Terms of Use

1. Platform Overview

Delphitek ("the Platform") is a SaaS multi-framework Compliance Assessment Platform that assists Managed Service Providers (MSPs) and their customers in assessing and monitoring alignment with multiple cybersecurity and compliance standards.

The Platform currently supports forty-seven compliance frameworks, delivered through a single cloud portal:

The Platform is operated by Base 60 Capital Pty Ltd (ABN: 40 681 217 694) trading as Delphitek ("Delphitek", "we", "us").

2. Intellectual Property

This toolkit and its methodology — including all assessment logic, scoring algorithms, framework plugins, report templates, and associated tooling — are proprietary intellectual property of Base 60 Capital Pty Ltd (trading as Delphitek).

This expressly includes the Delphitek Agent Connector and its local assessment engine (the Windows service, orchestration scripts, collector scripts, scoring engine, and all control/rule/classification data files it installs on your endpoint(s)) — installing this software on your own hardware does not transfer, license, or waive any of Delphitek's intellectual property rights in it, and it remains subject to this section in full on every machine it is installed on.

• No redistribution, resale, or sharing of the platform, the Agent Connector/local assessment engine, or their outputs is permitted without written consent
• No reverse engineering, decompilation, disassembly, or derivative works are permitted — of the Platform or of the Agent Connector/local assessment engine, including any attempt to extract, copy, or repurpose its scoring methodology or rule/classification data
• No white-label rights are granted unless explicitly licensed in writing
• Derivative tools or materially similar systems created using this platform, including via AI-assisted reconstruction, are considered IP infringement

3. Authorised Use

You may use the Platform solely for your organisation's internal compliance assessment purposes or, if you are an MSP, to assess and monitor the compliance posture of your authorised end-customers across the frameworks covered by your subscription.

You must not:

• Use the Platform for any unlawful purpose
• Attempt to gain unauthorised access to any part of the Platform or its infrastructure
• Use the Platform to assess organisations you are not authorised to act on behalf of
• Share API keys, agent tokens, or login credentials with unauthorised parties
• Attempt to access compliance frameworks for which your subscription is not licensed
• Copy, extract, or run the Agent Connector or its local assessment engine outside of a live, licensed, currently-entitled Delphitek tenant, or on any endpoint not covered by your active subscription

4. Subscriptions and Billing

Access to the Platform is provided on a per-tenant annual subscription basis. Subscription tiers (Basic, Pro, Premium, Enterprise), framework add-on pricing, and included features are as agreed in your commercial terms with Delphitek.

Subscriptions auto-renew unless cancelled. Billing is processed via Stripe. You authorise Delphitek to charge your nominated payment method on the agreed billing cycle.

Access to specific compliance frameworks is gated by your active subscription entitlement. Attempting to run an assessment against an unlicensed framework will be declined by the Platform.

5. Assessment Data and Accuracy

Assessment results are generated based on data collected via Microsoft 365 Graph API and/or the Delphitek Assessment Agent (AssessmentKit) deployed locally in a customer environment. Results represent the assessed posture at the time of collection and may not reflect all security controls in your environment.

The controls and data points assessed vary by framework. Some frameworks rely exclusively on Microsoft Graph API telemetry; others may incorporate additional data sources collected by the local Assessment Agent.

Assessment outputs do not constitute a formal security audit and should not be relied upon as the sole basis for compliance decisions. Engage a qualified cybersecurity professional for formal assessments and advice.

6. Data Handling

Your use of the Platform is also governed by our Privacy Policy, which is incorporated into these Terms by reference.

7. Assessment Scope and Limitations

The Delphitek AssessmentKit provides compliance readiness assessments only. These assessments:

• Are generated by automated software tools and do not constitute formal certification, attestation, or a compliance determination under any framework (including ASD Essential Eight, ASD Essentials for Cloud, ASD Essentials for Enterprise IT, ASD Essentials for Operational Technology, ISO/IEC 27001:2022, NIST CSF 2.0, CIS Controls v8.1, SOC 2 Type II, SMB1001, PCI DSS v4.0.1, APRA CPS 234, CMMC 2.0 Level 2, Privacy Act Compliance, APRA CPS 230, SOCI Act (CIRMP), ISO 22301, ISO 27701, GDPR, HIPAA Security Rule, DORA, NIS2, NIST 800-53, IRAP Readiness, FedRAMP Readiness, NIST SP 800-171, CMMC 2.0 Level 1 (Foundational), ISO/IEC 27017, ISO/IEC 27018, SOC 1 Type II, ISO/IEC 20000-1, ISO 9001, ISO/IEC 42001, or any other). For PCI DSS v4.0.1 specifically, this Platform does not perform or replace a Qualified Security Assessor (QSA) assessment or Self-Assessment Questionnaire (SAQ), and does not determine Cardholder Data Environment (CDE) scope. For APRA CPS 234 and APRA CPS 230 specifically, this Platform does not perform or replace an APRA supervisory review, and each standard applies only to APRA-regulated entities (authorised deposit-taking institutions, general/life/private health insurers, and registrable superannuation entity licensees) — use of these add-ons does not determine your organisation's regulatory status or obligations. For CMMC 2.0 specifically, this Platform models Level 2 only (built on NIST SP 800-171 Revision 2), does not perform or replace an assessment from an accredited Third-Party Assessment Organization (C3PAO), and does not itself constitute a CMMC certification for any contract. For Privacy Act Compliance specifically, this Platform assesses the 13 Australian Privacy Principles at principle level only, does not constitute legal advice, and does not replace a qualified privacy law practitioner or the guidance of the Office of the Australian Information Commissioner (OAIC). For the SOCI Act (CIRMP) specifically, this Platform does not perform or replace a review by the Cyber and Infrastructure Security Centre, and the SOCI Act applies only to responsible entities of critical infrastructure assets as defined under that Act. For ISO 22301 and ISO 27701 specifically, this Platform does not perform or replace a certification audit by an accredited certification body; ISO 27701 additionally extends an existing ISO/IEC 27001 Information Security Management System, and purchase of the ISO 27701 add-on requires an active ISO/IEC 27001 add-on for the same tenant. For GDPR specifically, this Platform does not constitute legal advice, does not determine your organisation's regulatory status under the GDPR, and does not replace the guidance of a qualified EU data-protection legal practitioner or a supervisory authority. For HIPAA specifically, this Platform assesses the Security Rule only (not the separate Privacy Rule or Breach Notification Rule), does not constitute legal advice, and does not replace a qualified US health-privacy legal practitioner or a determination by the US Department of Health and Human Services Office for Civil Rights (OCR). For DORA specifically, this Platform does not perform or replace a competent authority's compliance determination, and DORA applies only to entities within its own defined list of EU financial entities. For NIS2 specifically, this Platform assesses the EU-level Directive baseline only, not any specific EU Member State's transposing national law, and does not perform or replace a competent authority's compliance determination. For NIST 800-53 specifically, this Platform does not constitute an Authorization to Operate (ATO), a FedRAMP assessment, or qualified US federal compliance/legal advice. For IRAP Readiness specifically, this Platform is NOT a real IRAP (Infosec Registered Assessors Program) assessment, does not constitute Australian Signals Directorate (ASD) endorsement, and assesses only a curated subset of the full Australian Government Information Security Manual (ISM) — a genuine IRAP assessment can only be performed by an ASD-endorsed IRAP assessor. For FedRAMP Readiness specifically, this Platform is NOT a FedRAMP authorization, does not perform or replace an assessment from an accredited Third-Party Assessment Organization (3PAO), and does not constitute or determine FedRAMP Marketplace listing eligibility — a real FedRAMP authorization attaches to a specific cloud service offering and is granted by an individual federal agency or the FedRAMP Board. For NIST SP 800-171 specifically, this Platform models Revision 3 at the 17 official control-family level (not full individual-requirement level), does not constitute a NIST SP 800-171 compliance determination, and applies to any organisation holding Controlled Unclassified Information (CUI), not only Defense Industrial Base contractors already on CMMC 2.0. For CMMC 2.0 Level 1 (Foundational) specifically, this Platform models the FAR 52.204-21 basic safeguarding requirements at full requirement level, does not perform or replace a self-assessment or third-party CMMC assessment, and does not itself constitute a CMMC certification for any contract. For ISO/IEC 27017 specifically, this Platform models only the 7 cloud-specific controls unique to that standard, does not perform or replace a certification audit by an accredited certification body, and requires an active ISO/IEC 27001 add-on for the same tenant. For ISO/IEC 27018 specifically, this Platform is modeled at the ISO/IEC 29100 privacy-principle level (not full individual Annex A control level), does not perform or replace a certification audit by an accredited certification body, and requires an active ISO/IEC 27001 add-on for the same tenant. For SOC 1 Type II specifically, this Platform assesses readiness against the COSO 2013 Internal Control Framework as a proxy, since SOC 1 (SSAE 18) itself defines no fixed control catalog of its own — a real SOC 1 Type II examination's control objectives are defined bespoke, jointly with a licensed CPA firm performing the engagement, and this Platform does not preview, perform, or replace that examination. For ISO/IEC 20000-1 specifically, this Platform models the 7 top-level management-system clauses only (not the full internal service-management-process structure of Clause 8), and does not perform or replace a certification audit by an accredited certification body. For ISO 9001 specifically, this Platform assesses all 28 top-level sub-clauses of ISO 9001:2015, plus the requirements ISO 9001:2026 adds, entirely via customer self-attestation, and does not perform or replace a certification audit by an accredited certification body. For ISO/IEC 42001 specifically, this Platform models the 9 Annex A control categories only (not the full individual-control level beneath them), does not perform or replace a certification audit by an accredited certification body, and does not constitute legal or regulatory advice regarding AI governance obligations. For Consumer Data Right (CDR) specifically, this Platform does not constitute legal advice or a determination of accreditation status as a CDR Accredited Data Recipient. For APRA CPS 220 specifically, this Platform does not perform or replace an APRA supervisory review, and applies only to APRA-regulated entities. For the AUSTRAC AML/CTF Program specifically, this Platform does not constitute legal advice or a substitute for AUSTRAC supervisory review. For the Australian Government ISM (full) specifically, this Platform assesses a curated subset of Information Security Manual controls, and does not constitute Australian Signals Directorate (ASD) endorsement or a formal ISM compliance determination. For the GLBA Safeguards Rule specifically, this Platform does not constitute legal advice or an FTC compliance determination. For NYDFS 23 NYCRR 500 specifically, this Platform does not constitute legal advice or a determination of compliance with the New York Department of Financial Services regulation. For the CJIS Security Policy specifically, this Platform does not constitute a formal CJIS audit or FBI CJIS Security Policy compliance determination. For HITRUST CSF specifically, this Platform is a readiness indicator only and does not constitute a HITRUST CSF Validated Assessment or Certification issued by HITRUST Services Corp. For Canada PIPEDA specifically, this Platform does not constitute legal advice or a determination of compliance with the Personal Information Protection and Electronic Documents Act. For UK Cyber Essentials / Cyber Essentials Plus specifically, this Platform is a readiness indicator only and does not constitute a certification issued by an IASME-accredited certification body. For Singapore PDPA / MAS TRM specifically, this Platform does not constitute legal advice or a determination of compliance with Singapore's Personal Data Protection Act or the MAS Technology Risk Management Guidelines. For the EU Cyber Resilience Act (CRA) specifically, this Platform does not constitute legal advice or a CE marking conformity assessment. For Vendor / Third-Party Risk Assessment specifically, this Platform applies an internal risk-assessment methodology and does not constitute a certification against any external standard. For Cyber Insurance Readiness specifically, this Platform does not guarantee insurance approval, a specific premium, or any underwriting outcome. For Ransomware Readiness Assessment specifically, this Platform applies an internal risk-assessment methodology and does not constitute a certification against any external standard. For the ASD Essentials frameworks (ASD Essentials for Cloud, for Enterprise IT and for Operational Technology) specifically, this Platform provides readiness indicators against the Australian Signals Directorate's published ASD Essentials guidance; they are not assessments conducted or endorsed by the Australian Signals Directorate, they do not assign the effectiveness ratings described in that guidance (which require review by a qualified assessor), and ASD content is reproduced under the Creative Commons Attribution 4.0 International licence. The ASD Essentials Transition Readiness report included with Essential Eight assessments shows which Essential Eight evidence relates to ASD Essentials actions and is not an ASD Essentials assessment.
• Are limited to controls observable via the Microsoft 365 Graph API and/or the local Assessment Agent, and represent a partial assessment of the full framework control set.
• Do not replace a formal audit conducted by a qualified assessor or accredited certification body.
• Should not be relied upon as evidence of compliance in regulatory, contractual, or legal proceedings without independent verification by a qualified third party.

Controls Without Telemetry. Some framework controls cannot be assessed via available data sources (for example, application control, endpoint hardening, and backup verification for certain frameworks). These controls are explicitly marked Not Assessed in all reports and scores and are excluded from scoring calculations. A "Not Assessed" designation does not indicate alignment or non-alignment — it indicates that no valid telemetry was available to support a scoring determination. The number of controls assessed may vary based on Microsoft 365 API permissions and Assessment Agent coverage at the time of assessment.

Readiness Indicators. All scoring outputs (Aligned, Partially Aligned, Not Aligned, Unable to Verify, or framework-equivalent designations) are readiness indicators only. They do not represent a formal determination of compliance status and must not be presented to auditors, insurers, regulators, or boards as evidence of certification or compliance without independent verification by a qualified third party.

Delphitek accepts no liability for compliance outcomes, audit results, or regulatory enforcement actions arising from the use of AssessmentKit reports.

8. Subscription, Auto-Renewal, and Cancellation

Auto-Renewal

Subscriptions renew automatically at the end of each billing period (monthly or annual, as selected at checkout). You will be charged the then-current subscription price on your renewal date.

Cancellation

You may cancel your subscription at any time via the Billing Portal within the AssessmentKit portal. Cancellation takes effect at the end of the current billing period. No partial-period refunds are provided.

Refund Policy

Subscription fees are non-refundable except where required by applicable law (including Australian Consumer Law). If you believe you are entitled to a refund, contact us at info@delphitek.com within 7 days of the charge.

Framework Add-On Subscriptions

The base subscription (Basic, Pro, Premium, or Enterprise) includes access to the ASD Essential Eight framework and the ASD Essentials for Cloud, ASD Essentials for Enterprise IT and ASD Essentials for Operational Technology frameworks. The following compliance frameworks are available as separately billed annual add-ons:

A Multi-Framework Pack (all 43 framework add-ons bundled) is available at $59,995/tenant/yr. Themed bundle packs covering a subset of add-ons (e.g. AU Regulatory, ISO Management Systems, US Federal & Healthcare, International Expansion, Insurance & Risk) are also available — see the Platform's current Pricing page for the definitive, always-current list and pricing. Framework add-on subscriptions may be cancelled independently of the base subscription. Cancellation of a framework add-on takes effect at the end of the current billing period, after which access to that framework's assessment features will be removed.

GST (Australian Goods and Services Tax)

Prices shown are exclusive of GST. Australian GST (currently 10%) will be added to all invoices issued to Australian customers. Tax invoices are available from the Billing Portal.

9. Availability and Support

Delphitek will use reasonable efforts to maintain Platform availability. We do not guarantee uninterrupted or error-free operation. Scheduled maintenance will be communicated where practicable.

Support is available at info@delphitek.com.

10. Limitation of Liability

To the maximum extent permitted by law, Delphitek is not liable for any indirect, incidental, consequential, or punitive damages arising from your use of the Platform or reliance on assessment outputs.

11. Termination

Delphitek reserves the right to suspend or terminate access to the Platform at any time for breach of these Terms or non-payment of subscription fees, with or without notice.

12. Governing Law

These Terms are governed by the laws of New South Wales, Australia. Any disputes will be subject to the exclusive jurisdiction of the courts of New South Wales.

13. Changes to Terms

Delphitek may update these Terms at any time. Continued use of the Platform following notification of changes constitutes acceptance of the updated Terms.

14. Contact

Delphitek trading under Base 60 Capital Pty Ltd
Email: info@delphitek.com