Privacy Policy

This policy explains how Veritas Cyber (“we”, “us”) handles your personal information. We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By usingveritas-cyber.com you agree to this policy.

What we collect

We practise data minimalism — we collect only what the service needs:

• If you use the free assessment and ask us to email your snapshot: your email address and your maturity levels (a Level 0–3 summary per control). We do not store your individual answers from the free assessment on our servers — they stay in your browser unless you create an account.
• If you create an account: your email address, your business details (business name, industry, staff count, whether you use Microsoft Office), and your saved assessment answers and results, so we can generate your documents.
• If you subscribe or purchase: your payment is processed by Stripe. We never see or store your card details — we retain only your plan, status, and billing period.
• Analytics: anonymous, aggregated usage data (pages viewed, assessment progress) via PostHog, to understand and improve the service. We do not send your assessment answers to analytics.

We do not collect your systems’ credentials, secrets, or network data, and we never scan your systems. The assessment is self-reported.

How we use it

• To provide the assessment, generate your documents, and run your account.
• To email your snapshot, service updates, and (if you opted in) helpful follow-ups.
• To send re-assessment reminders aligned to your renewal cycle.
• To improve the product using aggregated analytics.

You can unsubscribe from non-essential emails at any time using the link in any such email. We do not sell your personal information.

Who we share it with

We use trusted service providers who process data on our behalf, only as needed to run the service:

• Supabase — database and authentication (stores your account data).
• Stripe — payment processing.
• Resend — sending email.
• Vercel — website hosting and delivery.
• PostHog — product analytics.
• Anthropic — the AI that personalises the wording of your generated documents and answers questions in our help widget. We send it your business name and industry, and any question you type into the help widget. We never send it your assessment answers, and it never decides a maturity level — scoring is done by our own deterministic code.
• Sentry — error monitoring, so we can see when something breaks. It is configured not to collect user information or request bodies, so an error report contains the technical fault and the page it happened on, not your data.

Some of these providers may store or process data outside Australia. We may also disclose information where required by law.

How long we keep it

We keep your information while your account is active or as needed to provide the service, and as required to meet legal and tax obligations. You can ask us to delete your account data at any time (see below).

Your rights

Under the Australian Privacy Principles you may request access to, or correction of, the personal information we hold about you, and you may request deletion of your account data. To make a request, email us at hello@veritas-cyber.com. If you have a concern about how we have handled your information, you may also contact the Office of the Australian Information Commissioner (OAIC).

Security

We take reasonable steps to protect your information, including encryption in transit, access controls, and storing only what we need. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above.

Contact

Questions about this policy or your information? Email hello@veritas-cyber.com.