Composa privacy statement
Version 2026-10-18
Who this is for
Composa is an integration platform: it receives business documents (orders, invoices, despatch advices and the like), converts them and delivers them to an organisation's trading partners and systems. This statement is for the organisations that use it (our customers) and for the people whose information passes through it.
The customer decides what is sent through Composa and to whom. We keep and process that information on the customer's behalf, to run their integrations. Composa is provided by Integration Wizards (to verify: legal entity, ABN and address).
What is kept
| What | Details |
|---|---|
| User accounts | Username, roles and environment access, and how the person signs in. A password is kept only as a one-way hash. A two-factor secret is kept encrypted. A work-account sign-in keeps the identifier the directory gives. |
| Messages | For every message: when it arrived, from which partner, its status, size and reference, and the search fields chosen for it. Unless a workflow is set not to keep content: each message as received and as delivered, its debug checkpoints, API responses and failure details. Stored content can be encrypted (Settings -> Global settings). |
| Processed files | A folder channel moves each processed file to a .done folder, unless the workflow is set not to keep it. |
| Configuration | Partners, including their contact and notification email addresses; connections to APIs, databases, SFTP servers and email, whose passwords and keys are kept encrypted; workflows, mappings and schemas. |
| Audit trail | Who did what and when, and from which network address: sign-ins, changes, approvals, and opening a message's content. |
| AI records | When the AI is used: what was sent to it and what it answered. |
| Server log | Warnings and errors, which can include a message's reference and its error text. |
| Billing | Daily counts of messages and their size per workflow, and the invoices issued from them. |
Where it is kept
On the servers that run the customer's Composa instance, in its database and data folders. Each customer's information is kept apart from every other customer's, and Development, Test and Production apart from each other. To verify: hosting provider and region of the production deployment.
How long it is kept
| What | How long |
|---|---|
| Messages | Each environment's administrator sets how long (Administration -> Maintenance): the days a message stays in the live view before it is archived, per status, and the days an archive file is kept before it is deleted. Until they change it: 14 days, and then 90 days of archive files in Development and Test and five years of archive files in Production. Production keeps archive files at least five years, because invoices pass through. Archiving runs daily unless it is switched off in the same screen. |
| Processed files | The copy of each processed file in its folder's .done folder: until the period set for the server under Administration -> Maintenance, or for good when none is set. |
| Audit trail | 730 days in the product; older entries are then written to compressed archive files and removed (to verify: how long those files are kept). |
| AI records | 30 days, unless the operator sets another period. |
| Server log | Until archived under the log archiving settings. |
| Billing | Kept separately from messages, so archiving messages does not remove it (to verify: period - at least five years for invoices). |
| User accounts | Until an administrator removes the account. |
| Configuration | Until the customer deletes it. |
Who else processes it
| Who | What for | What they receive |
|---|---|---|
| Anthropic, PBC (United States) | The AI behind the Integration Wizard and document reading | Only in an environment where the customer has allowed it, and only what that allows (below). |
| Hosting provider (to verify) | Running the servers | Everything kept, as stored. |
| The customer's email server | Sending notification and failure emails | The emails. The server is the one the customer sets in Settings. |
The trading partners, APIs, databases, file servers and work-account directory a customer connects receive what the customer's workflows send them. They are the customer's choice, not suppliers of ours.
The AI, and sending information overseas
The AI is provided by Anthropic in the United States, so using it sends information outside Australia. Each customer decides, per environment, what the AI may see:
- Everything - configuration, and also messages and documents: a document read by an Extract step, search fields suggested from a message, a failure explained from its error, and the Wizard reading failed messages or calling a live API.
- Configuration only - what a person types to the Wizard, and the workflows, mappings, schemas and settings it works with, for building integrations, drafting specifications and proposing an adapter's rows. No message or document is sent.
- Off - nothing is sent.
An environment is off until an administrator chooses a level and agrees to it for their organisation. The words agreed to, the version of this statement, who agreed and when are kept with the setting and in the audit trail.
To verify: Anthropic's commercial terms for its API - how long it keeps what is sent, that it is not used to train its models, and where it is processed.
How it is protected
Passwords are hashed and connection credentials encrypted (AES-256-GCM). Message content can be encrypted too. Each person sees only the environments and sections their roles allow. Two-factor sign-in can be required per role. Repeated failed sign-ins pause signing in. Changes and sign-ins are in the audit trail.
Access, correction and deletion
A person who wants to see, correct or remove information about them should ask the organisation that sent it through Composa, as that organisation controls it. Its administrators can find messages by reference and search fields, and change or delete partners and accounts.
To remove a person's details, an administrator enters what identifies them (an email address, a phone number or a name) under Settings -> Personal data. Composa lists every place in every environment that holds it, and on confirmation:
- replaces the details with
[removed]in messages, search fields, dead letters, message archive files, the server log and text files in channel and archive folders. The messages themselves are kept, because they are the customer's business records; - deletes the Wizard conversation records that quote them;
- lists, without changing them, partners and user accounts that hold them, for the administrator to change, and files that are not text (a PDF, a spreadsheet) and so cannot be searched.
The audit trail is not changed: what it holds of a person is who did what, and it is append-only. The search and the removal are recorded in it, but the details searched for are not.
Contact and complaints
To verify: privacy contact (name or role, email address). If a complaint is not resolved, it can be taken to the Office of the Australian Information Commissioner (oaic.gov.au).
Changes
Each change to this statement gets a new version. An agreement to the AI names the version it was given under.