Privacy Policy

Delphitek ("we", "our", "us") provides a multi-framework Compliance Assessment Platform designed to assist Managed Service Providers (MSPs) and organisations in assessing, monitoring, and improving their cybersecurity and compliance posture across multiple industry standards.

The platform currently supports forty-seven compliance frameworks (including "Privacy Act Compliance" and "GDPR," two of the frameworks the platform can assess a customer's own posture against — distinct from this Privacy Policy, which describes how Delphitek handles your data):

This Privacy Policy explains how we collect, use, store, and protect information when you use our platform.

1. Information We Collect

Account and Identity Information

• Name, email address, and organisational details
• Authentication information via Microsoft Entra ID (Azure Active Directory)
• Tenant identifiers associated with your Microsoft 365 environment
• MSP account identifiers used to isolate data between managed service providers

Customer and Tenant Data

• Organisation and tenant configuration details
• Assessment-related metadata (e.g. tenant IDs, assessment timestamps, selected compliance framework)
• Subscription entitlement records (which frameworks are licensed for each tenant)

Security and Compliance Assessment Data

• Configuration and security posture information retrieved via Microsoft Graph API (used for framework assessments requiring Microsoft 365 / Azure AD data)
• Compliance assessment results, control scores, findings, and remediation recommendations — stored per framework per tenant
• Framework-specific maturity, conformance, or coverage level scores (depending on the assessed standard)

Assessment Agent Data

• Where the Delphitek Assessment Agent (AssessmentKit) is deployed in a customer environment, assessment payloads collected locally are transmitted to Delphitek's Azure infrastructure for processing and storage
• Agent heartbeat and version telemetry used for operational monitoring
• No personally identifiable end-user data is collected by the agent — only device configuration and security posture metadata

Training Records (Delphitek Academy)

• Where Delphitek Academy knowledge checks are enabled for your organisation: your name, email address, which knowledge checks you attempted, your score, the number of attempts and the dates
• These records are visible to you, to your managed service provider, and to the people in your organisation who have portal access, as evidence that security awareness training was completed
• For staff invited to the Academy by email: the email address and name supplied by your managed service provider
• Where policy acknowledgements are enabled for your organisation: your name, email address, which of your organisation's policies you acknowledged, the version and the date. These are visible to you, to your managed service provider, and to the people in your organisation who have portal access
• Where your managed service provider has switched on training reminders: your email address is used to send you reminders about training that is due, and we record when each reminder was sent

Technical and Usage Data

• IP address, browser type, and device information
• Platform usage logs and diagnostic data

2. How We Use Your Information

We use collected information to:

• Authenticate users and manage role-based access control
• Perform compliance assessments across licensed frameworks and generate per-framework reports
• Enforce framework entitlement gating (verifying a tenant holds the required subscription before allowing a framework assessment to proceed)
• Operate, maintain, and improve the platform
• Send service notifications (scan completion results, subscription reminders, billing events)
• Comply with legal and regulatory obligations

3. Data Storage and Security

All data is stored on Microsoft Azure infrastructure hosted in Australia (Australia Southeast region). We implement industry-standard security controls including encryption at rest and in transit, role-based access control, audit logging, and network-level access restrictions on the systems that store assessment evidence, reports, and credentials.

Assessment data and scan results are stored per-framework per-tenant and are logically isolated from other tenants. Only authorised users with the appropriate role can access data within their organisation.

MSP Account Isolation: Where the platform is accessed through a Managed Service Provider, each MSP's customer tenants are isolated using a dedicated MSP owner identifier. This ensures that an MSP can only access data belonging to their own managed tenants, and that data from different MSPs is never commingled.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data with:

• Microsoft Azure: Our cloud hosting, identity (Entra ID), and database (Azure SQL) provider
• Stripe: For subscription billing processing, including base tier subscriptions and framework add-on billing
• SendGrid / Azure Communication Services: For email notifications (scan completion, subscription events, alerts)
• Website analytics and advertising (Microsoft Clarity, LinkedIn): Only on our public website, never inside the customer portal, and only after you accept cookies on that website. See Section 7.

All third-party processors are bound by appropriate data processing agreements.

5. Data Retention

We retain the following data for these periods:

• Portal account records: retained for as long as your account is active. Retained after account closure only where required for legal, billing, or dispute-resolution purposes, unless you request earlier deletion or anonymisation — see Section 6 below.
• Assessment (scan) outputs: 365 days from collection by default, after which older scan runs are automatically purged, unless a longer period is agreed in writing or required by law.
• Billing and invoice records: 7 years, as required by Australian Taxation Office obligations.
• Training records (Delphitek Academy): retained while your organisation remains a customer, as evidence of completed training. Deleted when your account is deleted or anonymised, and when your organisation is removed from the platform.
• Audit logs (security and access records): kept for at least 12 months, as required by the security and compliance standards we operate under, and deleted after no more than 2 years. This applies to every copy we hold, including backups.

You may request deletion of your personal data at any time — see Section 6 below.

6. Your Rights (Australian Privacy Act 1988)

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the right to:

• Access (APP 12): Request a copy of the personal information we hold about you. You can use the in-portal data export (Settings → Account → Download My Data) or contact info@delphitek.com.
• Correction (APP 13): Request correction of inaccurate or incomplete personal information. Contact info@delphitek.com.
• Deletion (APP 11.2): Request that we de-identify or delete your personal data when it is no longer needed. You can use the in-portal account deletion (Settings → Account → Delete Account) or contact info@delphitek.com. Note: organisational scan data and framework assessment results associated with your employer's tenant are not deleted — only your personal account record is anonymised.

We will respond to access and deletion requests within 30 days. If we are unable to fulfil your request, we will explain the reason in writing.

6a. Notifiable Data Breaches

In the event of an eligible data breach as defined under Part IIIC of the Privacy Act 1988, Delphitek will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law. If you suspect a data breach involving your information, contact us immediately at info@delphitek.com.

7. Cookies

The customer portal uses only the session cookies required for authentication and security. It does not use analytics or advertising cookies.

Our public marketing website (the page you land on before signing in) uses Microsoft Clarity, a session-replay and heatmap analytics tool, to understand how visitors interact with that page — clicks, scrolling, and session recordings. Clarity is only ever active on the marketing site, never inside the customer portal, and only runs after you accept the cookie banner shown on that page; declining means it never loads. See Microsoft's Clarity documentation for what it collects.

We advertise on LinkedIn from time to time, for example through posts and sponsored content. To measure and improve that advertising, our public website also uses the LinkedIn Insight Tag. It helps us understand how visitors reach our website from LinkedIn and what they do there, and lets us show relevant content to people who have visited our website, on LinkedIn. It may set cookies and share information such as your IP address, browser details, the page you visited and when, with LinkedIn. We see only aggregated reports, not who you are. Like Clarity, the LinkedIn Insight Tag is only ever active on the public website, never inside the customer portal, and only runs after you accept the cookie banner; declining means it never loads.

Microsoft and LinkedIn may process this information outside Australia, including in the United States and Ireland, under their own privacy policies. See LinkedIn's Cookie Policy for what it collects and how to control it, including LinkedIn's advertising settings in your LinkedIn account.

You can change your choice at any time by clearing this website's cookies and site data in your browser; the cookie banner will then ask you again.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the platform following notification of changes constitutes acceptance of the updated policy.

9. Contact Us

Base 60 Capital Pty Ltd (trading as Delphitek)
Email: info@delphitek.com