can request access to or correction of their personal information at any time.
- We comply with the Notifiable Data Breaches scheme.
- How long we keep it. By default we keep client and project data for up to 5 years after an engagement ends. On your written request we delete or return client personal information within 30 days instead. Financial records are kept for up to 7 years.
Compliance and artefacts
Updated 02.10.2026
Three frameworks in place today, Essential Eight self-assessed. Pen test planned for Oct to Dec 2026.
The documents your security team is about to ask for. There are three, none of them a download. Request them from the document bundle and a person sends them to you.
- Mutual NDA. PDF, v2.1, February 2026. Two-way confidentiality agreement, ready to counter-sign.
- Data Processing Agreement. PDF, v1.0, 18 June 2026. DPA covering processing of personal data under the Privacy Act 1988.
- Insurance certificate of currency. PDF, February 2026. Berkley Insurance Australia. Professional indemnity, public liability and cyber.
Frameworks we work to, and where we are heading
We currently operate against the controls below. Independent certification of Neighbourhood-hosted services is on the roadmap. We publish dates rather than vague language.
| Framework | Status | When |
|---|---|---|
| Australian Privacy Act 1988 and the APPs | In place | Current |
| Notifiable Data Breaches scheme | In place | Current |
| OWASP Top 10 secure development | In place | Current |
| ACSC Essential Eight | Self-assessed | Current |
| Annual external penetration test, NBH-hosted services | Planned | Oct to Dec 2026 |
| SOC 2 Type I readiness, NBHOS and client tools | Planned | 2027 |
| ISO 27001 gap assessment | Planned | 2027 |
Subprocessors
Updated 02.10.2026
All 18, what each one touches, and 30 days notice before we add one.
How a subprocessor gets added
We give you 30 days written notice. You can object in writing. Subscribe to updates and the notice reaches you by email.
The full list. The honest list. Every tool that may touch a piece of your engagement, grouped by purpose. We notify clients in writing at least 30 days before adding a new subprocessor that could access client data.
Infrastructure, Neighbourhood-hosted services
Compute, edge, transactional email and payments for anything we host.
| Subprocessor | Purpose | Certification | What it can touch |
|---|---|---|---|
| DigitalOcean | Compute, Sydney region | SOC 2 Type II · SOC 3 | Application and database |
| Cloudflare | Website hosting, DNS, WAF, DDoS, TLS | SOC 2 Type II · ISO 27001 · ISO 27018 | Traffic in transit |
| Resend | Transactional email | SOC 2 Type II | Email recipients |
| Stripe | Payment processing, NBH Billing | PCI DSS Level 1 · SOC 2 Type II | Payment and billing data |
Client platforms, which you authorise us to use
Your own systems, which we access as an authorised user under least privilege.
| Subprocessor | Purpose | Certification | What it can touch |
|---|---|---|---|
| HubSpot | CRM, marketing, sales automation | SOC 2 Type II · ISO 27001 | Client-authorised |
| Xero | Accounting integration | SOC 2 Type I · ISO 27001 | Client-authorised |
Workplace and collaboration
How we talk to you and to each other: mail, calls, meetings, proposals.
| Subprocessor | Purpose | Certification | What it can touch |
|---|---|---|---|
| Google Workspace | Email, calendar, documents | SOC 2 Type II · ISO 27001 · IRAP | Client correspondence |
| Microsoft 365 | Email and documents | SOC 2 Type II · ISO 27001 | Staff correspondence |
| Google Meet | Client meetings | SOC 2 Type II · ISO 27001 | Meeting content only |
| Aircall | Cloud telephony | SOC 2 Type II | Call recordings and transcripts |
| Bird (MessageBird) | SMS notifications | SOC 2 Type II · ISO 27001 | Phone numbers and message content |
| Fathom | AI meeting transcription | SOC 2 Type II · HIPAA | Meeting audio and transcript |
| Slack | Internal and shared channel comms | SOC 2 Type II · ISO 27001 | Conversation only, no CRM data |
| Qwilr | Proposals and quotes | SOC 2 Type II | Prospect and client proposal data |
AI providers
Two, named. Anthropic runs on no-training commercial terms with per-tenant keys for client tools, and is the only AI provider in our own stack. Fathom, listed under workplace tools above, transcribes meetings.
| Subprocessor | Purpose | Certification | What it can touch |
|---|---|---|---|
| Anthropic (Claude) | Reasoning, code, agent runtime | SOC 2 Type II · no training on inputs | Minimised, per-tenant keys for client tools |
Security and identity
Source control, password management and device management. No client data.
| Subprocessor | Purpose | Certification | What it can touch |
|---|---|---|---|
| GitHub | Source code, code review, audit logs | SOC 2 Type II · ISO 27001 | Code only, no client data |
| 1Password | Password management | SOC 2 Type II · ISO 27001 | No client data |
| Mosyle | Mobile device management | SOC 2 Type II · ISO 27001 | Device metadata only |
How a subprocessor gets added
We give written notice at least 30 days before adding any subprocessor that could process client data. Clients may object in writing, in which case we will work with you to find an alternative.
Insurance and legal
Renewed Feb 2026
$2m professional indemnity per claim, $20m public liability, cyber cover capped at $1m.
Covered, current, on file. We hold professional indemnity of $2m per claim ($6m aggregate a year), public liability of $20m and cyber cover capped at $1m, with Berkley Insurance Australia. The policy was renewed in February 2026. The certificate of currency is available on request from the document bundle.
- Professional indemnity. $2m per claim, $6m aggregate a year. Covers errors, omissions and professional negligence.
- Public liability. $20m. General liability for business operations.
- Cyber. Capped at $1m. Data breach and cyber incident cover.
The questions your team usually asks
Updated 02.10.2026
NDAs, hosting, AI, certifications, breaches, insurance and what happens when we finish.
If yours is not here, ask it. We answer in writing.
Do you sign NDAs and Data Processing Agreements?
Yes. We counter-sign your mutual NDA and execute a DPA before work begins, or provide ours. Request either via our contact page.
Where is our data hosted?
Your CRM data stays in your own platforms, and HubSpot data for Australian and New Zealand clients is hosted in Sydney. Anything we host ourselves, including any working copy of records a tool we build for you needs, runs in Sydney. AI inference (Anthropic) and meeting transcription (Fathom) run in the United States.
Do you use our data to train AI models?
No. No client data is used to train or fine-tune any AI model. Where a tool we build for you uses AI, it runs on a dedicated key scoped to your tenant. Most of our work runs on the commercial Claude Team plan, with the Anthropic API for AI features in client tools, both under no-training commercial terms.
Can we audit you, or send our own security questionnaire?
Yes. We complete your standard security questionnaire and provide our document bundle: Mutual NDA, DPA and insurance certificate of currency. Request it from the document bundle.
What happens to our data and access when an engagement ends?
We follow a formal off-boarding checklist: all access and API keys are revoked or rotated. On written request we delete or return your data within 30 days. Otherwise client and project data is kept for up to 5 years, and financial records for up to 7.
Are you SOC 2 or ISO 27001 certified?
Not yet. We align with the Privacy Act and the APPs, the Notifiable Data Breaches scheme and the OWASP Top 10, and self-assess against the Essential Eight. An external penetration test is planned for Oct to Dec 2026, with SOC 2 Type I readiness and an ISO 27001 gap assessment in 2027.
Who at Neighbourhood can see our portal?
Only the people working with you, each on their own named login, with no shared accounts. Super Admin is given only when the work needs it, and removed when that work ends.
Do your AI agents change our CRM on their own?
No. Our AI agents never write to your CRM without a person approving the change. Anything destructive or irreversible stops and waits for a person.
Where does AI processing happen?
In the United States. Prompts go to the Anthropic Claude API, which does not train on them and keeps them for up to 30 days for trust and safety. Google Gemini is used for internal work only, never on client data.
How fast do you tell us about a breach?
Within 24 hours of a confirmed incident. That is our contractual commitment to you, and it runs alongside our duties under the Notifiable Data Breaches scheme.
Is your team based in Australia?
Yes. Everyone at Neighbourhood with access is employed in Australia and works onshore, and none of them work overseas. All of them complete security and AI training.
What insurance do you hold?
Professional indemnity of $2m per claim ($6m aggregate a year), public liability of $20m and cyber cover capped at $1m, with Berkley Insurance Australia. The certificate of currency is in the document bundle.
How do we report a vulnerability?
Email weare (at) nbh.co or use our contact page. We acknowledge within one business day, and good-faith researchers are covered by our safe harbour.
Which subprocessors do you use, and will you tell us before adding one?
All 18 are listed above, with what each one can touch. We give 30 days written notice before adding one that could access client data, and you can object in writing.
Do you keep backups?
Yes. NBHOS, Billing and Solutions are backed up daily and the last seven are kept, so the recovery point is at most 24 hours. Backups for client tool servers are set per engagement.
Trust Centre · v2.6 · last updated 02.10.2026 · Privacy Policy · Terms and Conditions