AI-IN-A-BOX Statutory Privacy Impact Assessment (PIA-2026-V1)
Statutory compliance and data lifecycle assessment under the Australian Privacy Principles (Privacy Act 1988 Cth) and National AI Centre Australia AI Ethics Principles.
Operating Corporate Entity
LA MODA VENTURES PTY LTD
ABN: 41 633 197 216
Trading as: AI-IN-A-BOX and The AIBulletin
Statutory Framework
OAIC APP 1.2 & NAIC Practice 2.1
Security: OFFICIAL: SENSITIVE / COMMERCIAL-IN-CONFIDENCE
Audit Status: APPROVED & SEALED
Direct Inquiries & SLA
privacy@aigovern.biz
Statutory SLA: 30 Calendar Days
Effective Date: 2026-03-20
01. Executive Summary & Project Description
AI-IN-A-BOX is an enterprise Governance, Risk, and Compliance (GRC) software-as-a-service platform developed and operated by LA MODA VENTURES PTY LTD (ABN: 41 633 197 216). The system provides Australian Government agencies, statutory bodies, regulated financial institutions (APRA-regulated entities), and enterprise subscribers with structured mechanisms to safely assess, inventory, and govern artificial intelligence (AI) and automated systems.
The platform operates four primary governance systems:
- SYS-AIAF-26 (Australian AI Assurance Framework Risk Engine): Deterministic risk tier calculation under federal and NSW assurance frameworks.
- SYS-APRA-230 (APRA CPS 230 / ISO 42001 Vendor AI Risk Engine): Supply-chain fourth-party algorithmic tracing and operational risk scorecards.
- SYS-LLM-04 (Glass-Box Policy Copilot & Sovereign Concierge): Generative policy drafting equipped with client-side and server-side redactive sanitizers for government identifiers.
- SYS-SEC-01 (Statutory Security & Threat Profiling Engine): Anomaly mitigation and cryptographic authentication gates.
02. Information Lifecycle & Data Flow Mapping
Personal and organizational data lifecycles are restricted to legitimate compliance operations. Data is segregated into:
Storage Architecture & Residency
Primary Documents & Binaries: DigitalOcean Spaces located in Sydney, Australia (syd1) with bucket-level encryption at rest.
Relational Metadata: Neon PostgreSQL database (AWS us-east-1) with AES-256 encryption at rest and mandatory TLS 1.3 in transit.
Irreversible 30-Day Purge (APP 11.2)
Accounts scheduled for deletion enter an immutable 30-day grace period. An automated nightly Vercel Cron engine (/api/cron/purge-accounts) irreversibly shreds database rows, files, and billing profiles.
Zero LLM Training Guarantee: No customer data, prompt input, or uploaded compliance artifact is ever ingested or utilized to train external foundational AI models.
03. Assessment of the 13 Australian Privacy Principles (APPs)
| Principle | Statutory Requirement | AI-IN-A-BOX Operational Mechanism | Audit Status |
|---|---|---|---|
| APP 1 | Open and transparent management | Public Privacy Policy; dedicated Data Subject Rights portal; published Statutory PIA. | COMPLIANT |
| APP 2 | Anonymity & pseudonymity | Pseudonymous display names supported; unauthenticated sandbox previews. | COMPLIANT |
| APP 3 | Collection of solicited personal info | Restricts collection strictly to identity and tenant administration. Prohibits unsolicited sensitive data. | COMPLIANT |
| APP 4 | Dealing with unsolicited info | Automated ingestion regex guards reject documents containing TFNs, Medicare, CRNs, or IHIs. | COMPLIANT |
| APP 5 | Notification of collection | Statutory collection notices embedded in signup, checkout, and intake modals. | COMPLIANT |
| APP 6 | Use or disclosure | Personal data strictly used for GRC service provision. Prohibits sale, tracking, or model training. | COMPLIANT |
| APP 7 | Direct marketing | Prohibits third-party direct marketing. Product updates utilize transactional Brevo SMTP with unsubscribe. | COMPLIANT |
| APP 8 | Cross-border disclosure | US/EU subprocessors (Neon, Vercel, Brevo) bound by Standard Contractual Clauses (SCCs). | COMPLIANT |
| APP 9 | Government related identifiers | UUIDv4 identification strictly enforced; no government identifiers used as primary keys. | COMPLIANT |
| APP 10 | Quality of personal info | Self-service editing in Settings; formal rectification workflow with 30-day SLA. | COMPLIANT |
| APP 11 | Security & destruction | Passkeys, TOTP MFA, AES-256 storage, automated 30-day cryptographic purge under APP 11.2. | COMPLIANT |
| APP 12 | Access to personal info | Self-service JSON data export portal (APP 12 / GDPR Art. 20) in user settings. | COMPLIANT |
| APP 13 | Correction of personal info | Dedicated Statutory Rectification Form with dual-dispatch Brevo email confirmations. | COMPLIANT |
04. Automated Decision-Making (ADM) Impact Analysis (APP 1.7–1.9)
In compliance with OAIC Automated Decision-Making transparency standards and National AI Centre Practice 2.1, all algorithmic diagnostic engines undergo formal risk assessment:
Australian AI Assurance Framework Risk Engine
Computes risk tiers across stakeholder vulnerability, decision velocity, and deployment scale. System cannot certify or publish a determination without explicit human auditor sign-off.
APRA CPS 230 / ISO 42001 Vendor Risk Engine
Calculates supplier concentration and fourth-party AI dependencies. Serves as advisory diligence support for procurement officers.
Glass-Box Policy Copilot & Sovereign Concierge
Interactive LLM assistance with automated client-side and server-side regex detection of prohibited government identifiers before inference.
Statutory Threat & Session Anomaly Engine
Evaluates authentication telemetry and applies temporary 15-minute IP rate limits. Permanent suspensions require human administrator intervention.
05. Cross-Border Data Flow Safeguards (APP 8)
To deliver enterprise-grade cloud capabilities, select subprocessors operate outside Australia. Strict compliance safeguards are enforced under Australian Privacy Principle 8:
- DigitalOcean Spaces (Sydney syd1): Primary document store and customer vault remain within Australian territorial jurisdiction.
- Neon Inc. (AWS us-east-1): Serverless PostgreSQL store utilizing AES-256 encryption at rest and TLS 1.3 in transit under binding Data Processing Addenda.
- Vercel Inc. (Edge Network): Edge runtime acceleration and serverless application hosting.
- Brevo / Sendinblue (EU): Transactional email dispatch bound by GDPR Article 28 data processing covenants.
06. Risk Mitigation & Treatment Register
| Risk Vector | Inherent Risk | Mitigating Technical Controls | Residual Risk |
|---|---|---|---|
| Unsolicited ID Ingestion (TFN, Medicare, CRN, IHI) | HIGH | Regex pattern detection in dataProtectionPatterns.ts; HTTP 422 document rejection. | LOW |
| Indefinite Data Retention Post-Closure | HIGH | Vercel Cron purge engine (/api/cron/purge-accounts); 30-day grace period; multi-pass shredding. | NEGLIGIBLE |
| Unauthorized ADM Administrative Action | MEDIUM | Platform-wide AdmBadge.tsx disclosure; mandatory Human-in-the-Loop review gates. | LOW |
| Cross-Border Cloud Data Interception | MEDIUM | TLS 1.3 in transit, AES-256 at rest, SOC 2 Type II certified infrastructure. | LOW |
| Credential & Account Compromise | HIGH | WebAuthn/FIDO2 Passkeys, TOTP MFA, bcrypt password hashing, stateless JWT cookies. | LOW |
| Administrative Purge Accidents | CRITICAL | Hard-coded immutable safety guard for primary demonstration account contact@discedu.co. | NEGLIGIBLE |
07. Senior Responsible Officer Sign-off & Attestations
STATUTORY SIGN-OFF: PRIVACY OFFICER & DATA GOVERNANCE LEAD
Corporate Entity: LA MODA VENTURES PTY LTD (ABN: 41 633 197 216)
Trading As: AI-IN-A-BOX and The AIBulletin
Direct Inquiries: privacy@aigovern.biz / info@aigovern.biz
Statutory SLA: 30 Calendar Days (APP 12.4 / GDPR Art. 12)
Attestation Date: 20 March 2026
Status: APPROVED, SEALED & IMMUTABLE
STATUTORY SIGN-OFF: TECHNICAL & SECURITY ARCHITECTURE LEAD
Platform: AI-IN-A-BOX Enterprise GRC Platform
Infrastructure: DigitalOcean Spaces (Sydney), Neon PostgreSQL (Encrypted)
Controls Verified: Regex ID Sanitization, Multi-Factor Authentication,
30-Day Automated Purge Engine, Dual-Dispatch Audit Trails
Attestation Date: 20 March 2026
Status: VERIFIED & SYSTEM OPERATIONAL