Privacy Policy

Delphitek ("we", "our", "us") provides a multi-framework Compliance Assessment Platform designed to assist Managed Service Providers (MSPs) and organisations in assessing, monitoring, and improving their cybersecurity and compliance posture across multiple industry standards.

The platform currently supports twenty-one compliance frameworks (including "Privacy Act Compliance" and "GDPR," two of the frameworks the platform can assess a customer's own posture against — distinct from this Privacy Policy, which describes how Delphitek handles your data):

This Privacy Policy explains how we collect, use, store, and protect information when you use our platform.

1. Information We Collect

Account and Identity Information

• Name, email address, and organisational details
• Authentication information via Microsoft Entra ID (Azure Active Directory)
• Tenant identifiers associated with your Microsoft 365 environment
• MSP account identifiers used to isolate data between managed service providers

Customer and Tenant Data

• Organisation and tenant configuration details
• Assessment-related metadata (e.g. tenant IDs, assessment timestamps, selected compliance framework)
• Subscription entitlement records (which frameworks are licensed for each tenant)

Security and Compliance Assessment Data

• Configuration and security posture information retrieved via Microsoft Graph API (used for framework assessments requiring Microsoft 365 / Azure AD data)
• Compliance assessment results, control scores, findings, and remediation recommendations — stored per framework per tenant
• Framework-specific maturity, conformance, or coverage level scores (depending on the assessed standard)

Assessment Agent Data

• Where the Delphitek Assessment Agent (AssessmentKit) is deployed in a customer environment, assessment payloads collected locally are transmitted to Delphitek's Azure infrastructure for processing and storage
• Agent heartbeat and version telemetry used for operational monitoring
• No personally identifiable end-user data is collected by the agent — only device configuration and security posture metadata

Technical and Usage Data

• IP address, browser type, and device information
• Platform usage logs and diagnostic data

2. How We Use Your Information

We use collected information to:

• Authenticate users and manage role-based access control
• Perform compliance assessments across licensed frameworks and generate per-framework reports
• Enforce framework entitlement gating (verifying a tenant holds the required subscription before allowing a framework assessment to proceed)
• Operate, maintain, and improve the platform
• Send service notifications (scan completion results, subscription reminders, billing events)
• Comply with legal and regulatory obligations

3. Data Storage and Security

All data is stored on Microsoft Azure infrastructure hosted in Australia (Australia Southeast region). We implement industry-standard security controls including encryption at rest and in transit, role-based access control, audit logging, and network-level access restrictions on the systems that store assessment evidence, reports, and credentials.

Assessment data and scan results are stored per-framework per-tenant and are logically isolated from other tenants. Only authorised users with the appropriate role can access data within their organisation.

MSP Account Isolation: Where the platform is accessed through a Managed Service Provider, each MSP's customer tenants are isolated using a dedicated MSP owner identifier. This ensures that an MSP can only access data belonging to their own managed tenants, and that data from different MSPs is never commingled.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data with:

• Microsoft Azure: Our cloud hosting, identity (Entra ID), and database (Azure SQL) provider
• Stripe: For subscription billing processing, including base tier subscriptions and framework add-on billing
• SendGrid / Azure Communication Services: For email notifications (scan completion, subscription events, alerts)

All third-party processors are bound by appropriate data processing agreements.

5. Data Retention

We retain the following data for these periods:

• Portal account records: retained for as long as your account is active. Retained after account closure only where required for legal, billing, or dispute-resolution purposes, unless you request earlier deletion or anonymisation — see Section 6 below.
• Assessment (scan) outputs: 365 days from collection by default, after which older scan runs are automatically purged, unless a longer period is agreed in writing or required by law.
• Billing and invoice records: 7 years, as required by Australian Taxation Office obligations.
• Audit logs: 90 days (automated purge applied).

You may request deletion of your personal data at any time — see Section 6 below.

6. Your Rights (Australian Privacy Act 1988)

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the right to:

• Access (APP 12): Request a copy of the personal information we hold about you. You can use the in-portal data export (Settings → Account → Download My Data) or contact info@delphitek.com.
• Correction (APP 13): Request correction of inaccurate or incomplete personal information. Contact info@delphitek.com.
• Deletion (APP 11.2): Request that we de-identify or delete your personal data when it is no longer needed. You can use the in-portal account deletion (Settings → Account → Delete Account) or contact info@delphitek.com. Note: organisational scan data and framework assessment results associated with your employer's tenant are not deleted — only your personal account record is anonymised.

We will respond to access and deletion requests within 30 days. If we are unable to fulfil your request, we will explain the reason in writing.

6a. Notifiable Data Breaches

In the event of an eligible data breach as defined under Part IIIC of the Privacy Act 1988, Delphitek will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law. If you suspect a data breach involving your information, contact us immediately at info@delphitek.com.

7. Cookies

Our platform uses session cookies required for authentication and security. We do not use advertising cookies.

Our public marketing website (the page you land on before signing in) uses Microsoft Clarity, a session-replay and heatmap analytics tool, to understand how visitors interact with that page — clicks, scrolling, and session recordings. Clarity is only ever active on the marketing site, never inside the customer portal, and only runs after you accept the cookie banner shown on that page; declining means it never loads. See Microsoft's Clarity documentation for what it collects.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the platform following notification of changes constitutes acceptance of the updated policy.

9. Contact Us

Base 60 Capital Pty Ltd (trading as Delphitek)
Email: info@delphitek.com