Privacy policy

1. Scope

This policy describes how Obscura Security (“Obscura”, “we”, “us”, “our”) handles personal information collected through this website, sales conversations, and the delivery of professional services. We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs).

2. What we collect

We collect only the personal information needed to do the work you ask us to do.

• Through this website: your name, email address, business name, staff count, and the contents of any message you send via the contact form or the sample-report request form.
• During a sales conversation: the same information plus what you choose to tell us about your security posture, your firm, and your buying timeline.
• During an engagement: scoping documentation, scan results, configuration exports, and any other technical evidence you authorise us to collect. This data may incidentally contain personal information about your staff, contractors, or clients.

We do not knowingly collect personal information from children. We do not buy or sell personal data.

3. Why we collect it

• To respond to your enquiry.
• To deliver, document, and invoice for the services you have engaged us for.
• To meet our legal, regulatory, and insurance obligations.
• To improve our own services, typically in de-identified, aggregated form.

4. How we store it

• Personal information collected via this website is stored on infrastructure provided by Cloudflare (Pages, R2) within their global network, with retention limited to what is required to respond and to demonstrate compliance.
• Engagement evidence is stored on encrypted business systems behind multi-factor authentication, retained for seven years to support insurance and dispute resolution, then securely destroyed.
• We do not transfer personal information offshore for processing beyond the use of mainstream cloud providers (Cloudflare, our email provider, our identity provider) that operate in jurisdictions with comparable privacy regimes.

5. Who we share it with

We disclose personal information only in the following circumstances:

• To service providers who help us operate (email, document storage, payment processing), under contractual confidentiality obligations.
• To our insurers and legal advisers where reasonably necessary.
• Where required by Australian law or a properly issued court order.

We do not disclose engagement findings to anyone outside your nominated recipients without your written authorisation.

6. AI-assisted analysis

We use large language models, currently those provided by Anthropic, to accelerate parts of analysis and report drafting. We only feed redacted or in-engagement client data to these tools, never your personal information beyond what is necessary for the engagement, and never for the tools’ own training. Every finding is human-reviewed and human-signed before delivery. See our Assessment disclosure for the full statement.

7. Your rights

You can:

• Access the personal information we hold about you.
• Correct it if it is wrong.
• Withdraw consent for marketing communications.
• Complain to us, and to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you are not satisfied with our response.

Reach our privacy contact at the email below. We aim to respond within 30 days.

8. Cookies and tracking

This website uses no third-party tracking cookies, no advertising pixels, and no behavioural analytics. Our contact and sample-report forms use first-party security cookies only where strictly necessary to prevent abuse.

9. Changes

We may update this policy. The “updated” date at the top reflects the most recent revision. Significant changes will be flagged on this page.

10. Contact

Privacy contact: [email protected]

Postal correspondence available on request.