AskPenny Trust Centre

AskPenny is an AI sales coaching assistant built by SalesStar. This page explains how we handle your data, how the system is built, and where we are on the journey to formal certification.

Our approach

We have deliberately built AskPenny on managed AWS services with an AWS certified partner rather than running our own infrastructure. Encryption, physical security, network isolation and platform patching rest on infrastructure that is independently certified to SOC 2, ISO 27001 and equivalent standards. What we build on top of that - how we keep one customer's data separate from another's, who at SalesStar can access what, how the AI assistant handles your content, and how we detect and respond to problems - is our responsibility. That is what the rest of this page describes.

Where we are

AskPenny holds no security certifications today. We are a small team shipping a new product, and we have put our early investment into the security architecture rather than into audit and certification. We think that is the right order, and want to be upfront regarding our current status. We will pursue SOC 2 and an independent penetration test as our customers' requirements make that the right call. This page will be updated when that happens.

About AskPenny

What is AskPenny?

AskPenny is an AI sales coaching assistant built by SalesStar. It gives sales leaders and their teams on-demand coaching grounded in SalesStar's own sales methodology, alongside tools for sales planning and sales process work.

Who is behind AskPenny?

AskPenny is built and operated by Sales Star Limited, a New Zealand company trading as SalesStar (NZBN 9429032238242). SalesStar is a sales coaching and sales transformation firm operating across New Zealand, Australia and internationally.

What is your approach to security?

We have deliberately built AskPenny on managed AWS services - serverless compute, a managed database, managed AI - rather than running our own servers. Encryption, physical security, network isolation and host patching rest on infrastructure that is itself independently certified to SOC 2, ISO 27001 and equivalent standards. In addition we engaged an AWS certified partner (Parallo) to design and implement this architecture. What we build on top of that - our application code and container images, how we keep one customer's data separate from another's, who can access what, and how we detect problems - is our responsibility, and that is what this page describes.

When was this page last reviewed?

The 24th August 2026. We review this page at least quarterly, and whenever something material changes.

Certifications

Is AskPenny SOC 2 or ISO 27001 certified?

No. We hold no security certifications today. AskPenny is a new product from a small team, and we have chosen to put our early investment into the security architecture itself rather than into audit and certification. We will pursue certification when our customers' requirements make it the right call, and this page will change the day that happens.

Has AskPenny had an independent penetration test?

Not yet. We have scoped an external penetration test and deferred it as a deliberate decision while the product is in an early release phase. In the meantime we test ourselves: we maintain an adversarial cross-organisation test that authenticates as a real user, targets an organisation they do not belong to, and asserts the request is refused with no content returned. We run it against deployed environments and are bringing it into our automated build pipeline. We will commission an independent test as the customer base grows.

Can you complete our security questionnaire?

We will consider completing a security questionnaire based on its complexity and the potential commercial value of a deal. Please route this request through your SalesStar sales representative, and include security@salesstar.com in your email. This page is designed to answer most standard questions up front - if it does, feel free to point your reviewer here instead.

Hosting & residency

Where is my data hosted?

Unless otherwise requested, AskPenny customer data is hosted on Amazon Web Services in the Europe (Frankfurt) region. Your account data, conversations and uploaded documents are stored there. AI processing uses Amazon Bedrock's EU-resident endpoints, which may run in any EU AWS region. A small number of delivery and logging components run outside the EU — we set those out in full in the next answer.

Does any of my data leave that region?

Some does. Specifically, the application is delivered through a content delivery network with edge locations in Europe and North America; its access logs and web-application-firewall request samples are held in a US AWS region. When the assistant runs a web search or fetches a page on your behalf, the query or URL goes to a specialist provider which may process it outside the EU, and one of those providers generates a short AI summary of the query it receives. Your account details flow to and from GoHighLevel, our commerce platform. Operational alerts — error messages and system events, not conversation content — are delivered to our team's Slack workspace. Everything else, including all AI processing of your conversation content, stays in the EU.

Can you host our data in Australia or New Zealand?

We can implement regional hosting upon securing clients with this requirement.

Data security

Is my data encrypted?

Yes. All traffic to and from AskPenny is encrypted in transit using TLS 1.2 or higher, and database connections require TLS with certificate verification. All data is encrypted at rest. Our database, document storage and conversation memory are encrypted with customer-managed AWS KMS keys with automatic key rotation enabled. A small number of supporting stores use AWS-managed encryption.

How is my organisation's data kept separate from other customers'?

Separation is enforced at several layers rather than relying on any single check. Every request is verified against your organisation membership before it is served, and every query the application makes is scoped to your organisation. Row-level security policies are defined on the underlying database tables as a further layer. Your uploaded documents are indexed into storage dedicated to your organisation alone - a separate storage resource, not a filtered view of a shared one. We also maintain adversarial tests that attempt cross-organisation access and assert that it fails.

Do you take backups?

Yes. Our production database is backed up automatically every day and retained for 35 days, and backups inherit the same customer-managed encryption key as the live database. Deletion protection is enabled on the database in every environment, and a final snapshot is always taken before a database can be removed. Production backups are additionally copied to a separate, segregated AWS account and to a second AWS region.

How long do you keep my data?

Your conversation history is retained while your account is active, and you can view and delete it at any time within the product. Deleting a conversation removes it and the documents you attached to it. Some derived data - the assistant's longer-term working memory, and operational logs - is removed on its own cycle or on request rather than immediately. Operational logs that may contain conversation content are retained for up to 90 days, and where you ask us to delete data we action the request within 30 days.

What happens to our data if we stop using AskPenny?

On request we will delete your organisation's data. Contact legal@salesstar.com and we will action the request within 30 days. Some records may be retained where we are legally required to keep them, for example billing records.

Access control

Who at SalesStar can access customer data?

Access to production systems is limited to a small number of engineering staff, using named individual identities rather than shared logins. No one uses long-lived AWS access keys, and our deployment pipeline authenticates without stored credentials. A password policy applies across every AWS account requiring at least 14 characters, all four character types, no reuse of the last 24 passwords and rotation every 90 days. Production access is separated from development and staging by using entirely separate AWS accounts.

How do users sign in to AskPenny?

Through AWS Cognito. Accounts are created by us when your organisation subscribes through GoHighLevel, or when we set you up directly. Each new user receives a one-time password by email and sets their own password on first sign-in.

Is multi-factor authentication or SSO available for our team?

Not currently, but these are on our development roadmap.

AI & your data

Which AI models does AskPenny use?

AskPenny runs on Amazon Bedrock, AWS's managed service for foundation models. We use Anthropic's Claude models and Amazon's Nova models, accessed through Bedrock's EU-resident endpoints. We do not train or run our own models, and we have no direct relationship with any model provider - all model access for your conversations is mediated by Bedrock, under AWS's terms. The one exception is our web-research providers: one of them generates a short AI summary of the search query it receives. See the web access question below and our subprocessor list.

Is my data used to train AI models?

No. Your inputs are not used to train or fine-tune any model. This is committed in our terms of use, and it reflects how Amazon Bedrock works: Bedrock does not use customer inputs or outputs to train the underlying models, and does not share them with the model providers.

What does AskPenny store from my conversations?

Your conversation history and the messages within it; a structured summary of each session; and any documents you upload, including the text and search index we derive from them. The assistant also keeps a longer-term working memory for each user -coaching preferences, and deal context such as accounts, stages and stakeholders you have discussed - so it can pick up where you left off. Conversation content also passes through operational logs used for troubleshooting and monitoring, retained for up to 90 days. We record product analytics events, including any feedback comment you choose to submit. If your organisation uses the sales plan, sales process or client register features, that content is included in the context given to the assistant at the start of each conversation so its coaching is relevant to your accounts.

Do SalesStar staff read my conversations?

Generally no, with a narrow exception. Prompts and responses are written to a text-only operational log, retained for up to 90 days, which supports troubleshooting, cost monitoring and auditing. A small number of engineers can read that log when diagnosing a fault, investigation policy/terms violations or improving response performance.

Can one customer's content influence another customer's answers?

No. Each organisation's uploaded documents are indexed into storage dedicated to that organisation, and the assistant retrieves only from the requesting organisation's own index - a separate storage resource rather than a filtered view of a shared one. The only content shared across customers is SalesStar's own sales methodology material, which is our intellectual property rather than anyone's customer data.

What stops the assistant producing harmful or inappropriate output?

We use Amazon Bedrock Guardrails on your conversation with the assistant, screening both what goes in and what comes out for hate, harassment, sexual and violent content. They also block sensitive data such as payment card numbers, passwords and AWS access keys from appearing in responses, and mask email addresses and phone numbers. The assistant is additionally instructed to stay within its remit - it will not give legal, HR or medical advice.

Can AskPenny be wrong?

Yes, and we say so in the product itself. AskPenny is a coaching assistant, not an authority. Like any large language model it can produce inaccurate, out-of-date or fabricated statements, and our terms of use make clear that outputs are informational and require your own judgement. It is designed to support human decision-making, not to replace it.

Does AskPenny access the internet?

The assistant can run web searches and fetch public web pages when that helps answer your question - for example, researching a prospect company. These use specialist search and retrieval providers, listed in our subprocessors below. What they receive is the search query the assistant composes, or a URL you paste. Those queries are drawn from your conversation and can include company, person or account names you have mentioned. We do not send your documents or your conversation transcript to these providers, and the assistant is instructed to keep queries to the research question - but the query is generated by the model, so treat anything you would not want sent to a search engine as something not to ask the assistant to research.

Who owns the content I put in and the content AskPenny produces?

You do. Our terms are explicit: we do not own the content you submit, and you own the responses, playbooks, scripts and materials AskPenny generates for you. We hold only the licence needed to actually run the service for you.

Payments

Does AskPenny store payment card details?

No. Payments are handled by GoHighLevel, our commerce and CRM platform. Card processing is handled by Stripe, which is certified to PCI DSS Level 1. Card data never reaches AskPenny, our systems contain no card-handling code and never see a card number. We receive only a payment reference, a quantity and an amount, used to credit your account and to prevent a purchase being counted twice.

What information does AskPenny receive from GoHighLevel?

Your name, email address, company name and the associated account identifiers flow from GoHighLevel into AskPenny - that is how your account is created when your organisation subscribes. AskPenny writes back to GoHighLevel only to link your contact record to your company record, and when you use the in-product purchase link, which passes your email and company name to the GoHighLevel order form so the purchase is matched to the right account.

Subprocessors

Who are your subprocessors?

Our current subprocessors are listed below, with what each one does and where it operates.

• Amazon Web Services — Hosting, database, file storage, identity and application delivery. Customer data it touches: All application data. Where it operates: Europe (Frankfurt); content delivery logs and web application firewall request samples in the United States.
• Amazon Bedrock — AI model processing — Anthropic Claude and Amazon Nova models, and text embeddings. Customer data it touches: Prompts, conversation content, uploaded document content. Where it operates: EU-resident model endpoints.
• GoHighLevel — Commerce, subscriptions and CRM; source of record for user accounts. Customer data it touches: Name, email, company name, account identifiers. Where it operates: United States.
• Stripe — Card processing, behind GoHighLevel. Customer data it touches: Payment card data - which never reaches AskPenny. Where it operates: Global.
• PostHog — Product analytics and error monitoring. Customer data it touches: Account identifier, email, name, organisation name and subscription tier, usage events, feedback comments. Where it operates: European Union.
• Serper — Web search, powering the assistant's research features. Customer data it touches: Search queries, which may include company or contact names. Where it operates: United States.
• Tavily — Industry and market research search. Customer data it touches: Research queries. Where it operates: United States.
• Firecrawl — Retrieval of public web pages the user asks about. Customer data it touches: URLs supplied by the user, and the page content retrieved. Where it operates: United States.
• Parallo — Managed AWS infrastructure partner. Customer data it touches: Infrastructure-level access to the environments holding customer data. Where it operates: New Zealand.
• Slack — Delivery of operational and security alerts to the SalesStar engineering team. Customer data it touches: Error messages, system events, organisation and user identifiers - not conversation content. Where it operates: United States.

Will you tell us if your subprocessors change?

Yes. Our terms commit to at least 30 days' advance notice of material changes to how data is used or processed.

Privacy & legal

Who is the data controller?

We act as a data controller and a data processor in terms of the GDPR when handling Personal Information, unless we have entered into a data processing agreement with you in which case you would be the data controller and we would be the data processor. For more detail, please refer to the Privacy Policy.

Which privacy laws does AskPenny comply with?

Our privacy policy sets out how we handle personal information under the EU GDPR, the New Zealand Privacy Act 2020, the Australian Privacy Principles and the California Consumer Privacy Act.

Can we get a Data Processing Agreement?

Yes, on request, although note we don't currently have a standard template. We often find that companies prefer to supply their own Agreement, which we review and then sign. Contact legal@salesstar.com .

How do I access, correct or delete my personal data?

Email legal@salesstar.com . We action requests within 30 days. You can also view and delete your conversation history yourself at any time within the product.

Will you tell us if there is a data breach?

In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe that there is a reasonable risk of harm to the User as a result of the breach or if notice is otherwise required by law. When we do, we will send you an email. We will also notify the relevant privacy regulator where the law requires it.

Where are your terms of use and privacy policy?

Our terms of use are at salesstar.com/askpenny-terms-and-conditions and our privacy policy is at salesstar.com/askpenny-privacy-policy . Both were last updated in August 2026.

Threats & Incident response

How do you monitor for security threats?

Our AWS environment is monitored continuously by AWS security services enabled across every account: GuardDuty for threat detection, Inspector for vulnerability scanning, Security Hub for benchmark compliance, and AWS Config for configuration monitoring against the CIS AWS Foundations Benchmark. Findings route automatically to our security team. All administrative activity across every account is recorded in a tamper-evident audit log held in a separate, dedicated logging account and retained for seven years, and network traffic logs are retained for a year.

Reporting & contact

How do I report a security vulnerability?

Email security@salesstar.com . We welcome good-faith reports and will not pursue legal action against researchers who report responsibly, avoid accessing or modifying other people's data, and give us a reasonable opportunity to fix the issue before publishing. We will acknowledge your report and keep you updated.

Who do I contact with a security or compliance question?

Email security@salesstar.com and we will come back to you. For privacy requests and data protection matters, use legal@salesstar.com .