AI use policy

Catharsis is a cyber security company, and we help clients adopt AI safely. You should be able to see how we use AI ourselves. This policy explains which AI tools we use, what we never put into them, and how we make sure a person is accountable for everything we deliver.

It applies to everyone who works for or on behalf of Catharsis, and to all client work, internal work and this website.

For day-to-day business operations, we use local AI: private large language models (LLMs) hosted within our own organisation, on infrastructure we control. Prompts and documents stay inside our environment. They aren’t sent to public AI services, and they aren’t used to train anyone else’s models.

These private tools help our team work more efficiently, for example by:

• summarising long technical material, such as vendor advisories and standards
• preparing first drafts of documents and reports for our team to review and finalise
• reviewing code and scripts
• organising notes and research

We don’t use AI to replace the judgement of an experienced security practitioner. Security findings, risk ratings, advice and recommendations are always made by a member of our team.

Some content on this website was drafted with the help of AI tools, then reviewed and approved by our team before publication.

Our everyday AI tools are private LLMs that we host and manage ourselves. Before we approve any AI tool for business use, we check where it stores data, whether it uses our inputs to train its models, who can access the data and how long it is kept.

Unless a tool is approved for that type of data and your contract allows it, we never enter:

• client confidential information, such as network details, findings or configuration files
• passwords, keys, tokens or other credentials
• personal information about clients, client staff or members of the public
• information covered by a non-disclosure agreement or security classification

Where we want to use AI on client data to deliver a service faster or better, we ask you first and explain which tool, what data and why.

AI-assisted work is reviewed by a member of our team before it is used or reaches a client. That person is accountable for its accuracy, just as they would be for work they wrote themselves. We check AI output for errors, made-up facts and references, and security issues in any code.

When we help clients adopt AI, such as Microsoft 365 Copilot, AI automation or private AI models, we design the project so you know where your data goes. With Microsoft 365 Copilot and private AI models, data stays within your tenancy or on systems you control; where an automation uses an external AI service, we tell you which provider, what data it receives and where it is processed before you approve it. We design these projects around data protection, access controls and governance aligned with ISO/IEC 42001 and the National AI Centre’s Guidance for AI Adoption. See secure AI for how we work.

AI tools are part of our information security management system, which is certified to ISO/IEC 27001:2022. They go through the same supplier checks, access controls and reviews as any other system we use, and we watch for AI-specific risks such as prompt injection and data leakage.

We review this policy regularly, and whenever our tools, the law or recognised guidance changes.

Questions about how we use AI? Email info@catharsis.net.au or send us a message.