Privacy Policy

1. About this Policy

CyberShore Pty Ltd (ACN —) (“CyberShore,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the CyberShore service (the “Service”).

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we comply with those obligations.

2. What Information We Collect

2.1 Account Information

• Full name, email address, and password hash (HIBP-validated at set time).
• Organisation name, ABN (optional), and billing address.
• Authentication method preferences (passkeys, magic links, passwords, 2FA).
• IP address and user-agent string at sign-in (for security logging).

2.2 Monitored Asset Data

• Domain names and public IP addresses you register for external monitoring.
• DNS records (A, AAAA, MX, TXT, CNAME, NS, SOA), SPF, DKIM, and DMARC configurations resolved from public DNS.
• SSL/TLS certificate chain data retrieved from public endpoints.
• WHOIS registration data fetched from public WHOIS servers.
• Open TCP ports, service banners, and version strings discovered during authorised external port scans.
• Web vulnerability findings from passive and active scans of your public-facing web applications.
• Subdomains discovered through passive DNS enumeration of your registered domains.
• Core Web Vitals and PageSpeed scores for your monitored websites.

CyberShore performs external-only scanning. We do not install agents on your internal network, access your cloud accounts, or scan private IP ranges.

2.3 Usage and Analytics Data

• Page views, feature engagement, and session duration (via self-hosted Umami analytics on a separate, isolated database).
• First-party event log (stored in our main database) as a privacy-respecting fallback when the Umami script is blocked.
• No third-party advertising trackers, fingerprinting scripts, or social-media pixels are used anywhere in the Service.

3. How We Use Your Information

We use the information we collect solely to provide, maintain, and improve the Service:

• Service delivery: Monitor your external attack surface, detect vulnerabilities, and surface actionable alerts.
• Plain-English reporting: Raw technical findings are processed through Google Gemini 3 Flash (via Vercel AI Gateway) to generate human-readable summaries. Zero data retention and training-disallowance headers are enforced on every LLM request— your vulnerability data is not stored, cached, or used to train models by the AI provider.
• Account administration: Authentication, billing, and transactional email notifications (via Resend).
• Cyber Health Score:Aggregate your monitoring data into a 0–100 score you can track over time.
• Support and debugging: Investigate and resolve technical issues you report.
• Legal compliance: Meet our obligations under Australian law.

We do not sell, rent, or trade your personal information or scan data to any third party.

4. Data Storage and Hosting

• Primary database:Supabase (PostgreSQL) — all client account data, scan findings, alerts, and monitoring records are stored here.
• Scan execution: Google Cloud Run jobs running in australia-southeast1 (Sydney).
• Queue & cache: Upstash Redis, provisioned in a geographically proximate region.
• Anonymous analytics: Self-hosted Umami instance for visitor page-view metrics, running on a separate Supabase project (CyberShore-Umami) that never shares a database with the main CyberShore project. No client account or scan data is stored in this database.
• Application layer: Next.js deployed on Vercel (global edge network). Server-rendered pages and API routes execute in regions close to the requester.

All database-level data at rest is encrypted (AES-256). Data in transit is protected by TLS 1.2 or higher.

5. AI Processing and Zero Data Retention

CyberShore uses Google Gemini 3 Flash, accessed through the Vercel AI Gateway, to translate raw technical scan findings into plain-English alerts and fix recommendations. On every request we set:

• x-vercel-ai-zero-data-retention: true
• x-vercel-ai-disallow-prompt-training: true

These headers instruct the AI Gateway and the underlying model provider that your vulnerability data must not be retained, logged for human review, or used to train or fine-tune any machine-learning models. No raw scan data or enriched findings are sent to the AI provider outside of these ephemeral, zero-retention requests.

6. Third-Party Services

We engage a limited number of subprocessors to deliver the Service. Each is evaluated for privacy and security compliance:

7. Data Retention

• Account data: Retained for the life of your account plus 30 days after account closure, after which it is permanently deleted.
• Scan findings and alerts: Retained while your account is active so you can track historical security posture. Deleted within 30 days of account closure.
• AI-generated overviews: Stored for your reference. Deleted with your account data.
• Scan job logs and queue data:Ephemeral — Redis queue entries are drained on each run; Cloud Run container logs rotate per Google’s retention policy.
• Analytics data (Umami):Retained in the separate CyberShore-Umami database. You may opt out of analytics tracking at any time by enabling your browser’s “Do Not Track” setting or using an ad-blocker — Umami honours DNT signals.

8. Multi-Tenant Data Isolation

CyberShore serves multiple organisations from a shared database. To enforce strict data isolation we use PostgreSQL Row Level Security (RLS) policies. Every database query is scoped to the authenticated user’s tenant, ensuring that organisation A can never read, modify, or discover organisation B’s data. Service-role access (used by automated scan workers) is tightly controlled and never exposed to end users.

9. Security Measures

• Encryption in transit: All connections use TLS 1.2+.
• Encryption at rest: All database content is encrypted with AES-256.
• Password security:Passwords are validated against the Have I Been Pwned k-anonymity API at set time to prevent credential stuffing. Passwords are hashed using bcrypt (via Supabase Auth).
• Multi-factor authentication: TOTP-based 2FA and WebAuthn/Passkey support are available to all users.
• Row Level Security (RLS): As described in Section 8.
• API authentication: All API routes require a valid JWT (Bearer token). Cron endpoints additionally require a shared secret.
• No credential storage: CyberShore performs external-only scanning. We never request, store, or have access to your cloud provider API keys, internal network credentials, or authentication secrets.

10. Cookies

CyberShore uses only strictly necessary cookies:

• Session cookies: Supabase Auth session tokens (prefix sb-) for maintaining your authenticated session. These are HttpOnly, Secure, and SameSite=Lax.
• Tenant selection cookie: selected_tenant_id (admin users only; 30-day expiry).

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. Our self-hosted Umami analytics does not use cookies and honours browser “Do Not Track” signals.

11. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Ask us to correct inaccurate or out-of-date information.
• Deletion: Request that we delete your personal information (subject to any legal obligations requiring us to retain it).
• Complaint: Lodge a complaint with us about a breach of the APPs, and if unsatisfied with our response, escalate to the Office of the Australian Information Commissioner (OAIC).

To exercise any of these rights, contact us using the details in Section 13. We will respond within 30 days as required by the APPs.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes, we will notify you via email and/or through a notice in the Service prior to the change becoming effective. The “Last updated” date at the top of this page indicates when the policy was last revised.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact our Privacy Officer:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.