Security & privacy

• Your data is stored in Australia, in Sydney.
• Each company is walled off from every other. Another company cannot see your inspections, photos or people, and automated tests check that on every change we make.
• AI only runs when you ask it to. Nothing is sent to an AI service in the background.
• Tortu staff access is recorded. Every time one of our administrators looks at a company's records, it is logged.
• You can close your account, and your data is then permanently deleted.

Data travels between your device and Tortu over encrypted connections (HTTPS), and Google Cloud encrypts it where it is stored.

The one exception is the AI features: when you choose to use one, the files it needs are processed outside Australia. See What AI does with your photos and audio below.

• People in your company, according to their role (Owner, Admin or User).
• Outside contractors you invite see only the inspections you assign to them, not the rest of your company.
• Other companies can't see anything of yours. This is enforced by the database's own security rules, not just by the app's screens, and automated tests try to break through it on every change.
• Photos and files are only ever shown through links that stop working after 15 minutes, and only to signed-in people who have access to that inspection.

Tortu staff. A small number of Tortu administrators can look at account details (company name, people, credit history) to help with support and billing. Our admin console does not show your inspections, forms or photos, and every look is recorded: who, what and when.

• Passwords must be at least 10 characters, with a letter and a number.
• New accounts confirm their email address with a code sent to it.
• Only Owners and Admins can give someone Admin rights, and ownership of a company can only be handed over by the current Owner, never by an invitation.

AI in Tortu never runs on its own. It only runs when someone presses the AI button and confirms the credit cost.

AI Fill (filling in a form from its photos and voice notes) sends that form's photos, voice notes and attached PDFs to Google's Gemini AI service, which reads them and suggests answers. The suggestions are saved to your form for you to check.

• This processing happens on Google's servers, outside Australia.
• The copies sent to Google are deleted automatically by Google within 48 hours. Your originals stay in your storage in Sydney.
• Only the form you pressed the button on is sent, nothing else.
• Tortu uses Google's paid AI service, under which Google does not use what we send it to train its AI models.

Template AI (building a form from a description or an existing PDF) sends the text or PDF you give it to Anthropic's Claude AI service, also outside Australia. No site photos are involved.

Tortu itself does not train any AI on your data.

A company Owner can close the account from their profile page.

1. 1For 30 days after closing, you can change your mind. We'll email reminders.
2. 2Everything is then permanently deleted within 90 days of closing: inspections, forms, photos, voice notes, templates, projects and people's accounts. It can't be recovered after that.

What we keep. Australian tax law requires business records to be kept for five years, so when an account is deleted we keep one record: the company name and ABN, the owner's name and email, when the account opened and closed, and its credit transactions. It contains none of your inspections, forms or photos.

Yes. Your records, photos and files are stored in Sydney, and the app runs from Sydney. The only time anything is processed overseas is when someone chooses to use an AI feature. See What AI does with your photos and audio.

No. Each company's data is separated by the database's own security rules, which apply no matter how someone tries to reach it, and we test that separation automatically on every change.

No. An outside contractor sees only the inspections you assign to them. They can't see your other inspections, projects, templates or people.

No. Tortu doesn't train any AI on your data, and the AI service that reads your photos and audio (Google's, on its paid tier) doesn't use them to train its models either. They only go to it when someone in your company presses an AI button, and only for that one form.

Yes, in the Tortu mobile app, if the inspector allows it. When a photo is taken with the app's camera, the phone's position and the time are saved with that photo, so an inspection shows where and when each photo was taken. The app uses the phone's location only while its camera is open, and saves it only when a photo is taken.

An inspector can decline location access and still take photos; those photos are marked as having no location. People who can see the inspection can see where its photos were taken. Photos added through the website only carry a location if the file already contained one.

Our admin console is built for support and billing. It shows account details and credit history, not your inspections, forms or photos. Every time an administrator opens a company's records, it is logged.

An Owner can close the account. You have 30 days to change your mind, and everything is permanently deleted within 90 days of closing, apart from the small business record tax law requires us to keep. See What happens when you close your account.