Terms of use

Contracting entity, ABN and governing jurisdiction — to be confirmed

Until this is finalised, any agreement in place is the one recorded in your written order or engagement, not this page.

This section is not boilerplate. Misunderstanding it is the most likely way for a customer to be disappointed, so it is stated as directly as we can.

• Not a certification body. We issue no accreditation against any standard. Assessments produced in the platform are self-assessments and are labelled as such, inside the exported document.
• Not an auditor or independent assessor. We do not verify your environment or form an independent opinion about it.
• Not a guarantee of compliance. Using the platform does not make you compliant with the Essential Eight, ISO/IEC 27001, the Australian Privacy Principles, APRA CPS 234, PCI DSS or anything else.
• Not legal, financial or insurance advice. We are not a law firm, a broker or an insurer. Nothing in the platform or on this website is advice of that kind.
• Not a security service. We do not monitor your systems, respond to your incidents or implement controls for you. That work is done by your internal team or your IT provider.
• The readiness score is an internal indicator. It exists to prioritise work and show movement over time. It is not an audit result, an accreditation or a compliance rating, and it should not be presented to a third party as one.

The simulation subsystem is built to be useful for testing an organisation’s own staff and useless for anything else. These are conditions of use, and several of them are enforced by the platform rather than merely stated here.

• You may only run simulations against people in an organisation that has authorised them, and only where you are permitted to do so.
• Where you operate the platform for a client, that client must have authorised the programme. The approval workflow exists for this reason.
• You must not attempt to use simulated messages against anyone outside the authorising organisation.
• You must not attempt to collect real credentials, payment details, government identifiers or any other sensitive information through a simulation. The platform blocks templates that try, and attempting to circumvent that is a breach of these terms.
• You must not use prohibited scenario themes — dismissal or redundancy, death or bereavement, serious medical events, law enforcement or courts, government agencies, or promised bonuses and pay rises. These are blocked by the template scanner.
• You must not use the platform as a general-purpose mailer, or attempt to configure alternative sending infrastructure.
• You remain responsible for your obligations to your own employees, including any notification, consultation or employment-law requirements in your jurisdiction.

We may suspend simulation sending for an organisation that breaches this section. Suspension blocks launching and sending; it never deletes evidence.

Training modules, risk explainers, control descriptions, scenarios, characters, assessment questions and framework summaries are authored by Cyber Guys and remain our property. Your subscription grants your organisation the right to use them inside the platform for your own people, and for your clients where your plan includes that.

• There are no editable document exports and no bulk export. PDFs are produced only as the output of completed work.
• You may share exported documents with your own stakeholders — your board, your insurer, your auditor, your client. You may not redistribute or resell our content as your own.
• Where framework identifiers belong to a publisher such as ISO, NIST, the ASD or the PCI Security Standards Council, we reference the identifiers and write our own summaries. We do not reproduce copyrighted standard text, and a licensed copy of a standard remains something you obtain from its publisher.
• Records you create — your assessment answers, decisions, evidence and employee data — remain yours.

• You are responsible for the accounts you create and for the actions taken under them.
• Do not share credentials. Add a user instead; that is what roles are for.
• Tell us promptly if you believe an account has been compromised. A password reset revokes every session for that account immediately.
• Demo access is time-limited, marked as demo throughout the interface, restricted to demo workflows, and produces watermarked exports. It is a way to evaluate the platform, not a way to obtain the content library.

Prices are in Australian dollars and exclude GST. GST is added at checkout where it applies. Paid plans may be billed monthly or annually, as shown before payment. A subscription renews automatically at the end of each billing period until it is cancelled. The account owner can manage the payment method, download invoices and cancel through the billing portal.

New self-service plan subscriptions include the trial shown at checkout (currently seven days). A payment method is collected when the trial begins and the first charge is made when the trial ends unless the subscription is cancelled first. One trial is available per organisation. Plan changes may be prorated by our payment provider and the amount is shown before confirmation.

Single training-module purchases are one-off payments. If Australian Consumer Law requires a remedy, or a duplicate or erroneous charge has occurred, contact us. Other refunds are assessed fairly against whether access has been used and the circumstances of the request; cancelling a subscription normally stops the next renewal rather than refunding the current period.

If a subscription ends, your records remain readable for 30 days so you can export the certificates, reports, assessments and risk acceptance records you need. After that the organisation is deactivated. We do not hold data hostage, and we do not delete it the moment a payment fails.

We aim to keep the platform available and will give notice of planned maintenance where we reasonably can. We do not currently publish a contractual uptime commitment, and we are not going to imply one that does not exist.

Service level commitments, if any — to be confirmed

Liability limits, warranties and indemnities — to be confirmed

Nothing in these terms is intended to exclude or limit any right you have under the Australian Consumer Law that cannot lawfully be excluded or limited.

Testing the platform for vulnerabilities is welcome within the boundaries of our responsible disclosure policy. Acting within that policy is not a breach of these terms.

If we change these terms in a way that materially affects you, we will tell account holders. The effective date will be shown once these terms are finalised.

Questions about these terms:use the contact form — a dedicated address has not been published yet