Privacy Policy
Last updated 1 September 2026
This Privacy Policy explains how Meshlyr ("we", "us", "our") collects, uses, stores and discloses personal information, and how we handle the cloud configuration metadata we discover from the AWS accounts and GCP projects you connect. We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
Meshlyr is operated by Whakaata Pty Limited (ABN 42 666 915 555). This policy covers the web application at app.meshlyr.com, the demo at demo.meshlyr.com and the website at meshlyr.com, together the Service.
1. What we collect
Yes, we collect user data. Everything we collect is listed here. We collect nothing else, and we do not buy personal information about you from data brokers.
Account and identity information
Your name, email address, a securely hashed password (managed by AWS Cognito, so we never see or store your password), your mobile number if you provide one, and your organisation or tenant and your role within Meshlyr.
Cloud environment metadata
When you connect an AWS account or a GCP project or organisation, Meshlyr performs read-only discovery of the configuration and metadata of the resources in that environment. This includes networking, compute, container, storage, database, identity structure, DNS, edge and security configuration, infrastructure-as-code stacks, security findings, cost and billing data, and the relationships between resources. Resource names, tags and configuration can contain personal information if you have put it there, for example a person's name in a tag or an email address in an IAM user, so treat this as your content. We also store point-in-time snapshots and change or drift history so the map stays accurate over time.
Content you create in the app
Business service definitions, relationship edits, cost allocations, saved map layouts and views, preferences, and any file or image you upload. You can edit or delete this content yourself at any time (see Retention and deletion).
Activity records
Your last sign-in and last-seen time, and an audit record of administrative actions taken in your tenant, such as accounts connected, users invited, roles changed and relationships edited. Audit records are retained for a limited period and then deleted.
Usage and analytics data
IP address, browser and device information, approximate location derived from IP address, log data, and which screens and in-app actions were used, collected through Google Analytics via Google Tag Manager. Our analytics uses generic screen names and event names only. It does not include resource identifiers, account contents, cost figures or any of the content of your cloud environment.
Communications
Records of enquiries you submit (such as name, email, mobile number and message), account access requests, and support correspondence.
2. What we do not access
Meshlyr is a metadata and configuration tool. When discovering your connected cloud accounts, we do not:
- read the contents of your data stores (no object or file contents, no database rows, no message payloads);
- read secret values (we never retrieve Secrets Manager or Parameter Store values, private keys, or credentials);
- pull container image layers or your application code;
- access your application or end-user data.
Configuration values that look like secrets are masked before they are stored or displayed. Our access is read-only, and we never create, modify or delete resources in your cloud.
3. How we use it
We use the information above to operate and provide the service, which includes discovering and mapping your resources and computing derived views such as blast radius, cost attribution, drift and business impact; to authenticate you and secure the platform; to send transactional and service notifications; to respond to your enquiries; to maintain, troubleshoot and improve the service; and to meet our legal obligations.
We do not sell your personal information, we do not share it for advertising, and we do not use your cloud metadata or your content to train any AI model.
4. AI features and processing
Meshlyr includes optional AI-assisted features: the in-app assistant, the cost advisor, the cost movement explainer, and relationship review. These use Claude, a large language model provided by Anthropic.
- What is sent. When an AI feature runs, we send Anthropic a compact, pre-computed summary of the resource configuration, relationships and cost figures relevant to that request, plus your chat message where you are using the assistant. Configuration values that look like secrets are masked before they are sent.
- When it is sent. It is not automatic. The assistant sends data only when you send a message. The cost advisor and relationship review run only when your operator has enabled them.
- Anthropic does not train models on it. Data submitted through the Anthropic API is not used to train their models. Anthropic acts as our subprocessor and may process this data outside Australia, including in the United States.
- The output is a suggestion, not a decision. AI output is advisory, can be wrong or incomplete, and is never applied to your cloud automatically. Nothing changes until you click to apply it, and applying a suggestion only edits data inside Meshlyr. We do not use AI to make any decision that has a legal or similarly significant effect on you.
- Scope and safety. The assistant is scoped to your cloud infrastructure. It is not a source of medical, legal, financial or crisis advice and should not be used for those purposes. If you or someone else is in immediate danger, contact your local emergency service. In Australia you can reach Lifeline on 13 11 14 or the Suicide Call Back Service on 1300 659 467, at any hour.
- You can avoid it entirely. If you never use the assistant and your operator leaves the advisory features off, no data is sent to Anthropic. Assistant conversations are held in your browser session and are not retained by us as a transcript.
5. Cookies, analytics and third parties
We use a strictly necessary, signed session cookie to keep you signed in. We do not use advertising cookies and we run no advertising or remarketing tags.
Third-party data collectors in the Service. The following third parties collect or receive data through Meshlyr:
- Google Analytics 4, loaded through Google Tag Manager (Google LLC): collects IP address, device and browser information, approximate location, screens viewed and generic in-app event names, to give us aggregate usage statistics. Google acts as our processor for this data. See Google's privacy policy.
- Anthropic: receives the AI request data described in section 4, only when an AI feature is used.
- Amazon Web Services: hosts the Service and processes everything you store in it, including authentication and outbound email.
You can block analytics with browser controls, a tracker blocker, or Google's opt-out browser add-on, with no effect on how the product works. Blocking the session cookie will stop you being able to sign in.
6. Where your data is stored
Your account data, discovery snapshots, uploads and registry are hosted on Amazon Web Services in the Asia Pacific (Sydney) region, in Australia. Some limited processing occurs internationally through the subprocessors listed below, for example AI processing by Anthropic and analytics by Google, both of which may process data in the United States. Where we disclose personal information overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
7. Sharing and subprocessors
We share data only with service providers who help us run Meshlyr, under confidentiality obligations, and only as needed to provide the service:
- Amazon Web Services (Australia, Sydney region): hosting, storage, authentication (Cognito) and email delivery (SES).
- Anthropic (United States): optional AI features, as described in section 4.
- Google (United States): website and product analytics.
Within your organisation, other users in your tenant can see the accounts and data an administrator has granted them access to. We may also disclose information where required by law or to respond to a valid request from law enforcement or a regulator, and in connection with a business sale or restructure, in which case the acquirer is bound by this policy. We do not sell your personal information.
8. Security
We integrate with your cloud using least-privilege, read-only access: AWS via a role you create that trusts only our control plane and is scoped with a unique ExternalId (guarding against confused-deputy misuse), and GCP via keyless Workload Identity Federation, so no long-lived service-account keys are created or stored. We do not read secret values.
All storage holding your data is private by default and never publicly readable. Snapshot and upload storage blocks public access and is reachable only by the application's own identity, and static site content is served through a CDN using origin access control rather than a public bucket. Data is encrypted in transit and at rest, passwords are hashed and managed by AWS Cognito, signing in requires a code sent to your email address in addition to your password, tenants are isolated from each other, and access is enforced per account and per role. Our public endpoints sit behind a web application firewall.
You can revoke our access at any time by removing the read-only role or the federation configuration, which stops further discovery. No system is completely secure and we cannot guarantee absolute security. If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
9. Retention and deletion
You can delete your data, and deletion means deletion.
- Delete it yourself, at any time. Content you create in the app, including business services, relationship edits, cost allocations, saved views and any file you upload, can be deleted by you from within the app. Deleting an upload removes the stored file, not just the link to it.
- Disconnect an environment. Removing a connected account stops discovery and deletes that environment's discovered snapshots and history.
- Close your account. Email support@meshlyr.com and we will delete your account and its associated data within 30 days, and confirm when it is done.
- While your account is active we keep your account data and discovery snapshots so the service works. Change and drift history is pruned on a rolling basis, by default to 90 days. Audit records are kept for a limited period and then deleted.
- After deletion, residual copies cycle out of routine encrypted backups within a further 35 days. We may retain limited records where required for legal, tax or dispute purposes, and de-identified aggregate statistics that cannot be linked back to you.
10. Subscriptions and billing
Meshlyr is currently provided at no charge during early access, and we do not collect payment card details. If paid plans are introduced, card details will be handled by a third-party payment processor and will not be collected or stored by us directly, and we will update this policy before that happens.
Where a paid subscription renews automatically, we will tell you the renewal date and price before you buy, email you a reminder before each renewal, and let you cancel at any time from within the app in no more steps than it took to subscribe, with no phone call or email required. Cancelling stops the next renewal and takes effect at the end of the period you have already paid for. See our Terms of Use for the full billing terms.
11. Your rights and choices
You may request access to, or correction or deletion of, the personal information we hold about you, ask for a copy of it in a portable format, ask us to stop sending marketing messages, or object to a particular use, by contacting support@meshlyr.com. We will respond within a reasonable time, and within 30 days wherever practicable. We will not charge you for making a request or treat you differently for making one. We may need to verify your identity first.
12. Children
The Service is a business tool intended for people aged 16 and over, and is not directed at children. We do not knowingly collect personal information from a child. If you believe a child has provided us with information, contact us and we will delete it.
13. Complaints
If you have a privacy concern, please contact us first and we will try to resolve it. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
14. Changes
We may update this Privacy Policy from time to time. Material changes take effect when the updated policy is posted on this page, we will update the date above, and we will notify signed-in users of significant changes.
15. Contact
Questions about this policy or your data can be sent to support@meshlyr.com, and a person will answer. Postal enquiries can be addressed to Whakaata Pty Limited (ABN 42 666 915 555), New South Wales, Australia.