This page describes how Block Mondo Corporation Pty Ltd protects the information that organisations and their people entrust to the Block Mondo platform. The specific commitments that apply to each customer are set out in that customer's cloud services agreement.
Data location and hosting
The Block Mondo platform is hosted in Australia on Microsoft Azure or Amazon Web Services, or as specified in the customer's cloud services agreement. Customer data is stored in the same location.
The service providers that process customer data on Block Mondo's behalf, and where they do so, are listed on the Subprocessors page.
Data protection
- In transit. All connections to the platform are encrypted using industry-standard transport security, and browsers are instructed to connect securely only.
- At rest. Customer data is encrypted at rest using the encryption services of the hosting provider.
- Credentials and keys. Credentials, encryption keys and connection secrets are held in the hosting provider's secure configuration and key management services, and are never kept in the platform's source code.
Separation of customer data
Each organisation's data is kept separate from every other organisation's. Access to data is restricted to the organisation it belongs to.
The Enterprise Edition may be provided on dedicated infrastructure. The arrangements that apply to each customer, including any dedicated environment, are set out in its cloud services agreement.
Identity and access
- People sign in with a verified email address and a password that must meet strength requirements.
- Two-step sign-in is required by default. An organisation's owner or administrator may change this setting, and every change is recorded.
- Accounts are protected against repeated failed sign-in attempts.
- Within an organisation, access is granted by role. Owners and administrators manage members, roles and licences, and each person sees and does only what their role allows.
Accountability and records
- Changes to records are attributed to the person or service that made them, and when.
- Decisions made by the platform's AI governance controls are recorded in a tamper-evident audit trail.
- Records can be placed under legal hold, and retained or disposed of in line with an organisation's retention schedule.
Artificial intelligence
- A person's own AI agent, such as the Cadence coaching agent, is private to that person. They decide whether it keeps notes, can see everything it keeps, and can delete any or all of it at any time.
- Block Mondo makes every reasonable effort to detect private or sensitive information before it is shared with an AI model. Automated detection is not guaranteed to find everything, so users should not enter private, sensitive, secret or regulated information into an AI feature unless their organisation has expressly permitted it.
- AI responses are reviewed against the governance policy that applies to each agent before they are shown.
- Where an organisation sees information about coaching outcomes, it is shown only in aggregate, and only where enough people have contributed that no individual can be identified.
Privacy and individual rights
- Individuals can access, download and delete the information their personal AI agent holds about them.
- An organisation's data can be exported, and is deleted at the end of its subscription, in accordance with its cloud services agreement.
- Block Mondo's Australian Privacy Policy explains how personal information is collected, used, disclosed and stored, and how to request access or correction or make a complaint.
Service status and maintenance
For service status, maintenance notices and incident updates, see Service Status and Maintenance on the Block Mondo website.
Keeping up with law and practice
Block Mondo reviews developments in privacy, artificial intelligence and security law and its providers' terms every quarter, and whenever a material change is announced. Each review is documented, and approved changes are reflected in its policies, customer documentation and published disclosures.
Enquiries
Block Mondo responds to security and privacy enquiries and supplier reviews on request. Contact Block Mondo through the details on this website.