The foundation beneath Ask Arkie
Ask Arkie only works because of what sits under it. Not a data warehouse, not a dashboard bolted onto the systems you already run — a governed, reconciled, firm-owned data layer: the typed object model the AI was always meant to operate on. This is what that layer is, why it makes every answer provable, and why it is yours.
A new category
CRMs store data. Workflow tools track tasks. Both are static — the actual prep happens outside them, in inboxes, scratch documents and offshore admin queues — and neither tells you whether the advice built on that data is defensible. Surity360 closes both gaps: it runs the prep upstream, and it proves the advice downstream.
Stores client data — Salesforce, XPlan, Worksorted. Excellent at storing and retrieving. Cannot tell you whether the advice built on that data is correct, complete, or defensible.
Tracks tasks — Fin365, Plutosoft, Worksorted. Excellent at recording task state. The work itself happens outside it, and it cannot see across systems or verify the quality of the evidence those tasks produce.
Does the prep. Proves the advice. Surity360 — the layer above the CRM and the workflow tracker. It runs the agentic workflow upstream of every advice conversation, then manages obligations, coordinates evidence, and produces a provable compliance chain across every system in your stack. The advice is defensible by construction.
The platform
Surity360 sits above your planning software, any CRM, any wrap platform, any digital fact find and your document store — and gives you four things those systems individually cannot.
It reads from each system, reconciles contradictions on a per-field basis, and writes back where the source of truth says it should. Ontology-first, not warehouse-first — a typed object model the AI was always meant to operate on, not a dashboard layered on the data you already have.
Outcomes before software
An ontology-first data architecture — reality modelled as typed objects with sources, state and history, not rows in a table. Same strategic logic as BlackRock’s Aladdin: the OS layer becomes the most valuable in the stack. In advice, that layer belongs to the adviser, not the product provider — this is AdviserOS.
Surity360 was designed from the compliance outcome backwards — the evidence chain an ASIC review requires, then the architecture to produce it continuously across every system you already run. That is what agent-native means: not AI layered on a data warehouse, but operations that execute against a live ontology. AI on clean, governed data beats AI on fragmented tables.
The foundation underneath the ontology
Typed objects need a database that stores objects — not one that shreds every client into a dozen joined tables. Surity360’s governed layer runs on MongoDB, the document database: each client is one JSON document that mirrors reality, and it is the same shape the AI already speaks.
Structured, unstructured and interdependent data in one object — holdings, goals, the fact find, documents and consents nested where they belong, not scattered across tables joined by hope.
The operational record, its provenance and the vector embeddings for search live in the same document — not a bolt-on search index quietly drifting out of sync with the data it describes.
When a new BID field, a new disclosure or a new product arrives, the model flexes to hold it — no migration project, no downtime. Advice compliance shifts every quarter; the data model keeps pace.
LLMs, MCP tools and vector stores all emit and consume JSON. The governed record speaks the same language the agent does, so there is no translation layer to lose fidelity or provenance in.
None of this is native to a rigid relational schema — the architecture most “AI for advice” is quietly built on. Relational was built for a world of fixed forms, and it shows: rigid schema, brittle and hard to adapt, difficult to scale.
| Capability, through an advice lens | Document model (MongoDB Atlas) |
Relational (e.g. Postgres) |
|---|---|---|
| Flexible schema that evolves with regulationA new BID or disclosure field just gets added — no migration. | ✓ | ✗ |
| One nested client record, not joined tablesThe whole client as a single object, the way the ontology models them. | ✓ | ✗ JSONB is not the document model |
| Native queryable encryptionClient PII stays encrypted and still searchable — industry-first. | ✓ | ✗ |
| Fully managed, isolated cluster per practiceA dedicated database per firm, not a shared table with a tenant column. | ✓ | ~ provider-dependent |
| Australian residency, multi-regionYour data pinned to Sydney; none of it leaves the country. | ✓ | ~ provider-dependent |
| Native horizontal scaling & shardingScales from one practice to thousands without re-architecting. | ✓ | ✗ |
This is why Surity360 can give every practice its own isolated, onshore, bank-grade cluster on advice-fee economics — the same architecture scales down to a single firm and out to thousands without being rebuilt.
Your data, your own
Every AI-first advice tool runs on data it holds and you reach through it. Surity360 runs on data you own. Your reconciled client record lives in your own cloud account — provisioned for your practice alone, in Australia, never pooled into a shared vendor datalake you cannot see into or get out of.
A dedicated Google Cloud project and a dedicated MongoDB Atlas cluster in Sydney — provisioned exclusively for you. Completely independent infrastructure, not a logical partition of shared hardware. No shared databases, no cross-practice access possible.
All data resides in Australia; no client data ever leaves it. ISO 27001 and SOC 2 Type II certified, encrypted in transit and at rest, Cloudflare Access 2FA at the perimeter, role-based permissions and a per-action audit log inside — every read and write attributable to a named identity.
You can see it, query it, export it, and walk away with all of it — the reconciled record and its seven-year evidence chain. Data sovereignty means no lock-in. The isolation that once required institutional capex now runs for a single practice on a subscription, billed to you at cost.
Concretely, that means the AI never talks to your data directly:
Ask Arkie. Built on Surity360 — you are in control of your own data.
Why now
The window to put this foundation in place — quietly, on your own terms, without a forced migration — is closing now, not in twelve months.
ASIC’s October 2025 offshore-outsourcing review and the parallel Best Interests Duty intensification have made fragmented evidence a real, auditable liability. The cost of an enforcement event is $100K–$1M+. The bar applies to this year’s reviews, not next year’s.
48% fewer advisers since 2019. Each remaining adviser carries more clients, more complexity, more compliance burden — while $4.5 trillion in superannuation means demand is surging. The only answer is leverage, and software is the lever.
Capital-backed consolidators are aggressive buyers of Australian advice practices in 2026. A fragmented book is a discount; a unified client record with a clean evidence chain is a premium. The premium is set the day a buyer audits your stack — not the day a competitor’s roadmap ships.
Australian financial-services technology programs slip, and the ones that ship often arrive narrower than promised. Waiting on a US data product adapted to Australian compliance is a bet against a long historical pattern. The audit, the AAA renewal, the BID file note all happen this quarter. Surity360 is live now.
Whitepapers
Both are gated — one human reads each request before the link goes out, no tracking pixels, no third-party analytics, no cookies dropped.
For principals · ~12 pages
Five recurring failure modes mapped against the live Australian advice stack — XPlan, Worksorted, HUB24, North, MyProsperity, Advice Designer and SharePoint.
For CTOs, CIOs, compliance directors and acquirer DD teams · ~10 pages
The engineering case for ontology-first over feed-first warehouses — DDD, DRY, Open/Closed, PECS — mapped to live Surity360 code.
FAQ
Standard Steward pricing is A$900 / adviser / month (A$1,800 monthly practice minimum for two advisers). Early adopters get 40% off — A$540 / adviser / month, locked in for three years with CPI adjustments. Add-ons are flat per practice. Infrastructure (Google Cloud and MongoDB Atlas) passes through at our cost — typically around A$1,000 / month, depending on practice size and how much data changes each day. The pilot itself is free; implementation is a refundable A$5,000 fee credited against your first month if you convert (waived for early adopters). We count only relevant providers currently registered on ASIC’s Financial Advisers Register — Professional Year provisional advisers, paraplanners and support staff do not count toward your headcount. Full pricing →
The honest one: we are early-stage and we want lighthouse SMB customers. Each quarter, the first three practices to qualify get the implementation fee waived and a 36-month 40% discount lock (held at 40% off whatever standard pricing is that year, with CPI adjustments). To qualify: a discovery call, an initial assessment and an approved application. The cohort runs until further notice.
Surity360 makes you a more attractive acquisition, not a less. Capital-backed consolidators pay a higher multiple for practices with clean data, structured evidence and a unified client record, because they do not have to fix it post-deal. That is exactly what Surity360 produces. Whether you sell to a consolidator, run an internal succession or pass the practice to family, you walk into the conversation with the operational discipline that sets the price.
We do not currently write back to XPlan. XPlan reconciliation is read-only and currently depends on the practice running MyProsperity alongside XPlan — we read fact-find data and key client records from MyProsperity, then reconcile against Worksorted and HUB24. XPlan stays the SOA production engine. Worksorted has native API integration — bi-directional once you opt in, read-only by default during the pilot.
Yes — any CRM with a documented API can be connected. Worksorted is what we run out of the box; SuiteCRM and a small number of others have working connectors today. Beyond that, integrating a new CRM is bespoke implementation work, scoped at the discovery call. The same applies to investment platforms outside the standard set: Netwealth, CFS, MLC, BT Panorama, Praemium and others can all be wired in — but as a custom build, not as a checkbox at sign-up.
HUB24 — full integration out of the box including SFTP daily reports, alignment dashboard and Playwright automation for portal-only workflows. North — full integration: Playwright automation plus client-list ingest. Netwealth, BT Panorama, CFS, MLC and Praemium — read-only daily report ingest is straightforward; deeper integration is custom implementation work on top of the standard pilot. Listed on the 2026 roadmap as productised connectors but available now via custom build.
Compliance lawyers now treat $50/year as the materiality bar for product cost comparisons. Every SMA in every review has to demonstrate that the fee differential over a cheaper alternative (a direct ETF, a model portfolio) is offset by quantifiable diversification benefit and satisfies the other key BID criteria — client return objectives, time horizon, tax/CGT position, liquidity, turnover suitability, ESG preferences, client familiarity. Surity360’s data layer holds your live HUB24 and North holdings today, and the ADW (Advice Development Worksheet) module captures all the BID criteria as structured fields. The cost-vs-diversification view that computes concentration, correlation and factor exposure for each SMA against a chosen alternative — and emits a BID-ready file-note paragraph — is a candidate Phase 1 pilot deliverable. Live data ingest and structured BID capture now; the standardised cost-justification engine is on the 2026 roadmap.
Each model portfolio is monitored across 1D, 4W, 3M, YTD, FY, 1Y and 3Y horizons, benchmarked against the indexes and peer funds you choose, with drift, drawdown and relative return on the adviser’s screen before the review meeting. Combined with the ADW module’s structured BID-criteria capture, the file note can show — on live data — that the SMA still aligns with the client’s risk profile, return objectives and the alternatives available. Live today; a productised review-pack export is on the 2026 roadmap.
Your practice runs in its own dedicated Google Cloud project (australia-southeast1, Sydney) and its own dedicated MongoDB Atlas cluster (Sydney) — provisioned exclusively for you, never pooled in a shared vendor datalake. No data is co-located with another practice at any layer. No data leaves Australia. All connections encrypted in transit and at rest. You can see it, query it, export it and take it: you own the asset outright — freehold, not leasehold.
Compute sits in Google Cloud (australia-southeast1, Sydney); structured data in MongoDB Atlas (Sydney) — both independently certified to ISO 27001 and SOC 2 Type II, both encrypted in transit and at rest. Cloudflare Access guards the perimeter with mandatory two-factor authentication. Application access is then gated by bcrypt-hashed passwords and role-based permissions. Secrets live in Google Cloud Secret Manager, never in code. Each practice runs in its own dedicated project and cluster — completely independent infrastructure, not a logical partition of shared hardware. No shared databases, no cross-practice access possible. All data resides in Australia; no client data ever leaves it. Offshore admin staff access the platform through the same 2FA, role-based permissions and per-action audit log as onshore users — every read and write attributable to a named identity, aligned with ASIC’s October 2025 expectations on offshore outsourcing. A Data Processing Agreement forms part of the standard contract.
We provide a licensee briefing pack covering data handling, hosting, security, audit and ASIC alignment. To date, every licensee that has reviewed the pack has approved a pilot. If you are self-licensed, even simpler — you make the call.
The pilot is scoped to one screen, one workflow. If your team does not use it after 30 days, that is the answer — and you have lost nothing. Source data stays in your existing systems. Worst case, you stop syncing to Surity360 and you are exactly where you started. It cannot break anything — read-only by default.
Practice Brain enhancements — richer adviser-ready synthesis per client before every review. Expanded platform connectors for Netwealth, BT Panorama and Praemium. Tighter Lumiant integration. Salesforce and Dynamics connectors. Productised agent workflows for ROA filing, rebalance execution and BID evidence capture — all included in the Steward subscription.