.webp)
Cybersecurity Policy for Generative AI
How we use AI safely and keep your information confidential. Profit Cloud Accounting (Depacioli Pty Ltd, ABN 67 160 934 538). Policy owner: Damian Bartholomeusz, Principal and registered agent. Next review: by October 2027.
Last updated: 25 October 2026
What this means for you
This is the policy our team follows when using AI. We publish it so you can see exactly how your information is protected. In short:
-
Your information is only used in AI tools we have approved, through business accounts that keep it confidential. Never in free or personal AI accounts.
-
We only enter the information a task needs, and leave out details like TFNs and bank account numbers where practical.
-
A qualified person checks all AI-assisted work, and a registered agent remains responsible for any advice we give and anything we lodge for you.
-
If something goes wrong, we act straight away and notify you and the OAIC where the law requires.
Questions? Contact us at admin@profitcloud.online. The full policy our team follows is below.
1. Purpose
This policy sets out how our team must use generative artificial intelligence (AI) tools responsibly and securely when working on client matters and running our practice. Generative AI is technology that creates text, images, summaries or other content in response to prompts or documents.
AI is now built into much of the software we use, including Xero, QuickBooks and Google Workspace. When we use those systems, client information is processed by their AI features. This policy explains which AI tools may be used with client information, which may not, and the safeguards that apply.
2. Who this policy applies to
This policy applies to everyone who works for or with Profit Cloud, including Depacioli Pty Ltd staff, contractors and anyone working under the supervision of The Accounting Academy Services Pty Limited (our supervising registered agent) on Profit Cloud matters.
3. Client information in AI tools – 3.1 What is permitted
Client information, including personal and confidential information, may be used in:
-
AI features built into our approved business software, including Xero, QuickBooks and Google Workspace; and
-
AI tools on the Approved tools list (section 4), used through a business or enterprise account that Profit Cloud has approved.
Clients consent to our use of these systems and tools through our engagement letter.
3.2 What is not permitted
-
Do not enter client information, or confidential Profit Cloud information, into any AI tool through a free, personal or consumer account, even if the same tool is available as an approved business version.
-
Do not use an AI tool that is not on the Approved tools list for client work. If you want to use a new tool, ask the policy owner first.
-
Do not use AI tools to do anything that would breach the law, our professional obligations, a client's instructions or this policy.
3.3 Use only what is needed
Only enter the client information a task needs. Where practical, leave out or remove details that are not needed, such as tax file numbers, bank account numbers and identity document numbers.
4. Approved tools
The approved AI tools, and the type of account each must be used through, are listed below. A tool may only be added to this list by the policy owner, after checking that its business terms keep client information confidential and that its security settings are suitable.
Tool | Account type | Approved uses | Approved by / date |
|---|---|---|---|
Xero | Business – managed by Profit Cloud | Accounting and bookkeeping, including built-in AI features | Damian Bartholomeusz, 25 October 2026 |
QuickBooks | Business – managed by Profit Cloud | Accounting and bookkeeping, including built-in AI features | Damian Bartholomeusz, 25 October 2026 |
Google Workspace | Business – managed by Profit Cloud | Email, documents and file storage, including built-in AI features | Damian Bartholomeusz, 25 October 2026 |
Gemini (Google) | Business – managed by Profit Cloud | Drafting, research, summarising, extracting data from documents | Damian Bartholomeusz, 25 October 2026 |
ChatGPT (OpenAI) | Business – managed by Profit Cloud | Drafting, research, summarising, extracting data from documents | Damian Bartholomeusz, 25 October 2026 |
Grok (xAI) | Business – managed by Profit Cloud | Drafting, research, summarising | Damian Bartholomeusz, 25 October 2026 |
ElevenLabs | Business – managed by Profit Cloud | AI voice assistant answering visitor questions on our website | Damian Bartholomeusz, 25 October 2026 |
Wix | Business – managed by Profit Cloud | Website platform, including built-in AI features | Damian Bartholomeusz, 25 October 2026 |
AI features built into Xero, QuickBooks and Google Workspace may be used as part of those systems under our business accounts.
5. Checking AI output and responsibility
-
AI output can be wrong, incomplete or out of date. Check AI-assisted work before relying on it, sending it to a client or lodging anything.
-
A registered agent remains responsible for the advice we give and for everything we lodge on a client's behalf, whether or not AI was used to help prepare it.
-
Do not present AI output as a final position without professional review.
6. Access and security
-
Use only accounts that Profit Cloud has set up or approved, and do not share login details.
-
Use multi-factor authentication (MFA) on every AI tool and business system that offers it.
-
Keep devices, browsers and software up to date, and use the security settings the policy owner approves.
-
Where an approved tool offers settings to stop prompts or content being used to train its models, or to limit how long data is kept, use them where available.
7. Storage outside Australia
Some AI and software providers store or process information outside Australia. Details are in each provider's published terms. Our Privacy Policy explains how we handle
personal information, including storage and processing outside Australia.
8. Incidents
If you think client or Profit Cloud information has been entered into a tool that is not approved, has been exposed, or has been accessed without authority, tell the policy owner straight away. We will assess the incident and, where the law requires it, notify the people affected and the Office of the Australian Information Commissioner (OAIC).
9. Training
Everyone covered by this policy must read it and complete the AI and cybersecurity training the policy owner provides, and refresh it when the policy changes.
10. Breaches of this policy
Breaching this policy may lead to disciplinary action, up to and including ending employment or a contract.
11. Review
The policy owner, Damian Bartholomeusz (Principal and registered agent), will review this policy at least every 12 months, and sooner if our tools, the law or professional guidance change. Next review: by October 2027.