Statement
Privacy
Last updated 25 September 2026
Remit holds the names, work email addresses and roles of agency staff who use it, and the descriptions, assessments and evidence agencies record about their AI use cases. This statement explains how that information is handled.
What is collected
Staff account details (name, work email, position, roles), sign-in records, and everything an agency enters about its AI use cases, including uploaded evidence documents.
Why it is collected
To operate the AI use case register and impact assessment workflow the agency uses to meet the Policy for the responsible use of AI in government, and to keep an audit trail of decisions.
Where it is stored
Each agency's Remit runs as its own instance, so one agency's records are never held alongside another's. The agency chooses where its instance runs: in its own data centre, in a cloud platform it selects, or hosted by Remit in a region it selects. Remit is tested today on Microsoft Azure, and support for other platforms is planned. Where Remit hosts it, as for remitai.com.au, the service runs on Microsoft Azure in the Australia East region: the application, its database, uploaded documents, secrets and operational logs all stay in that region, and stored data is encrypted at rest. Where the agency runs it, the records never leave the agency's environment and Remit has no access to them. When an agency turns on AI assistance, only the text a feature needs is sent to the Anthropic API for that call; How Remit uses AI sets out what is sent. Remit is designed for IRAP assessment and has not yet been assessed.
Who can see it
Only signed-in users of the same agency. Platform operators can see agency names and counts, never an agency's records. Every query is scoped to the agency.
How long it is kept
Records are kept for as long as the agency uses Remit. The audit log is append-only: the database refuses any change to it or deletion from it. A use case can be deleted only if it was created in error and nothing has happened on it yet; after that it is archived, which keeps the whole record. Accounts are deactivated, not deleted, so the audit trail still names who did what. Sign-in sessions end after 60 minutes idle, or the period the agency sets. Where Remit hosts the instance, database backups are kept for 7 days and operational logs for 30 days; where the agency runs it, the agency sets these. How records are returned or destroyed when a service ends is agreed in each agency's contract. Website contact requests are kept until the request is closed and are deleted on request.
Your rights and contact
Remit handles personal information under the Australian Privacy Principles in the Privacy Act 1988. An agency controls the records in its own instance, so first ask your agency's Remit administrator to see or correct your details. You can also contact us through the form at remitai.com.au/contact. We will acknowledge your request within 5 business days and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).