Security and accountability, by design.

Australia

• Privacy Act 1988 (Cth) and the Australian Privacy Principles

  Collection, notice, use, disclosure, cross-border disclosure (APP 8), security of personal information (APP 11), access and correction

• Privacy Act 1988 (Cth) Part IIIA and the Privacy (Credit Reporting) Code

  2014 Code v3 applies; a 2025 replacement is to be confirmed

  Permitted purpose, destruction and correction of credit information

• Privacy Act 1988 (Cth) Part IIIC — Notifiable Data Breaches

  30-day assessment period; statement to the OAIC and notification to affected individuals

• Cyber Security Act 2024 (Cth)

  Mandatory 72-hour ransomware-payment report to Home Affairs and the ASD; limited-use protections for information given to the National Cyber Security Coordinator

• Spam Act 2003 (Cth)

  Consent, identification and unsubscribe for commercial electronic messages

• Security of Critical Infrastructure Act 2018 (Cth)

  Determined not applicable, 16/09/2026

  Not applicable

  youX is not a responsible entity for a critical infrastructure asset, and is not a critical data storage or processing asset. The determination and its re-assessment triggers are recorded in the Regulatory Obligations Register.

New Zealand

• Privacy Act 2020 and the Information Privacy Principles

  NZ consumer applications

  IPP 3 collection notice; IPP 3A (from 01/05/2026) notice where personal information is collected indirectly; IPP 6 and 7 access and correction; IPP 12 cross-border disclosure

• Privacy Act 2020 Part 6

  Separate notification to the NZ Office of the Privacy Commissioner — a breach touching both markets is two notifications, each assessed on its own criteria

• Credit Reporting Privacy Code 2020 (Centrix)

  Consent before a credit check, permitted purpose, retention limits

Certificates & audit reports

Issued by our external auditors. Shared under NDA with customers and prospective partners.

• ISO/IEC 27001:2022 certificate

  Information Security Management System — issued June 2026

  PDFRequest access

• ISO/IEC 27017:2015 certificate

  Cloud information security controls — issued June 2026

  PDFRequest access

• ISO/IEC 27018:2019 certificate

  Protection of PII in public cloud — issued June 2026

  PDFRequest access

• Penetration test summary

  Executive summary of the most recent independent test of our defences

  PDFRequest access

Security documentation

How the platform is built, monitored and defended. For anything not listed here, ask — we would rather answer than have you guess.

• Request additional documentation

  Tell us what your review needs. If we hold it we will send it; if we do not, we will answer directly rather than leave you guessing.

  Request access

• youX security overview

  Our security posture, architecture and monitoring, written for a business audience

  PDFOpen

Privacy & legal

Published publicly and kept current.

• Privacy Policy

  What we collect, why, and the rights you have over it

  Open

• Terms & Conditions

  Open

• Vendors & sub-processors

  Every third party that handles personal information for us

  Open

• Third-party service fee schedule

  Open