Trust
How Catharsis protects client data: our ISO/IEC 27001:2022 certification, data handling, use of AI and how to report a security vulnerability to us.
01Certification
Catharsis is certified to ISO/IEC 27001:2022, the international standard for an information security management system (ISMS). The certification is audited independently, and we run our own business under the same controls we help clients implement.
A registered supplier to government on the Australian Government's BuyICT marketplace (opens in a new tab) and the NSW Government's Buy NSW marketplace (opens in a new tab).
Certified ISMS
Our ISO 27001 certificate
02Your data
When you work with us, we may see your network details, test findings, user lists, configuration exports and sometimes personal information. We treat all of it as confidential and handle it under our certified ISMS.
Only the people working on your engagement can access your data, and access is removed when the work ends.
Our staff accounts use multi-factor authentication (MFA), and administrator access is separate from everyday accounts.
Client data is encrypted in transit and at rest on the systems we use to store and share it.
Staff laptops are patched, protected by endpoint detection and response (EDR) and encrypted.
Reports and findings are shared through access-controlled channels, not as open attachments.
We keep engagement data only as long as the contract and the law require, then delete it securely.
We review the security of the suppliers we rely on before we use them.
Client data is stored in our own data centres, hosted in Australia. We never host client data outside Australia unless a client specifically asks for it and we agree it with them first.
Testing and incident work
Penetration testing and incident work follow written rules of engagement. We agree the scope, the testing window and an emergency contact before any work starts, and we report anything critical to your nominated contact straight away.
03AI use
We use AI tools to work faster on routine tasks, never as a replacement for the judgement of an experienced security practitioner. For day-to-day work we use private AI models hosted on infrastructure we control.
Our AI use policy sets out the detail, including how we handle client data and AI in your own environment.
Our commitments
04Website data and incidents
This website is hosted on Cloudflare. When you send an enquiry, we store it with a shortened version of your browser’s user agent string, which helps us tell genuine enquiries from spam. The website also uses analytics and advertising measurement. Our privacy policy explains what we collect, why, and your rights under the Privacy Act 1988 (Cth).
If we become aware of a security incident that affects your data, we will tell you promptly, explain what happened and what we are doing about it, and work with you on any notification you need to make. Where an incident is an eligible data breach under the Notifiable Data Breaches (NDB) scheme, we notify the affected people and the Office of the Australian Information Commissioner (OAIC) as the law requires.
05Report a vulnerability
If you think you have found a security vulnerability in this website or in any Catharsis service, we want to hear from you.
Email the details to info@catharsis.net.au with “Security vulnerability” in the subject line.
Include what you found, where, the steps to reproduce it and the impact you think it has.
Give us a reasonable time to investigate and fix the issue before you share it publicly.
Please don’t access, change or delete data that isn’t yours, run denial-of-service tests, use social engineering or physical attacks, or test systems that belong to our clients. We will acknowledge your report, keep you informed while we work on it, and won’t take legal action against good-faith research that follows these guidelines.
06Policies
How Catharsis collects, uses, stores and protects personal information under the Privacy Act 1988 and the Australian Privacy Principles.
Terms for the Catharsis website: starting prices and written quotes, managed IT plan terms, trials and complimentary offers, links and liability.
How Catharsis uses artificial intelligence in its own work: approved tools, client data, human review and accountability, in plain English.
Talk to our team
No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.
