Pyron AI and Automated Processing Statement

What this covers

Pyron AI is the assistant that answers questions and builds pages, automations and reports, and the AI steps a customer can put into an automation. This statement describes how it handles a customer's data, for the customer's security and privacy reviewers. It adds detail to Parts 7 and 8 of the Privacy Statement and clause 23 of the Website Terms, which prevail if anything here differs.

Where the AI runs

• Pyron AI is supplied through Amazon Bedrock using Anthropic Claude models. Techly does not host, train or own a foundation model.
• Inference runs on Amazon Bedrock in Australia, through Bedrock's Australian cross-region profile, which keeps each request within the Sydney and Melbourne regions.
• Every model Pyron uses is Pyron's own, on Bedrock. A workspace cannot bring an AI provider of its own.
• Search by meaning works from an index built by a model on Amazon Bedrock in the Sydney region.
• When the assistant or an automation searches the web, the search goes through Amazon Bedrock AgentCore, through our gateway in Sydney. AWS states that such a query is served within AWS and is not sent to a third-party search engine. It does not say that the query is answered from Australia.

Your data is not used for training

Customer Data is not used to train foundation models and is not shared with the model provider for training. Amazon Bedrock states that inputs and outputs are never shared with model providers and never used to train base models. Techly does not use Customer Data to train, fine-tune or adapt any model, its own or anyone else's.

The AI acts with your permissions

• The AI works with exactly the permissions of the person it is acting for. There is no separate set of AI permissions and no elevated account: what is outside that person's access is outside the AI's.
• Its activity is recorded on the workspace's audit trail like any other actor's, as made by Pyron AI on that person's behalf.

What waits for you

The AI applies a change at once only when all of these are true: it was tried first and nothing in it would be refused; it deletes, publishes, sends and grants nothing; and it changes nothing a person made. Anything else is proposed with a preview of what it will do, and waits for the approval of the person the AI is acting for. In particular:

• anything Pyron AI would delete, publish, send, or use to grant access waits for approval;
• a change to something a person made waits for approval;
• switching an automation on, or changing what a live automation does, always waits for approval.

Applying an approved change runs each step with the approver's own permissions, so it never does what the approver could not do.

AI steps in automations

An automation a customer sets up may ask Pyron AI to read, classify, summarise or draft from a record without a person present.

• The automation runs as an account an admin chose for it, and does only what its approved version declares. When someone switches it on, Pyron shows that it uses AI, and their approval covers that.
• An AI step can read what that account may read, and only through the same permission checks as everything else.
• What the automation does with the AI's answer is the customer's configuration and decision. Where it could affect a person, the customer is responsible for providing a route to human review.

Guardrails

Every request to the AI passes through Amazon Bedrock Guardrails:

• content filters for sexual content, violence, hate, insults and misconduct;
• detection of prompt attacks, on what people type and on what automations read;
• blocking of secrets, such as keys and tokens, in the AI's answers;
• masking of card numbers in the assistant's answers.

A workspace's admins choose how strict the content filters are, or give the workspace a guardrail of its own with topics the AI must decline. When a guardrail intervenes, the AI is told and corrects its course, and each intervention is recorded.

Budgets

Admins set monthly AI budgets, in Australian dollars, for the workspace, each role, each person and each automation. At its limit, an automation waits and asks someone. It never switches to a weaker AI.

AI output is decision support

What Pyron AI produces is decision-support information. It is probabilistic, may be incomplete or wrong, and must be checked by a competent person before it is relied on for an operational, safety, financial, employment, legal or similar decision. Pyron AI drafts, answers, classifies and recommends. It is not designed to make a legal determination about a person.

Your own privacy policy

From 10 December 2026, Australian Privacy Principles 1.7 to 1.9 apply. If an organisation uses a computer program to make a decision that could reasonably be expected to significantly affect a person's rights or interests, or to do something substantially and directly related to making one, and the program uses personal information, its privacy policy must say:

• the kinds of personal information the programs use;
• the kinds of decisions made solely by the programs;
• the kinds of decisions for which the programs do something substantially and directly related to making the decision.

For what a customer does in Pyron, the customer is responsible for its own privacy policy, and Techly processes the data on the customer's instructions. Whether an automation is within these principles depends on how the customer has set it up. This statement helps the customer answer:

• What Pyron AI does on a person's request makes no decision about anyone by itself: it acts with that person's permissions, and what matters waits for their approval.
• An automation that acts without a person confirming, such as one that routes, prioritises, approves or declines, can make a decision solely by a computer program. The customer's privacy policy should name the kinds of decision it makes, and the personal information it reads.
• An automation with an AI step that classifies, summarises or recommends for a person who then decides does something substantially and directly related to a decision. The customer's privacy policy should name the kinds of decision it supports, and the personal information it reads.

A customer may adapt this wording, after checking it against its own automations: "We use Pyron, a workflow platform supplied by Techly Operations Pty Ltd, to [describe the process]. Some steps run automatically, and some use artificial intelligence, through Amazon Bedrock in Australia, to [classify, summarise or recommend]. These use [the kinds of personal information]. [Name any decision made without a person reviewing it.] You can ask for a decision to be reviewed by a person by contacting [contact]."

This is information to help a customer, not legal advice.

Other automated processing

Part 8 of the Privacy Statement lists all the automated processing in Techly's platforms, including processing that does not use AI.

Review

The Data Protection Officer reviews this statement every year, and whenever Pyron's AI, its models or where they run changes in a way that affects it.