Trust centre
What we do with your data, and what we will not claim.
Cyber Guys holds records about your organisation, your controls and your employees’ responses to training and simulations. This is where the handling of all of it is written down — including the parts that are not finished.
- No invented certifications, hosting claims or compliance badges
- Employee simulation data handled under stated limits
- Outstanding disclosures listed openly rather than left blank
- A responsible disclosure route for anyone who finds a problem
Documents
Everything published, in one place.
Security overview
Authentication, tenant isolation, audit logging, rate limiting, export controls — and the gaps we know about.
Read →Responsible disclosure
How to report a vulnerability, what is in scope, and what we commit to doing about it.
Read →Employee data and simulations
What a phishing simulation records about a person, who can see it, how long it is kept, and the limits built into the scoring model.
Read →Privacy policy
What personal information we collect, why, who we share it with, and how to access or correct it.
Read →Terms of use
The terms that apply to using the platform, including acceptable use of phishing simulations.
Read →Verify a certificate
Check whether a Cyber Guys training certificate is genuine using its verification code.
Read →Business identity
Who you are dealing with.
Australian-built and Australian-operated. The formal registration details are being confirmed and will be published here rather than asserted in marketing copy.
- Trading name
- Cyber Guys
- Registered legal entity
- Confirmation pending
- ABN
- Confirmation pending
- ACN
- Confirmation pending
- Registered address
- Confirmation pending
- State of operation
- Confirmation pending
- General contact
- Confirmation pending
- Phone
- Confirmation pending
Until these are published, the contact form is the confirmed channel. It records every submission and notifies us directly.
Where data lives
Hosting and data location.
We will not claim a data-sovereignty position we have not confirmed. The application is a standard Node application backed by PostgreSQL and is deployable to Australian regions; the production hosting decision is being finalised and will be stated here.
- Application host
- Confirmation pending
- Database host
- Confirmation pending
- Primary data region
- Confirmation pending
If data location matters to your procurement or regulatory position, ask us before you buy. We will give you the current answer in writing rather than pointing at a badge.
Subprocessors
Third parties involved in running the service.
These are the categories of external service the platform depends on. Named providers are published once the production configuration is settled — listing the options the code supports would tell you nothing about what actually processes your data.
| Purpose | What it handles | Provider |
|---|---|---|
| Application hosting | Runs the web application. A standard Node application, deployable to Vercel or any Node host. | Confirmation pending |
| Database hosting | Stores all customer records. PostgreSQL, deployable to any managed Postgres provider. | Confirmation pending |
| Transactional email | Sends invitations, password resets and training assignment notices. With no provider configured, messages are written to the server log rather than sent. | Confirmation pending |
| Phishing simulation email | Sends simulated phishing messages. Deliberately a separate provider and sending domain from transactional email, so a simulation can never originate from the address that sends password resets. | Confirmation pending |
Known gaps
What we still owe you.
Published rather than kept in a private handover note. Every item here is something no amount of reading our documentation can answer, and each one will be filled in on this page.
- Registered legal entity name and ABN, and ACN if the entity is a company
- Registered or principal place of business, and the state of operation
- A monitored public contact address, and a privacy contact address
- A security contact address for responsible disclosure reports
- The production hosting provider and region, for the application and the database
- Confirmed subprocessor list, including transactional and simulation email providers
- Confirmed retention periods beyond the 30-day post-cancellation read window
- Whether backups are stored in the same region as the primary database
- A published breach-notification commitment and target response times
- Legal review of the privacy policy and terms of use before launch
- A name and portrait for the founder’s letter on /about
Doing due diligence on us?
Ask for whatever you need. If we cannot answer something yet, we will tell you that rather than send back a questionnaire that overstates the position.