Trust
Trust is earned through transparency, so here is exactly where your data lives, who touches it, and what we will and will not do with it.
Where your data is hosted
MechOS is built and run by an Australian company, MechOS Pty Ltd (ABN 80 698 552 706), for Australian workshops, and supported from Australia.
Your workshop data is held in managed cloud infrastructure. Our primary database is currently hosted in Australia (Sydney), and the subprocessors listed below operate in several countries. Where personal information is handled outside Australia we take reasonable steps to ensure protections consistent with the Australian Privacy Principles, and we remain accountable for it.
We may move or add infrastructure regions as we grow. This page is the current record — the table below is kept accurate, and we will update it rather than leave it behind.
Your data is yours
- You own the data you put into MechOS.
- We do not sell it.
- We do not use your customer data for advertising or behavioural profiling, and we never market to your customers.
- We use it only to run the service for you. Full detail is in our Privacy Policy.
Backups & availability
Automated daily backups on a rolling 7-day window, separate encrypted off-site copies taken every six hours, and restores we actually test on a schedule. The full picture is on our Security page.
Subprocessors
These are the third parties that process data on our behalf to deliver MechOS. We keep this list current as our infrastructure evolves.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, file storage | Australia (Sydney) |
| Vercel | Application hosting + global edge network; visitor statistics on the public website | United States / global (app servers in Sydney) |
| Resend | Transactional email (invoices, reminders, notifications) | Japan (Tokyo) |
| Anthropic (Claude) | AI features — job notes, dashboard summaries, import mapping | United States |
| Sentry | Error monitoring | United States |
| PagerDuty | Incident alerting | United States |
| Google Maps Platform | Address lookup / autocomplete | United States / global |
| Payment providers | Billing + in-shop card payments — only if you enable them | Australia / United States |
| Podium | SMS / customer messaging — only if you enable it | United States |
| Twilio | MechOS SMS (texts sent by MechOS) — only if you enable it | United States |
Export & deletion
- Export any time. Your data is yours to take with you.
- Delete on request. Deleting your organisation disables access immediately, keeps a 30-day recovery window, then securely deletes your data from our active systems (see the Privacy Policy for retention detail).
Compliance
Today
- Built to align with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles.
- A Notifiable Data Breaches process, so affected users and the OAIC are notified if ever required.
- Full data export, deletion on request, and an audit trail of who changed what.
- Optional two-factor authentication (2FA) for user accounts, enforced at the database once it’s set up.
On our roadmap
- Single sign-on (SSO) for larger teams.
- A formal, independent security assessment as we scale.
We would rather show you a clear roadmap than claim a badge we do not hold. If you are evaluating MechOS and need more detail, we are glad to walk through a security questionnaire — security@getmechos.com.au.