TrustProof / Legal
Privacy Policy
1. Scope and contact
This Privacy Policy explains how TrustProof Tech (ABN 42718806704) and its TrustProof service collect, use, disclose and protect personal information. It applies to the TrustProof website at trustproof.tech and to the TrustProof application, account, workspace, AWS readiness and monitoring services.
In this policy, “TrustProof”, “we”, “us” and “our” refer to TrustProof Tech. “You” refers to a person who visits the website, uses the service or acts for a customer organisation.
2. Information we collect
We collect information that you provide directly and information generated when you use the service. This may include your name, email address, account and authentication details, workspace membership, invitations, support messages and other details you choose to submit.
If you choose to sign in with Microsoft (a work or school account), Microsoft sends us your name, your email address and your Microsoft account identifiers (your organisation’s tenant ID and your object ID). We use them only to create and sign in to your TrustProof account. We do not receive your Microsoft password, and we do not ask for access to your mailbox, files or other Microsoft data. Microsoft’s own privacy statement applies to your Microsoft account.
When a customer connects an AWS environment, we process the connection metadata and the supported read-only evidence returned by that environment. We may also process scan records, findings, control mappings, monitoring records, report-share records and review activity.
Payment and subscription information is processed through the hosted Paddle checkout and related billing systems. We receive the customer, transaction, subscription and payment-status information needed to confirm package access and provide billing support; we do not ask you to send payment-card details to us by email.
3. AWS, evidence and report data
TrustProof uses the customer-configured, read-only AWS connection to gather the supported evidence needed for readiness checks, monitoring and reporting. The evidence trail begins from the connection date and does not represent evidence from before that connection.
The service can surface selected findings such as S3 public access, IAM access keys unrotated for 90 or more days, and SSH or RDP exposure. It organises supported evidence for the CPA Dashboard and guides customer review and approval. The customer controls its AWS environment and decides whether to make any change.
4. How we use information
- To provide, maintain and secure TrustProof accounts and workspaces.
- To authenticate users, manage access and apply workspace permissions.
- To collect supported AWS evidence, identify findings, monitor changes and organise reports.
- To confirm package access, process subscription status and provide billing support.
- To answer contact, support, privacy and security questions.
- To detect misuse, investigate incidents, enforce our terms and improve the reliability of the service.
5. When we disclose information
We disclose information only as needed to provide the service, comply with law, protect the service and its users, or follow your instructions. This may include disclosures to providers that host the application and database, support authentication, deliver email, process payments, provide monitoring or security services, or help us operate the website.
Paddle provides the hosted checkout and billing records for package purchases and subscriptions. We may also disclose workspace or report information to recipients selected by an authorised customer through a sharing workflow, including an independent CPA engaged by that customer.
We may disclose information where required by law, legal process or a valid government request, or where reasonably necessary to prevent fraud, security threats or harm.
6. Security and account responsibilities
We use reasonable administrative, technical and organisational measures to protect information against unauthorised access, loss, misuse or alteration. No online service can guarantee absolute security. You are responsible for keeping account credentials secure, using an appropriately scoped AWS read-only role and notifying us promptly if you believe an account or connection has been compromised.
Do not send AWS credentials, secret keys or other sensitive secrets to TrustProof through email or an unsupported channel.
7. Retention, cookies and analytics
We retain information for as long as it is needed to provide the service, meet contractual, accounting, security and legal requirements, resolve disputes and enforce our agreements. When information is no longer required, we delete it, anonymise it or securely isolate it, subject to lawful backups and retention requirements.
Measurement is off until you choose “Accept” in the cookie banner. If you accept, we use:
- Meta Pixel (Meta Platforms), to count page views, sign-ups and purchases (amount and currency) from our advertising. Meta’s automatic event collection (such as button clicks) is switched off;
- Opinly, to understand visits, sign-ups and contact-form submissions and, when you are signed in, to link visits to your account (your email address and account ID).
If you reject, or your browser sends a Global Privacy Control signal and you have not chosen otherwise, neither is loaded. You can change your choice at any time with “Cookie settings” in the footer, and we ask again after 12 months. Neither runs on the Auditor Portal or readiness pages.
Paddle, our payment provider, loads its checkout code only on our checkout page, because it is needed to take payment. Paddle’s own privacy notice applies to the payment details you give it.
8. Children and international processing
TrustProof is intended for business users and is not directed to children. We do not knowingly collect personal information from a child who is not permitted to use the service. If you believe a child has provided information to us, contact us so that we can review and remove it where appropriate.
We and our service providers may process information in countries other than the country where you are located. Where required, we take reasonable steps to use appropriate safeguards for that processing.
9. Privacy requests and contact
Send a privacy question or request to privacy@trustproof.tech. You may ask us to access, correct or delete personal information we hold about you, or to raise a concern about how we handle it. We may need enough information to identify the relevant account or workspace and verify your authority before responding.
Some information may need to be retained to comply with law, resolve a dispute, protect the service or complete a transaction. Where this applies, we will explain the reason when responding to your request.
10. Changes to this policy
We may update this Privacy Policy when the service, our processing practices or applicable requirements change. The updated policy will be published on this page with its revised content. Your continued use of TrustProof after an update means that you have had an opportunity to review the updated policy.