We hold the keys to your IT.
Here is how we guard them.

The Essential Eight

The Essential Eight is the Australian Cyber Security Centre's set of baseline strategies for reducing cyber risk: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. Each is measured against maturity levels.

We use it as the yardstick for our own systems, which we review against it every year, and it guides the security work in each client's annual IT review.

How our admin access is protected

• Every technician signs in with their own named account. No shared logins.
• Multi-factor authentication on every account that can reach client systems.
• Client passwords are kept in an encrypted password vault, never in email, spreadsheets or notes.
• Remote access to managed computers runs through our remote management tools, signed in with those named, multi-factor accounts.
• Admin activity on client systems is logged, and the logs are kept for 30 days.

How client data is protected

• We access client data only to provide the services in the client agreement.
• Backups we manage for clients are encrypted and kept in Australian data centres.
• Server backups are restore-tested, so we know they work before they are needed.
• Our staff are background-checked and bound by confidentiality.
• When a client leaves, we hand back their data and access and remove our own.

The Privacy Act

The Privacy Act 1988 and its Australian Privacy Principles set rules for how personal information is collected, used, stored and disclosed. We handle personal information in line with the Australian Privacy Principles, whether it is about our clients' staff and customers or about visitors to this website. We follow them voluntarily, as good practice.

Our privacy policy sets out what this website collects and why.

Notifiable data breaches

Under the Notifiable Data Breaches scheme, an organisation covered by the Privacy Act must notify the people affected and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. A suspected breach must be assessed within 30 days.

If we find or suspect a breach affecting a client, we tell the client as soon as we know, contain it, and help them assess whether it must be notified and prepare the notice. The decision to notify stays with the client.

If a breach affects personal information we hold ourselves, we assess and notify as the scheme requires.

Reporting a security concern

If you think something is wrong, call us on 1800 468 379. For a suspected security incident, call rather than use the contact form.