Trust & security
How the Hexis platform protects your workforce data — where it lives, who can reach it, and how every action is accounted for.
Last updated: 6 July 2026
Who runs this service
This workforce-management service is operated by Action Workforce Pty Ltd, a subsidiary of Ashley Services Group Limited (ABN 92 094 747 510), on the AgenticAI platform (commercial name Hexis). Ashley Services Group is the data controller for the workforce records held here; AgenticAI provides and secures the underlying platform as data processor. The posture below describes how that platform is built.
Sovereign by deployment
The platform runs as one codebase in two isolated deployments. The commercial deployment serves general business customers; the IRAP-assessed deployment runs at the OFFICIAL: Sensitive classification entirely within Australian-sovereign infrastructure (ap-southeast-2), with AI inference routed to in-region models. A deployment never crosses the boundary it was provisioned for.
Tenant isolation
Every customer is a tenant. Each database query is scoped to the requesting organisation at the data-access layer — isolation is enforced by the platform, not by individual feature code, so a query that forgets to scope simply fails closed rather than leaking across tenants.
The AI provider boundary
Models are reached only through a single hexagonal port. That port selects the in-region provider for the deployment — AWS Bedrock in Sydney (ap-southeast-2) for the sovereign deployment — enforces a per-organisation spend circuit-breaker, and keeps prompts in a cache-optimal, auditable order. Swapping or constraining a provider is a configuration change at the boundary — never a scattered code change.
Accountable by design
Sensitive domain changes are written to an append-only, hash-chained event log alongside the data they describe, so the record of what happened survives redeploys and resists tampering. Every request carries a correlation id that threads through logs, background jobs, and event metadata for end-to-end tracing.
Reporting a concern
Security issues and platform access concerns reach the platform team at security@agentic-ai.au. Live platform status is published at status.agentic-ai.au. Privacy questions about your own records go to Ashley Services Group at privacy@ashleyservicesgroup.com.au.