Compliance Overview

OpenAgent Core is an infrastructure provider that sits on top of Basiq.io's CDR-accredited data platform. This means:

When Financial Data flows through our platform, we apply the following CDR-aligned controls:

• Purpose limitation: Financial Data is used solely to fulfil the authorised API request. It is not retained, aggregated, or used for secondary purposes without explicit consent.
• Minimisation: Only the data fields necessary for the requested MCP tool operation are retrieved and processed.
• Consent integrity: All data access is gated by a valid, in-scope consent obtained through Basiq.io's consent management system.
• Deletion on request: Consumer data deletion requests are passed through to Basiq.io and actioned within the timeframes required by CDR rules.
• No onward disclosure: We do not disclose CDR data to any party other than the requesting tenant for the purpose of the authorised request.

Our integration with Basiq.io conforms to the Consumer Data Standards published by the Data Standards Body (DSB), including the Banking sector API specifications for accounts, transactions, and balance data.

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. In the event of an eligible data breach:

• We will assess whether a breach is eligible within 30 days of becoming aware of it.
• Affected individuals and the OAIC will be notified within 72 hours of confirming eligibility.
• Notification will include: the nature of the breach, the type of information involved, and the steps we recommend individuals take.

OpenAgent Core is a software infrastructure provider, not a financial institution, payment processor, or remittance dealer. We do not hold, transfer, or process money on behalf of customers or their End Users. Accordingly, we are not a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act).

However, if you use our platform to build an application that constitutes a designated service under the AML/CTF Act (e.g., a remittance service, digital currency exchange, or credit provider), you are responsible for registering with AUSTRAC and implementing your own AML/CTF programme. We are not a substitute for your own compliance obligations.

ThinkFoundry.ai Pty Ltd does not hold an Australian Financial Services Licence (AFSL) and does not provide financial product advice, dealing, or market-making services. Our platform is a developer infrastructure tool; it does not constitute a financial service.

If your application provides financial advice, credit, insurance, or investment services to End Users, you must hold the appropriate AFSL or credit licence, or operate under an authorised representative arrangement.

We do not engage in financial transactions, currency exchange, or remittance services. We maintain internal controls to ensure we do not inadvertently become a reporting entity. If you have concerns about whether your application triggers AUSTRAC reporting obligations, seek independent legal advice.

• Maintain a publicly accessible, up-to-date privacy policy that discloses to your End Users how their financial data is collected, used, stored, and deleted.
• Obtain valid, informed consent from End Users before requesting access to their financial data. Consent must be specific, granular, and easily revocable.
• Only request access to the data fields your application actually needs (data minimisation).
• Honour End User requests to delete their data promptly.

• Use CDR consumer data only for the purpose disclosed to the End User at the time of consent.
• Do not on-sell, disclose, or otherwise transfer CDR data to third parties without the End User's explicit consent.
• Do not use CDR data to make credit decisions, build marketing profiles, or for any purpose unrelated to the stated function of your application.
• Delete CDR data when consent expires or is revoked, and upon End User request.

• Store API keys and credentials in environment secrets — never in client-side code, browser storage, or public repositories.
• Encrypt any Financial Data you persist in your own systems using at minimum AES-256.
• Implement appropriate access controls to ensure only authorised personnel and systems can access Financial Data.
• Notify us immediately at security@thinkfoundry.ai if you discover or suspect a breach involving data accessed via our platform.

The following use cases are expressly prohibited on our platform:

• Building applications that facilitate financial crime, fraud, or money laundering.
• Using Financial Data to discriminate against End Users in lending, insurance, or employment decisions without appropriate legal authority.
• Aggregating CDR data across consumers to build anonymised datasets for sale to third parties.
• Accessing financial data without a valid, current End User consent.
• Impersonating a CDR-accredited data recipient without holding the required ACCC accreditation.