Trust centre

How we protect your data

We hold our customers' data to the standard we help them reach. This page sets out how we protect it, the frameworks we work to, who processes it for us and how to reach us about security.

How we protect your data

Everyday accounts run the business. Separate admin accounts change how it runs. We assume an everyday account will be phished one day, so it cannot change anything that moves money, data or access.

  • Every app we run signs in through Microsoft Entra ID single sign-on. There are no local passwords.
  • Admin accounts are separate from everyday accounts, and production access is granted for a limited time when it is needed.
  • Access rules are enforced by the server and the database, not by hiding a button. A field a person may not see is never sent to them.
  • Our apps and their data are hosted in Microsoft Azure in Australia.
  • Data is encrypted at rest and in transit, with TLS 1.2 as the minimum.
  • Secrets are held in a key vault, and apps use managed identities in place of stored passwords wherever the platform allows.
  • Every change to our apps goes through reviewed code and automated tests before it is deployed.
  • Our Microsoft 365 data is backed up to storage we hold outside Microsoft.

Frameworks we work to

We measure our own business against the same frameworks we use with customers. We say what we are working toward and when. We do not claim a certification until we hold it.

FrameworkWhere we are heading
ASD Essential EightWorking toward Maturity Level 2, targeted for June 2027
NIST Cybersecurity Framework 2.0Our security programme is organised around it
ISO/IEC 27001:2022Working toward certification, targeted for October 2027

Our information security policy

Cornerstone Cyber protects the information it holds for its customers, partners and staff. The directors own this policy and review it every year.

  • Everyone signs in with single sign-on and multi-factor authentication. Admin work uses separate accounts with time-limited access.
  • Access is granted for the job and removed when the job ends.
  • Customer data stays in systems we approve, hosted in Australia where we choose the region.
  • Devices are managed, encrypted and kept up to date.
  • AI tools are used only under our AI acceptable use policy.
  • Security incidents are reported to our security team, assessed straight away, and notified as the law and our contracts require.
  • We measure ourselves against the ASD Essential Eight, NIST CSF 2.0 and ISO/IEC 27001:2022, and report progress to the board.
  • Breaches of this policy are handled through our disciplinary process.

How we use AI

We use Claude, from Anthropic, to help with our own work and our customer engagements. Every request goes through one gateway that we control and log. Our provider's commercial terms do not allow customer data to be used to train its models. Our AI acceptable use policy sets out what our people may and may not do.

Who processes data for us

These are the services that may process personal or customer information on our behalf. We name the service, never our accounts.

ServiceWhat forWhere
Microsoft Azure and Microsoft 365Hosting our apps, email, files and identityAustralia
AnthropicAI assistance through our gatewayUnited States
GitHubSource code and build pipelines for our appsUnited States
XeroQuotes, invoices and accountsUnited States
Google AnalyticsMeasuring how this website is usedUnited States
LinkedInMeasuring our advertisingUnited States
ActiveCampaignEmail we send and website visit trackingUnited States
Leadfeeder (Pipedrive)Recognising the companies that visit this websiteEuropean Union

List as at 30 October 2026. We update the date when it changes.

Report a security issue

If you think you have found a vulnerability in our website or apps, email security@cornerstonecyber.com.au. Our responsible disclosure policy says what to include and what we commit to in return. The same address is published in our security.txt.

Request our security pack

Answering a security questionnaire or a tender? Ask for our pack and a person from our team will send what you need, including our insurance certificates of currency.