KoalaFix
Sign in Get early access
Menu

Your team’s memory is yours. Here’s how we keep it that way.

KoalaFix only holds what your agents choose to send. We never sell it or train AI models on it, and it’s encrypted and kept apart from every other team.

Read our security practicesTalk to us about a review

Three things you can count on.

  1. It’s never sold

    We don’t sell or share your team’s memory, and we never use it for advertising. That’s a promise in our Privacy Policy and DPA, not just this page.

  2. It’s never used for training

    We don’t train AI models on your team’s memory, and we don’t let our AI providers train on it either.

  3. It’s kept to your team

    Every request is checked against the person’s membership and role in your Space, so other teams can’t reach your memory.

What leaves your machines, and what never does.

Your people’s agents connect to KoalaFix over MCP, like any other tool. They send check-ins, search questions and the decisions they choose to save. Our servers never go and read your code, files, tracker or chat.

Your agents J H O Over MCP, encrypted in transit Code Your code, files and chat Our servers never go and read them Check-ins Teammemory Hosted on Microsoft Azure Encrypted at rest, kept apart from other teams Your own database Enterprise option Your agents Your code J H O Code Never read by our servers Over MCP, encrypted in transit Check-ins Teammemory Hosted on Microsoft Azure Encrypted at rest, kept apart from other teams Your own database Enterprise option

Where it lives.

Storage
Microsoft Azure’s Australia East region, in New South Wales. Memory, check-ins, the team map and search logs live in Azure Database for PostgreSQL, and the backups stay in Australia too.
US and EU regions
We plan to open US and EU hosting as demand grows. We’ll tell your Admins before we move your Space’s data to another region.
Sign-in
Supabase in Sydney, with email and password or Google. Passwords are stored only as hashes, by Supabase.
Encryption
TLS in transit, with HSTS so browsers always connect securely, and AES-256 at rest, backups included. KoalaFix isn’t end-to-end encrypted, because the service has to read memory to search it.
AI processing
Azure OpenAI is the only AI provider that handles your memory for us. Embeddings for search are made in Australia East. The optional AI judge, which suggests clean-ups such as duplicates, runs on a global deployment, so Microsoft may process that text outside Australia. Microsoft doesn’t use any of it to train models.
Your own database
On the Enterprise plan, your Space’s memory can live in a Postgres database you own, which our hosted service connects to.
Everything else
Email, payments and DNS providers are listed, with what each one handles, on the Subprocessors page. We give 30 days’ notice before we add or replace one.

Keeping it, exporting it, deleting it.

Backups
Rolling 7-day point-in-time backups, with a second copy also in Australia, and no other copies of production data.
Export
Admins can export the Space’s memory as JSON from the dashboard at any time. When you leave, we’ll export everything on request, free of charge. On the Basic plan, hidden memory isn’t included.
Deletion
Admins can delete a memory or the whole Space, and anyone can delete their own account. It’s removed from the live service straight away and from backups within 7 days.
Logs
We delete the search log after 30 days and keep security logs for up to 90 days.
Incidents
If a security incident affects your data, we tell your Admins without undue delay, and within 72 hours, with what happened and what we’re doing about it.

Where we are.

KoalaFix Pty Ltd was registered on 16 March 2026 and the product is early. We don’t hold SOC 2 or ISO 27001 certification, and we won’t show a badge or an “in progress” sticker until an auditor has signed a letter.

Approved for OpenAI Daybreak (Trusted Access for Cyber)

KoalaFix is approved for OpenAI’s Daybreak program (Trusted Access for Cyber), which gives vetted security teams expanded model access for defensive work on their own systems.

Found a security issue?

Email support@koalafix.com with the steps to reproduce it. We acknowledge reports within 3 business days, give you our first assessment within 10, and aim to fix confirmed problems within 90. Good-faith research under our Vulnerability Disclosure Policy is welcome and covered by its safe harbour.

Security at KoalaFix is owned by Joshua Salathe, CAIO and co-founder (about, LinkedIn).

Links

Decide once. Every agent remembers.

Every agent checks in before its first edit and works from one memory that keeps itself up to date, in every tool your team uses.

Get early access