Privacy Policy

At Pensure, we value your privacy and are committed to handling personal information responsibly. This Privacy Policy explains how Pensure Pty Ltd (ABN 87 688 512 334) collects, uses and shares information when you visit pensure.ai, contact us, use the Pensure platform or engage us for penetration-testing services (together, the “Platform”).

1. Information we collect

The information we collect depends on how you interact with Pensure.

Website and enquiries

When you contact us by email, book a scoping call or submit an enquiry, we may collect your name, work email address, organisation, contact details, the contents of your enquiry and information needed to respond or scope a potential engagement. The marketing site does not contain a form-processing backend; contact links open email or an external Google Calendar booking flow.

Account and product information

When you use the Pensure product, Pensure may process account, organisation, billing, authentication, usage and support information needed to provide and secure the service. Product sign-in is handled through the external Pensure application at app.pensure.ai; the marketing-site repository does not contain that application's authentication or storage implementation.

Penetration-testing engagement information

An engagement may involve targets, application or API information, test accounts, authentication material where required, vulnerability evidence, screenshots, request-response evidence, reports and remediation information. Pensure uses this information to scope and perform authorised testing, validate findings, prepare reports, communicate with the customer and support retesting.

Please do not send passwords, API keys, tokens or other secrets through marketing forms, ordinary email or booking notes. Where access is required, Pensure arranges an appropriate secure handoff after scope and authorisation are confirmed.

Analytics and similar technologies

The marketing site uses Google Analytics and PostHog to understand website and platform usage, measure performance, monitor relevant events and improve our services. These services may receive technical information such as IP address, browser and device information, pages viewed, approximate location, referral information and interaction events. See our Cookie Policy for more detail.

2. AI-assisted testing and data processing

Pensure uses AI-enabled testing workflows during penetration testing, with human validation and review before final delivery. The platform is documented as using managed Google Cloud services including Vertex AI. Relevant engagement information may therefore be processed by Pensure's AI-enabled testing workflows when needed to perform the authorised service.

The repository does not establish the exact categories of engagement information sent to Vertex AI, provider retention settings, whether provider personnel can access prompts or outputs, or whether those inputs and outputs are excluded from general model training under Pensure's current provider arrangements. Those details require confirmation before Pensure makes a stronger public commitment. Pensure does not use this uncertainty to change the approved human-validation model: every reported finding is human validated and reviewed before final delivery.

3. How we use information

We use information to:

respond to enquiries and arrange or scope engagements;
provide, secure, support and improve the Platform;
perform authorised penetration testing and generate reports;
validate findings, review evidence and support retesting;
measure website and product usage through Google Analytics and PostHog;
communicate about services, reports, support and material updates;
prevent misuse, investigate security events and enforce our agreements; and
meet legal, accounting and operational requirements.

We may share information with:

Service providers and subprocessors that support the Platform or our business, including Google Cloud for platform infrastructure, Google Analytics and PostHog for analytics, Cloudflare for marketing-site delivery and security, and Google Calendar for appointment scheduling;
Pensure personnel and qualified reviewers where access is required to deliver, validate, report or retest an engagement;
Your authorised personnel or other parties you direct us to involve; and
Legal or regulatory authorities where required by law or reasonably necessary to protect rights, safety or the integrity of the Platform.

We do not sell your personal information to third parties.

5. Overseas processing

Pensure's platform runs on Google Cloud Platform, using managed services including Cloud Run, Secret Manager and Vertex AI. The marketing site also uses Google Analytics and PostHog; PostHog is configured in this repository to use the US endpoint us.i.posthog.com. These services may process information outside Australia. The exact Google Cloud hosting region and complete provider data-location configuration are not established in this repository.

6. Security and human access

Pensure combines Pensure-operated application and engagement controls with the independently assessed controls of Google Cloud infrastructure. Connections use TLS/HTTPS, and Google Cloud encrypts customer content at rest and in transit by default. Qualified humans may access relevant engagement information where required to validate findings, assess exploitability, remove false positives, review evidence, finalise reporting and support retesting.

For more detail about the infrastructure and engagement safeguards, see Security and data handling.

7. Retention

We retain information for as long as reasonably necessary for the purpose for which it was collected, to provide and secure the Platform, to complete an engagement, to meet accounting or legal requirements, or to resolve disputes. Retention depends on the type of information and the applicable customer agreement or statement of work. Analytics retention is also affected by the configuration of the relevant provider.

Pensure's exact retention and deletion schedules for account data, engagement data, analytics and backups are not published here because they require confirmation.

Email: josh@pensure.ai
Address: 30-03, 201 Elizabeth Street, Sydney NSW 2000, Australia