ISO 27001 Toolkit Privacy Policy

Who we are

ISO 27001 Toolkit is operated by Zenith Consulting Services Pty Ltd, in Australia. We handle personal information in line with the Australian Privacy Principles. Questions, corrections and complaints go to support@zenithconsultingservices.com.au.

What we collect

We collect only what the toolkit needs to work:

• Account details. Your email address, whether your identity provider has verified it, a display name, and an identifier for the account at the identity provider (the issuer and the subject it gives us). If you sign in with Google, Microsoft or LinkedIn we receive your email address and that identifier from them, never your password.
• Preferences. Your time zone and locale, so dates read the way you expect.
• Workspace content. Everything you put into the tools: organisation name, scope and assessor, Annex A control records, risks, questionnaire answers and the questionnaire sheets you import. It is saved to our database as you work, one record at a time. This is yours, and it is only as personal as you make it, so avoid putting personal information about other people into free text fields where you do not need to.
• Membership. Which workspaces you belong to, your role in each, and invitations sent to or by you (the invited email address and when it was used).
• Terms acceptance. The version of the Terms of Use you accepted, when you accepted it, and which build of the app you accepted it in.
• An audit log. The database records changes to rows in your workspace: what changed, who changed it, and when. Values that look like a secret, such as an invitation token, are redacted or hashed before they are written to the log.

We do not collect payment details, and we do not ask for any information beyond the above.

Where it is held

Your account and workspace content are stored in a PostgreSQL database run by Amazon Web Services in the Sydney region (ap-southeast-2), encrypted at rest, in a private network reachable only by the application. Automated backups are retained for 14 days. The web app itself is served from Amazon CloudFront, a content delivery network with points of presence around the world; that serves the application's own files and not your workspace content. Sign-in is handled by Amazon Cognito in the same Sydney region.

Your browser keeps only working state, never your ISMS content: your theme preference, the id of the workspace you had open, a short-lived lock so only one tab refreshes your sign-in at a time, and, in per-tab session storage, your sign-in token and any in-flight sign-in, both cleared when you close the tab or sign out. Your acceptance of the Terms of Use is not kept in the browser; it is recorded against your account in the database.

Who can see it

• Members of your workspace. Every member can see and change everything in the workspace they belong to, and can see the display name and email address of the other members. Admins can additionally invite, change roles and remove members.
• No other customer. Workspaces are isolated from each other by the application and again by row level security in the database, so an ordinary account that is not a member of your workspace cannot read it.
• Platform operators. A small number of Zenith people are platform operators, so that we can support you. Their access to workspace content is read only: the database has no rule that lets an operator add, change or delete anything in your workspace. Every such read is recorded in your workspace's audit log first, with who read it, when and through which part of the app, and the database refuses the read if that record is missing. Those entries are in your workspace's own audit log, so your workspace admins can see them on the audit log screen in the app, and can download them from there. If you cannot see an entry you expect, ask us and we will look into it.
• Zenith staff with infrastructure access. Running the service means a small number of people can reach the production database and its logs directly. That access is for operating the service, investigating faults and meeting legal obligations, and changes made that way are recorded in the audit log too.
• Our service providers. Amazon Web Services (hosting, in Australia) and, where analytics is enabled, Google Analytics. We do not sell personal information, and we do not use your content to train machine learning models.
• Law enforcement or a regulator, where we are required by law to disclose something.

Analytics

When a measurement ID is configured for a deployment, the public pages use Google Analytics 4 to count visits and see which pages are used. We turn advertising signals and cross-site personalisation off, and we honour the Global Privacy Control signal: if your browser sends it, the analytics script is never loaded at all. Analytics is never loaded in local development, and no analytics event carries your workspace content. Google states that Google Analytics 4 does not log or store full IP addresses; that is Google's behaviour, not a setting we control.

Security

Traffic is encrypted in transit with TLS and data is encrypted at rest. Sign-in is handled by Amazon Cognito: passwords are never stored by us, and an account with an email address and a password must set up a TOTP authenticator app as a second factor. If you sign in with Google, Microsoft or LinkedIn, that provider authenticates you and any multi-factor requirement is theirs, not ours. The application connects to the database as a restricted role that cannot delete rows, and every workspace query is filtered again by the database itself.

How long we keep it

Workspace content is kept while the workspace exists. A workspace admin can archive a workspace and then schedule its permanent deletion: 30 days later every record in it and every stored version of every file uploaded to it is deleted, and until then any of its admins can cancel. Deleting a single file removes it from the workspace, but its stored versions are kept, like file evidence, until the workspace itself is deleted. You can also email us and we will delete a workspace, or erase your account and its data, subject to any record we must keep by law. Audit log entries and terms acceptance records are kept as a record of what happened, and are not deleted with the content they describe. Backups roll off after 14 days, so deleted content leaves them within 14 days.

The audit log names who made each change, so your email address and display name appear in it wherever you changed something, and stay there after you leave a workspace or your account is erased: without them a change could not be attributed. Workspace admins can read their own workspace's log. Audit log entries are kept for 7 years, the same period as file evidence, and are then deleted. A short record that entries were deleted, and of any workspace that was purged, is kept permanently.

Getting your data out, and getting it deleted

You can export a whole workspace from the app at any time as a .isms.json file, and each tool exports to CSV, XLSX or PDF. CSV and XLSX files, the ones you export and the ones you upload to import, are built or read by our service for that request only. The file itself is not stored: an export is downloaded straight to your device, and what you import is saved to your workspace like any other edit. To delete a workspace, to have your account and its data erased, or to ask what we hold about you or to correct it, email support@zenithconsultingservices.com.au. We will respond within 30 days.

Children

The toolkit is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 16.

Changes to this policy

We may update this policy. The current version is always on this page, and a change that materially affects you will be notified through the app or by email to your account address.

Complaints

Email us first and we will try to sort it out. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.