Most owners only know about one of the six things regulators, insurers and courts now expect. I sort all six with you, on one working call. AU$5,997 one-time, with 3 months of Titanos Monitor included free — versus ~AU$18,000+ for a comparable Vanta-plus-consultant setup in year one.
Built for Australian SMBs (5–50 staff) on Squarespace, WordPress, Microsoft 365, and Google Workspace. Plain English on the call. No jargon, no PDF-only hand-off. Health providers — clinic, allied health, pharmacy, any size — are already covered by the Privacy Act. There is no small-business exemption for health.
14-day refund if no deliverable has been issued. Monitoring cancellable any time. Read full terms ›
Scoped enquiry → invoice within 1 business day → pay by card via Stripe · 14-day refund if no deliverable has been issued
ABN 34 318 502 254 · Australian-owned · 3,600+ unique AU/NZ/SG businesses in the scan corpus · Methodology
See the kind of documentation this engagement produces — my own evidence pack, published in full →
Not sure you have a problem? The free scan doubles as a compliance gap snapshot — start there, no card, no commitment. Free scan →
90 minutes. Screen-share. I apply every change with you, live — not a PDF you have to figure out later.
The findings I prepared for your business — in plain English, no jargon. You'll know exactly what's missing and why it matters before I touch a single setting.
Privacy policy live. Breach plan drafted. SPF/DKIM/DMARC records in your DNS. Two-factor rolled out. Data map completed. AI disclosure added. All six obligations — done by the end of the call, not homework for later.
Every gap assigned and the fixes underway. The signed attestation letter lands at your 30-day review, once the fixes are verified — a one-page proof you can hand to a regulator, your insurer, or an enterprise client asking for it.
Your business's exposure changes every month. You keep watching it without lifting a finger for 3 months, then AU$149/mo only if you choose to continue — and I'll flag anything new that needs attention.
Ordered by what hits an SMB owner soonest, not chronologically. The compliance pack covers all five in one pass.
Since 10 June 2025, an individual whose data you seriously mishandle can sue you under the new privacy tort — no regulator, no OAIC queue. It applies even if your turnover currently exempts you from the rest of the Act.
Cyber insurers increasingly deny breach claims when baseline controls weren’t in place — things like two-factor login and keeping software up to date (the Australian government’s Essential Eight checklist). Policies commonly condition cover on documented security hygiene. Without a signed record, you’re relying on goodwill at the worst possible moment.
Automated decision-making — including AI tools your business uses — must be disclosed in your privacy policy with affected-decision categories, types of personal information used, and process explanation. Penalties up to AU$50M for serious or repeated interference.
The second reform tranche is positioned to remove the AU$3M turnover exemption, pulling roughly 2.3M additional AU SMBs into Privacy Act scope. If you’re currently exempt, that protection has a sunset on it.
Since January 2026 the OAIC has run compliance sweeps across sectors including real estate, pharmacies, and licensed venues — examining businesses before any complaint is made. “We’ve had no problems” is no longer the same as “we won’t be looked at.”
Two questions. No data collected, nothing submitted.
Is your business a health service provider (clinic, allied health, pharmacy, any size)?
Six steps from scan to signed attestation. No PDF-only deliverable, no opaque hand-offs.
You complete a 10-minute intake form (company, hosting, identity provider, MFA + backup state, what’s driving compliance). I run an external scan on your domain — a look at what an attacker can see about your business from the outside, with version-by-version CVE matching against the public NVD database. Output: scan JSON plus a documented record of what you affirmed about internal posture.
Within 3 business days I send your draft pack (~17pp, 13 sections) — your privacy policy + ADM disclosure draft, your NDB runbook (the step-by-step plan for the day you get breached, so you hit the mandatory notification deadline instead of panicking), vendor risk register (a one-page record of every third-party service that touches your customer data), and scan findings split by what I directly verified vs what you affirmed. The final evidence pack — with everything we applied together — lands within 24 hours of the working call, regulator-ready as a single PDF.
Screen-shared working session. I apply changes live: SPF / DKIM / DMARC / CAA records, Microsoft 365 or Google Workspace security defaults, MFA enabled across team, privacy policy + ADM disclosure deployed to your live site, breach-response runbook saved to your shared drive. You keep admin access throughout — every change is yours.
Some controls live on Squarespace / Shopify / Xero / Cliniko — not in your hands. You get a one-page escalation list: exactly what to ask your host to fix, with template wording. Anything they decline gets documented as 'reasonable steps taken' for your attestation.
I audit what shipped: policy is live, MFA is enforced, runbook is shared. Anything that drifted gets re-applied. You receive a signed letter you can hand to a regulator, insurer, or enterprise client stating exactly what was checked and fixed against the Australian government’s baseline security checklist (Essential Eight, Maturity Level 1), plus a Privacy Act compliance posture letter.
Monthly external scan with delta report, CVE alerts matched to your stack, and a regulatory-update briefing — same product as Titanos Monitor, included free for 3 months covering your 30-day review and beyond. After month 3 it continues at AU$149/mo only if you opt in — no silent continuity. I'll email you the exact date before any meter would start.
Your hosting service controls some things. I give you exactly what to ask them to fix, and document the rest as "reasonable steps taken."
I apply these with you on the working call.
I give you exactly how to escalate.
No tiers. No PDF-only option. One done-with-you engagement where I apply the changes together with you on a 90-minute working call — 3 months of monitoring included, plus regulatory briefings through the engagement whenever the rules move.
Comparable Vanta + DPO contractor: ~AU$18,000+ in year 1
Six obligations sorted in one pass: privacy policy, breach plan, email security, login security, data mapping, and AI disclosure. Everything you need to demonstrate “reasonable steps” under the Privacy Act and the Australian government's baseline security checklist (Essential Eight, Maturity Level 1), applied together with you in a single working call — then maintained for the 3-month monitoring window.
14-day refund if no deliverable has been issued. Monitoring cancellable any time. Read full terms ›
Scoped enquiry → invoice within 1 business day → pay by card via Stripe · 14-day refund if no deliverable has been issued
The first 3 months of Titanos Monitor ship with the pack — automatic, no extra charge. What happens at the end of month 3 is the part most vendors get wrong.
Monthly external scan, delta report, CVE alerts matched to your stack, and a regulatory briefing land in your inbox. Same product as Titanos Monitor — included with the pack.
Plain-English email: "Your 3 included months end on {date}. If you want it to continue at AU$149/mo, subscribe here. If you do nothing, it simply stops — no charge, no action needed."
Default mode: no charge unless you affirmatively subscribe. No auto-charge unless you choose to keep it. No retention sequence. No coupon games.
Want to see your current security exposure first? Free scan →
Need an AI build instead? AI Implementation for Business →
One engagement, one outcome: all six obligations sorted together — privacy policy, breach plan, email security, login security, data mapping, and AI disclosure — with every change applied on the 90-minute working call, a signed Privacy Act + Essential Eight ML1 attestation letter, and the 13-section evidence pack as proof of work.
14-day refund if no deliverable has been issued. Monitoring cancellable any time. Read full terms ›
Scoped enquiry → invoice within 1 business day → pay by card via Stripe · 14-day refund if no deliverable has been issued
Built with AI assistance. Every document, every scan finding, and every attestation is reviewed and signed off by Kyle Deligny (ABN 34 318 502 254) before it reaches you. My ABN is on every page — the accountability is mine.