Security & AI

How we handle data and AI.

NDIS providers hold sensitive information. Here is how Wholii protects it and how it uses AI:

Data residency

Stored in Australia.

Your data is stored on servers in Australia, hosted by Amazon Web Services. We do not sell Participant Data in a form that identifies an individual.

Access & control

Protections for your information.

Encryption in transit. Access controls. Regular security reviews.

AI & privacy

AI to assist you.

AI Features are intended to assist you, and AI outputs must be independently reviewed before they are relied on. We may use aggregated, de-identified data to train and refine the models used in the Platform. That data cannot reasonably be used to identify you or any individual.

Security at a glance

Wholii security at a glance.

Wholii is a compliance and workflow management platform that helps NDIS providers manage client records, notes, documents and communications with Participants. Wholii stores Platform data on servers in Australia, hosted by Amazon Web Services, and uses encryption in transit, access controls and regular security reviews. We do not sell Participant Data in a form that identifies an individual. We may use aggregated, de-identified data to improve the Platform, and that data cannot reasonably be used to identify you or any individual.

Platform data stored on servers in Australia

sale of identifiable Participant Data

AWS

hosting provider, with servers in Australia

outputs must be reviewed by your team before use

Last updated: October 2026

Why it matters

Why AI safeguards matter for NDIS providers.

NDIS providers hold some of the most sensitive information there is: participant details, support notes, incident records, medication information and staff credentials. When AI tools touch that information, three questions matter most: where does it go, who can see it, and what is it used for?

Wholii answers all three up front. Your data is stored on servers in Australia, hosted by Amazon Web Services. We do not sell Participant Data in a form that identifies an individual, and we do not share a Participant's information with other organisations without consent, except where required by law. AI-generated outputs are recommendations only and must be reviewed by you before they are relied on. We use Participant Data to provide, maintain, secure, improve and support the Platform, and we may use aggregated, de-identified data to train and refine the models used in it. That aggregated data cannot reasonably be used to identify you or any individual. We use encryption in transit, access controls and regular security reviews to protect information.

Full details are in our Terms and Conditions and Privacy Policy.

NDIS provider team member securely using Wholii compliance software on a laptop

Common questions

Frequently asked questions about Wholii security and AI.

What is Wholii?

Wholii is a compliance and workflow management platform that helps NDIS providers manage client records, notes, documents and communications with a Participant (or their nominee, guardian or support person).

Where is our data stored?

Wholii stores Platform data on servers in Australia, operated by Amazon Web Services. Some service providers we use may store or access data from outside Australia, and details are in our Privacy Policy. If you need hosting details for a procurement or due diligence process, contact the Wholii team.

Does Wholii use our information to train AI models?

We use Participant Data to provide, maintain, secure, improve and support the Platform. We may also use aggregated, de-identified data derived from use of the Platform to analyse, improve and train the algorithms and models used in the Platform. That aggregated data cannot reasonably be used to identify you or any individual. We do not sell Participant Data in a form that identifies an individual.

What security controls does Wholii have?

We use encryption in transit, access controls and regular security reviews to protect information on the Platform. You are also responsible for your own security practices, including keeping your login credentials confidential and controlling which of your Personnel have access.

Who can see our organisation's data in Wholii?

You can see the records of your own Participants. We do not share a Participant's information with other organisations or entities without consent, except where required by law. We use trusted third-party service providers, such as cloud hosting and payment processing, to operate the Platform.

Is it safe for NDIS providers to use AI with participant information?

The AI Features are designed to assist you, not replace your professional judgment. AI-generated outputs can contain errors, so they must be reviewed and approved by a suitably qualified person before being relied on. You remain responsible for your use of the AI Features, including having the consents required for any Personal Information you submit.

Still have a question? Talk to the Wholii team →

Keep learning