Privacy policy

What we collect

• Account details — name, work email address, organisation, role, and multi-factor authentication status.
• Compliance records you create — Statement of Applicability entries, control decisions and notes, review comments, remediation tasks and assessment history.
• Evidence you upload — documents, screenshots and links you attach to a control.
• Security posture summaries read from a Microsoft tenant you connect — control names, scores and status only.
• Usage and audit records — sign-ins, permission changes, evidence uploads and report shares, recorded so you can show an assessor who did what and when.
• Enquiries you send through the website contact form.

We do not read your email, documents, participant records or customer data, and we do not use your data to train machine-learning models.

Why we collect it

To provide the service you signed up for: recording your controls, holding your evidence, producing readiness and gap reports, letting an assessor review your evidence, keeping an audit trail, securing accounts, and responding to your enquiries. We do not sell personal information, and we do not use it for advertising.

Where it is stored

Data is held in a managed Postgres database and object storage. Evidence files sit in a private bucket that is only readable through short-lived links issued to signed-in members of your organisation. Access is enforced at the database with row-level security, so one organisation cannot read another's records.

Who can see your data

• Members of your own organisation, according to the role you give them.
• Assessors or auditors you invite — limited to the organisation you invited them into.
• Anyone you deliberately send a shared report link to, for as long as that link is live. You can revoke a link at any time.
• A small number of EPIC Assist administrators, for support and security purposes, with their actions recorded in the audit log.

Microsoft data

When you connect a Microsoft tenant, Assurely reads Secure Score and related control metadata using an application permission your administrator approves. It is read-only; Assurely never changes settings in your tenant. You can revoke the consent in Entra at any time, which immediately stops all posture syncs.

Service providers

Assurely relies on third parties for hosting, database and storage, authentication, and email delivery. These providers process data on our instructions only. Some may store or process data outside Australia; where that happens we take reasonable steps to ensure comparable protection.

Security

Access requires a password and, for administrators, multi-factor authentication. Data is encrypted in transit and at rest. Microsoft client secrets are encrypted before storage and are never displayed back to any user. Privileged actions — password resets, permission changes, evidence deletion — are logged.

Retention and deletion

Evidence and assessment history are kept for as long as your organisation has an active workspace, because audit trails need continuity. On written request we delete your workspace, all evidence files and all assessment history within 30 days, and confirm once it is done. Audit-log entries recording who deleted what are retained.

Your rights

You may ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Most of it you can see and export from inside the product. For anything else, contact us using the details below; we respond within 30 days.

Notifiable data breaches

If a breach occurs that is likely to cause serious harm, we will notify affected organisations and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and tell you what happened and what to do.

Cookies

Assurely uses only the cookies and local storage needed to keep you signed in and remember your workspace. There is no advertising or third-party tracking.

Accuracy

Readiness percentages and maturity levels shown in Assurely are indicative and support your own assurance work. They are not an audit opinion, an ACSC assessment, or an accreditation decision. Scope and control mapping should be confirmed with an accredited assessor.

Changes to this policy

We will update this page when our handling of data changes, and change the date at the top. Material changes are notified to workspace owners by email.

Contact

Privacy questions, access requests and deletion requests: Isaac Nicol, EPIC Assist — Isaac.nicol@epicshield.com.au, 0419 725 786. If you are not satisfied with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.