Privacy Policy

Draft — not yet reviewed by a lawyer. This page describes, as accurately as we can, what the platform actually does with data today. It is a starting skeleton, not a binding legal document, and must not be relied on or published to real clients until a qualified privacy lawyer (Australian Privacy Act 1988, APPs, and the Notifiable Data Breaches scheme all apply) has reviewed and approved the final wording — including the sections explicitly marked [NEEDS LEGAL INPUT] below.

What we collect

Account details you or your organisation provide (name, work email), and the security context you choose to share with us to be assessed — company profile, technology stack, findings from engagements, uploaded reports, and assets you register. We do not collect this data from anyone other than your own organisation's authorised users.

How it's protected

Each client's data is isolated at the database level (PostgreSQL row-level security), not just filtered in application code, so a bug in one tenant's view cannot expose another's data. Sensitive fields (findings content, uploaded reports, API keys) are encrypted at rest with a separate key per tenant. Every access to the platform is logged in an append-only, tamper-evident audit trail. Hosting is Australia-based. See our security overview [NEEDS LEGAL INPUT: link to a public-facing summary of docs/08-security-hardening.md, or decide this stays internal-only].

How it's used

Solely to deliver the assurance service you've engaged us for — correlating threat intelligence against your environment, scoring your posture, and generating advisories and reports for your organisation. We do not sell data, and we do not use one client's data to inform another client's results.

AI processing

Where an AI model is used to draft advisory text, it is given only your own organisation's data, assembled by our code — never another client's. If you provide your own model API key, that provider (e.g. Anthropic) processes the request under its own terms. [NEEDS LEGAL INPUT: confirm and cite the specific sub-processor terms that apply, and whether a Data Processing Agreement is required for AU privacy compliance].

How long we keep it

[NEEDS LEGAL INPUT: define retention periods per data category, and how offboarding/deletion (already built — a two-step, audited tenant purge) maps to your actual retention obligations and any contractual commitments.]

Your rights

[NEEDS LEGAL INPUT: access, correction, deletion request process and timeframes under the Australian Privacy Principles; a contact point (DPO or equivalent) for privacy requests.]

Data breach notification

[NEEDS LEGAL INPUT: your process and timeframe for notifying affected clients, consistent with the Notifiable Data Breaches scheme.]

Contact

[NEEDS LEGAL INPUT: a real contact email/address for privacy enquiries.]