What your agents send, where it lives, and who can see it.
KoalaFix holds two kinds of data for your team: live check-ins and the team memory. This page says plainly how both are handled. Updated 27 October 2026.
How it fits together.
Your agents connect to one hosted KoalaFix server over MCP, the same way they connect to any other tool. Nothing is installed on your machines beyond the AI tools you already use, and KoalaFix never reads your code. It only ever holds what an agent chooses to send: its check-in, and the decisions it records.
Where it lives.
- Hosting
- Microsoft Azure in Sydney, Australia. Each team has one home region that holds all of its rows and takes all of its writes, so its data does not move between regions.
- Database
- PostgreSQL, reachable only from the KoalaFix service. Enterprise teams can keep the memory in a database they run themselves.
- In transit
- Every connection between your agents and KoalaFix is encrypted. Agents authenticate with a token tied to a person and a team.
- AI processing
- Two narrow jobs use Microsoft Azure OpenAI Service: turning memory text into search vectors, and checking a new memory against existing ones so duplicates and contradictions are caught. Microsoft states that this data is not used to train its models.
- Everything else
- Billing, email, hosting and monitoring providers are listed, with what each one sees, in the subprocessor register.
Who can see what.
- Your team
- Check-ins and the team lane of the memory are visible to every member of your team, in whichever tool they use. Nobody outside the team can read them.
- Each person
- Private notes an agent saves for one person are read back only by that person’s agents.
- Joining
- People join a team by invitation and sign in with their work email. Enterprise teams can use single sign-on and provisioning instead.
- KoalaFix
- We do not read your team’s memory. Access is logged, and we use the logs to run and secure the service, not to look at content.
- Leaving
- Cancel and nothing is deleted: your team moves to the Basic plan and keeps the last 60 days of memory. Ask and we delete the lot.
Where we are, honestly.
KoalaFix is not SOC 2 certified. KoalaFix Pty Ltd was registered on 16 March 2026 and the product is early. We won’t show a badge or an “in progress” sticker until an auditor has signed a letter. If that is a blocker for your procurement team, book a call and tell us what bar you need.
KoalaFix is approved for OpenAI's Daybreak program (Trusted Access for Cyber), which gives vetted security teams expanded model access for defensive work on their own systems.
Found a security issue?
Email support@koalafix.com with “security” in the subject. We acknowledge within 24 hours, seven days a week, and triage by severity.
The paperwork
- Security: the formal statement of how we protect your data
- Privacy Policy: what we collect, how long we keep it, your choices
- Data Processing Addendum: our obligations as your processor
- Subprocessor register: every provider, with 30 days’ notice of changes
- security.txt: how to reach us, machine-readable
Decide once. Every agent remembers.
Every agent checks in before its first edit and works from one memory that keeps itself up to date, in every tool your team uses.
Start free