trust & security

where your data lives, and what leaves our servers.

This page documents tiny+'s approach to data safety and security. Where it’s hosted, how it’s protected, what the AI features send and never send.

Download the two-page PDF Read the DPA

tiny+ · what stays, and what crosses the line

stays in tiny+Your records

ProjectsCompaniesContactsPosts and commentsEmails and files you saveFeesReports

Hosted on Microsoft Azure in Sydney, Australia. Encrypted in transit and at rest. Backed up nightly.Never sold, never shared, never used to train a model.

what crosses the line · all off until an admin turns it on

Ask, Write with AI, report design→Anthropic’s Claudesendswhat you typed, and your account’s structure: field names, statuses, tags, staff namesneveryour records

Company Lookup→Anthropic’s Claudesendsthe company’s name and what you typed

Relationship capture←Microsoft 365sendsnothing. It reads mail headers: who, with whom, whenneversubjects or bodies

An assistant you connect⇄through your own loginsendswhat you can already see, when you ask for itneveranything you can’t see · it can’t delete

where your data lives

in australia, on microsoft azure.

One region, one provider, and a dedicated database if you need one.

HostingMicrosoft Azure, Australia East.

LocationYour data is stored and processed on servers in Australia.

BackupsNightly, kept for 90 days. In-app data retention forever.

Dedicated databaseAvailable on Enterprise, with a sign-in address of your own.

EncryptionIn transit with TLS, and at rest.

Sub-processorsListed in the DPA.

how it’s protected

who can sign in, and what they can see.

The controls an admin has, and the plan each one is on.

Two-factor sign-inFor everyone, on every plan.

Single sign-onWith Microsoft Entra ID, on Pro.

IP access rulesLimit sign-in to your office and VPN addresses, on Pro.

SessionsSee who is signed in and where, and sign a device out.

Audit logWho changed what, and when.

RolesDecide who may see and change what.

Confidential recordsHidden from everyone but their team.

ReportsBuilt for each reader from what they’re allowed to see.

your data is yours

take it with you, or have it deleted.

We never sell it or share it.

ExportEverything, at any time, from Account Settings.

DeletionClose your account and your data is deleted within 90 days, backups included.

If something goes wrongWe tell you within 72 hours of a breach that affects your data.

AgreementsThe Data Processing Addendum and Transfer Impact Assessment are published. Read them ›

PrivacyThe Privacy Policy says what we collect and why. Read it ›

Questionsprivacy@tiny.plus

gdpr

tiny+ and the gdpr.

tiny+ handles personal data in line with the EU and UK General Data Protection Regulation. For the records you keep in tiny+, your firm is the controller and TinyPlus Pty Ltd is your processor.

Our contract with youThe Data Processing Addendum sets out what we process, on whose instructions, and the sub-processors we use.

TransfersYour data is stored in Australia. Transfers from the EU and UK are covered by the Transfer Impact Assessment and Standard Contractual Clauses.

People’s rightsRequests to see, correct, export or delete someone’s personal data are answered at privacy@tiny.plus, and you can do all four yourself in the app.

BreachesWe notify you within 72 hours of a breach that affects personal data.

ai and capture

what each feature sends, and never sends.

Some optional features in tiny+ are enhanced with AI. Our AI provider is Anthropic. Every one of these is off until an account admin turns it on, and the AI Usage page shows what has been used. Anthropic does not train its models on what tiny+ sends.

Ask, Write with AI, report and automation designto Anthropic’s Claude · Pro

sendsWhat you typed, and your account’s structure: field names, statuses, tags and staff names.

never sendsYour records. No project, company, contact, post or file leaves tiny+.

Company Lookupto Anthropic’s Claude · Pro

sendsThe company’s name and what you typed. Nothing is saved until you press Apply.

never sendsAnything else about the company, or about your firm.

Research Assistantto Anthropic’s Claude · invite only

sendsFor the companies you pick: their name, website, town and ABN.

never sendsAnything about your firm, unless an admin chooses to add it.

Relationship capturefrom Microsoft 365 · Pro

sendsNothing leaves tiny+. It reads mail headers and stores who wrote to whom, and when.

never sendsIt never reads a subject or a body.

An assistant you connectClaude, Gemini, ChatGPT and others, with an AI licence

sendsWhat that person can already see, through their own login, when they ask for it.

never sendsAnything they can’t see. It changes nothing until an admin allows it, and can never delete.

microsoft 365

the permissions tiny+ asks for, and why.

The same list Microsoft shows on the connect screen. Each person connects their own account, so tiny+ reaches only that person’s mailbox, calendar, contacts and tasks, and one click disconnects.

openid · profile · email · User.ReadSign you in, and read your name and email address.Connecting · single sign-on

offline_accessKeep the sync running when you’re not signed in to tiny+.All syncs

Mail.ReadRead who each message is from and to, and when. tiny+ never asks Microsoft for a subject, a body or an attachment.Relationship capture · Pro

Contacts.ReadWriteKeep one Outlook contacts folder in step with tiny+, both ways.Contacts sync

Calendars.ReadWritePut tiny+ meetings and events in your calendar, and bring changes back.Calendar sync

Tasks.ReadWriteShow your tiny+ tasks in Microsoft To Do, and bring changes back.Tasks sync

who we are

a small, privately owned company in sydney, since 2016.

The people who build tiny+ answer support.

CompanyTinyPlus Pty Ltd, ABN 12 609 717 259. Sydney, Australia.

Security contactsecurity@tiny.plus

SupportBy email and in the app, from the team that writes the code.

a question this page doesn’t answer?

Send it to the people who built the thing. If your IT team has a questionnaire, send that too.

Email security@tiny.plus Download the two-page PDF

Trust & security · last reviewed November 2026