Updated Guides
Recruitment
Candidate trust, at the volume you hold it.
We protect candidate data at volume and help Australian agencies answer client security questionnaires with evidence.
Recruitment
The obligations in play.
More personal information per employee than almost any business.
Privacy Act 1988 and the APPs
Candidate personal information sits squarely under the APPs: the employee-records exemption does not extend to applicants.
Notifiable Data Breaches scheme
A breach of candidate data likely to cause serious harm must be assessed and notified.
Labour hire licensing
Queensland, Victoria and South Australia license labour-hire providers, with conduct and reporting conditions attached.
Spam Act 2003
Outreach at volume must respect consent, identification and unsubscribe rules.
Threat picture
What the sector is facing.
Updated Guides
AI tools, data leakage and the Privacy Act
What we do
What you carry, and what we do about it.
Candidate PII at volume, and the Privacy Act’s employee-records exemption does not cover job applicants.
We map the data you hold and where it lives, and review the gaps against the Australian Privacy Principles.
Privacy Act / APP upliftClient security questionnaires decide whether you get the brief, and they ask about the SaaS stack you run on.
A posture assessment maps where you stand against recognised controls, and SMB1001 readiness turns the answers into a certification you can point at.
Security posture assessmentRecruiters live in email and act fast: the behaviour account-takeover and payroll-redirection scams exploit.
Controlled phishing campaigns measure how the team behaves under a well-crafted pretext, and a tenant identity review closes the paths a captured credential would use.
Phishing and social-engineering simulationThe stack itself (intake, screening, outreach) has to hold the line without slowing the desk down.
We build and secure candidate intake, screening and outreach systems, with security invariants pinned by tests so a later change cannot regress them.
Product and platform engineering
Services
The services that apply.
- SMB1001 readinessGap assessment, evidence pack and support through to your target tier.
- Microsoft 365 and Azure security reviewIdentity, Conditional Access and tenant settings, reviewed setting by setting.
- Penetration testingNetworks, web apps, cloud and AI systems, with a report and a re-test.
- Software engineeringWeb, mobile and platform builds, run in production.
Delivered work
Built for the sector.
Group venture
For the group’s executive search venture we built the recruiter portal that carried a search from the first approach to the placement in one system, with every candidate on a role judged against the same scorecard.
Questions, answered.
What does the Privacy Act require of a recruitment agency?
Candidate personal information sits squarely under the Australian Privacy Principles, because the employee-records exemption does not extend to job applicants, and a breach likely to cause serious harm must be assessed and notified. We map the data you hold and where it lives, and review the gaps against the APPs.
How do we answer a client’s security questionnaire?
A posture assessment maps where you stand against recognised controls, and SMB1001 readiness turns the answers into a certification you can point at.
How do we protect recruiters from email account takeover?
Controlled phishing campaigns measure how the team behaves under a well-crafted pretext, and a tenant identity review closes the paths a captured credential would use.
Industries
Other sectors we work in.
Health
Clinical software and the security around it, with the Privacy Act and the APPs built in.
Legal
Practice and compliance systems for law firms, with trust accounting and QLS obligations in view.
Financial services
Portals and operations for AFSL holders, built around the licence perimeter.
