Trust Centre
Sovereign by design, with a person in charge.
Where student data lives, who processes it, and the controls that make sure a member of your team approves what students receive.
At a glance
Hosted in Sydney
The platform and its database run in AWS Sydney. A policy on our AWS accounts blocks resources in any other region.
AI that stays in Australia
Claude models run inside AWS through Australia-only profiles (Sydney, with Melbourne as overflow). Global and Asia-Pacific routing is blocked.
A person approves every message
AI drafts; your staff approve. Nothing written by AI reaches a student without a recorded staff approval.
Minimum data
Retento holds the support conversation and its outcome, never the student record. No grades, fees, attendance or enrolment data.
Controls
How we protect students.
Human in the loop and safety
- Free-form AI text always needs a staff approval, and the approval is recorded with who approved it and when.
- The only messages sent without per-message approval are your institution-approved templates, verbatim knowledge articles, and a fixed safety reply your wellbeing team signs off.
- Safety disclosures go straight to a person. AI drafting pauses on that conversation.
- Students opt in before any message, and STOP is honoured immediately.
- The AI is always disclosed and never claims to be human.
Isolation and encryption
- Each institution's data is isolated by database row-level security: every query runs in one institution's context.
- Data is encrypted at rest with AWS KMS keys, and in transit with TLS.
- Automated tests check that one institution can't read another's data.
Access
- Fixed roles with a published permission matrix. Admins configure the platform but don't see student cases unless they also hold a casework role.
- Sending a campaign needs a separate, per-person grant.
- Retento staff have no standing access. A support session is time-limited, needs a reason, can't contact students, and is shown in your access log.
Scope and retention
- Retento works on what students say they need, across five support areas. It doesn't track or chase fees, attendance, enrolment, census dates or visa matters.
- Escalations to your systems carry a fixed, minimum set of fields, and every escalation has a return path so none is silently dropped.
- Message content and case notes are deleted on a retention schedule agreed with each institution. Our default keeps concern summaries for 12 months after a case closes.
Sub-processors
Who processes data for us.
The providers that process institution or student data on Retento’s behalf. We’ll give customers notice before adding one. Last reviewed 15 October 2026.
Amazon Web Services
SydneyHosting, storage, computing, security and monitoring.
Platform data, including student contact details, conversations, case notes and staff accounts.
Amazon Cognito
SydneyStaff sign-in and account security.
Staff names, email addresses and sign-in records.
Amazon Simple Email Service (SES)
SydneyEmail to students and staff, and email-to-ticket escalations.
Email addresses, message content and minimum escalation fields.
Amazon Bedrock (Anthropic Claude models)
Sydney, Melbourne overflowSupporting triage and drafting replies that are reviewed by authorised staff.
Student message content, minimised in accordance with Retento's data-minimisation controls.
Sinch (Australian entity, formerly MessageMedia)
Australian endpointSending and receiving student SMS messages and managing dedicated numbers.
Student mobile numbers, message content and delivery receipts.
Google Workspace
May be outside AustraliaRetento staff email, support inboxes and portal authentication.
Retento staff information and information sent to Retento support by an institution or student.
Full details, including services used and overseas disclosures, are in our Privacy Policy.
Anthropic
AI models by Anthropic, run inside AWS in Australia through Amazon Bedrock. Anthropic does not receive your data, and AWS doesn't use prompts or outputs to train models.
Your own systems
In Connected mode, escalations go to the support system you choose, such as ServiceNow, Salesforce, Dynamics, Zendesk or email. You control those systems; Retento sends only the minimum escalation fields, at your direction.
Retento support staff
If you ask us for help, a Retento engineer can open a time-limited support session. It needs a stated reason, can't contact students or send anything, and appears in your access log.
Compliance
The frameworks we work to.
- Privacy Act 1988 (Cth) and the Australian Privacy Principles
- Information Privacy Act 2009 (Qld) and IS18 for Queensland public-sector customers
- Notifiable Data Breaches scheme
- ISO/IEC 27001: certification pathway in progress (not yet certified)
For your security and privacy assessment
We’ll send our security pack: architecture and data-flow overview, the escalation data contract, our sub-processor register, data retention schedule and a completed security questionnaire on request.
Found a security issue? Email zac@retento.com.au.