PYRON Trust Centre
APRA CPS 234 and CPS 230 response pack
What an APRA-regulated customer must ask a service provider under CPS 234 and CPS 230, answered.
An APRA-regulated entity that uses Pyron has duties under two prudential standards: CPS 234 Information Security (in force since 1 July 2019) and CPS 230 Operational Risk Management (the version in force from 1 July 2026). Each row names a paragraph, says what it asks of you, puts the question that follows to us, and answers it. Whether Pyron is a material service provider to you is your decision, made against your own critical operations.
The answers most entities ask about first:
- Incident notice. We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours. CPS 234 gives you 72 hours from becoming aware of a material incident to notify APRA.
- Audit and access rights, and contract terms. These belong in the written agreement under which you use Pyron. A standard Data Processing Agreement is not yet written, and no published Pyron document yet gives APRA access or a right to visit, so raise what CPS 230 paragraphs 53 and 54 require when you contract with us.
- Who else is involved. Every provider that handles customer data, and where, is on Data locations.
- Business continuity. The production database runs in a single availability zone and is backed up continuously, restorable to any moment in the last 35 days. The Business Continuity Policy sets a recovery point of about five minutes. A full restore has not yet been tested, so no recovery time is set, and the plan has not been exercised.
- Leaving. When a subscription ends there is a 30-day export window, then deletion within 90 days.
Status is where Pyron's part stands, computed from the same control register as every other assessment here, and Your part says what you do. The standards are APRA's, read from the Federal Register of Legislation; nothing here is legal advice on how they apply to you.
- In place
- 8
- Partial
- 22
- Planned
- 1
- Not applicable
- 0
Showing 31 of 31
| Reference | Requirement | Status | Responsibility | How we meet it |
|---|---|---|---|---|
| CPS 234 para 14 | The entity defines who is responsible for information security. Who is responsible for it at Pyron? | In place | Pyron | Techly's two directors are accountable for information security. The Technical Director runs it day to day, and the Managing Director takes part in each policy's review and in every decision to accept a risk. |
| CPS 234 para 16 | Where a third party manages its information assets, the entity assesses that party's information security capability. How can we assess yours? | Partial | Shared | This Trust Centre publishes our security overview, where each kind of data is held and these self-assessments, openly and each with a version and a date. Techly's Information Security Policy and the thirteen policies under it, among them Access Control, Acceptable Use, Business Continuity, Cryptography, Logging and Monitoring, Secure Development, Supplier Security and Vulnerability Management, are published in this Trust Centre. Each names its owner and is reviewed every year. Pyron holds no security certification and has had no independent penetration test. Your part: assess our capability in proportion to the consequences of an incident affecting what you keep in Pyron. |
| CPS 234 paras 18 and 19 | The entity keeps an information security policy framework that gives direction to every party with a part in it. What policies govern Pyron? | In place | Pyron | Techly's Information Security Policy and the thirteen policies under it, among them Access Control, Acceptable Use, Business Continuity, Cryptography, Logging and Monitoring, Secure Development, Supplier Security and Vulnerability Management, are published in this Trust Centre. Each names its owner and is reviewed every year. |
| CPS 234 para 20 | The entity classifies its information assets by criticality and sensitivity, including those a third party manages. How does Pyron classify and handle our data? | In place | Shared | Information is classified Public, Internal, Confidential or Restricted, with handling rules for each. Everything a customer keeps in Pyron is Restricted: stored only in Pyron's production systems and with the providers our Privacy Statement names, and never copied to an email, a chat or a ticket. Your part: classify what you keep in Pyron by its criticality and sensitivity to you. |
| CPS 234 para 21 | The entity's information assets, including those a third party manages, are protected by controls in proportion to their threats, criticality and sensitivity. What protects our data in Pyron? | Partial | Shared | Each workspace's data lives in a database schema of its own, and every request is answered inside the schema of the workspace it was made to. Each workspace has its own environment in our authorisation service, and a sign-in names the workspace it was issued for, so no other workspace accepts it. The database server and the computing cluster are shared. The database, its backups and stored files are encrypted with AES-256 under keys held in AWS Key Management Service, which rotate automatically; the secrets behind authenticator apps are encrypted a second time inside the database. Pyron is served only over HTTPS with TLS 1.2 or later, and tells browsers never to use plain HTTP; the database refuses an unencrypted connection, and file storage refuses an unencrypted request. Traffic between our own services inside the cluster is not encrypted. What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Your part: set your workspace's roles, two-step sign-in and single sign-on to match how critical your data is. |
| CPS 234 para 22 | Where a third party manages its information assets, the entity evaluates the design of that party's controls. Where is the design of Pyron's controls set out? | In place | Shared | This Trust Centre publishes our security overview, where each kind of data is held and these self-assessments, openly and each with a version and a date. This Trust Centre sets out what Pyron does and what a customer does, action by action, against ASD's Essentials for cloud, and names the owner of each answer to the Cloud Security Alliance's questionnaire. Your part: evaluate the design from the assessments here, and ask us for anything they leave out. |
| CPS 234 para 23 | The entity can detect and respond to information security incidents in a timely manner. How does Pyron detect and respond to them? | Partial | Pyron | Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting. A sign-in as an account's root user, use of emergency access, or a change to an organisation policy or to our cloud activity logging pages our on-call engineer; a change to who can reach our AWS accounts, and a new finding of access from outside them, raise an alert. Managed threat detection for our AWS accounts (Amazon GuardDuty), and detection of unusual sign-in patterns in Pyron, are not in place. Alerts that need someone page our on-call engineer through All Quiet. On-call is one engineer, with no second line. |
| CPS 234 paras 24 to 26 | The entity keeps plans to respond to plausible incidents, covering every stage and escalation, and reviews and tests them every year. Does Pyron have a response plan, and is it tested? | Partial | Pyron | The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held. |
| CPS 234 paras 27 and 28 | The entity tests its controls through a systematic program, and where it relies on a third party's testing, checks that the testing is enough. How are Pyron's controls tested, and how often? | Partial | Shared | Automated tests that try to reach one workspace's data from another run on every change, as do censuses that hold every operation to its declared permission and every read to its scoping. Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again. Pyron holds no security certification and has had no independent penetration test. Your part: judge whether that testing is enough for what you keep in Pyron. |
| CPS 234 para 30 | Testing is done by skilled and functionally independent specialists. Has anyone independent tested Pyron? | Planned | Pyron | Pyron holds no security certification and has had no independent penetration test. |
| CPS 234 paras 32 to 34 | The entity's internal audit reviews the design and operating effectiveness of controls a third party maintains, and assesses any assurance it relies on. What assurance can our internal audit rely on? | Partial | Shared | Pyron holds no security certification and has had no independent penetration test. This Trust Centre publishes our security overview, where each kind of data is held and these self-assessments, openly and each with a version and a date. Your part: decide whether our own account here is enough for your internal audit to rely on. |
| CPS 234 para 35 | The entity notifies APRA within 72 hours of becoming aware of a material information security incident. How soon will Pyron tell us of one? | In place | Shared | We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours, and assess a possible eligible data breach under the Privacy Act 1988 (Cth) within 30 days. Your part: notify APRA within 72 hours where the incident is material to you. |
| CPS 234 para 36 | The entity notifies APRA within 10 business days of a material control weakness it cannot remediate in time. Will Pyron tell us of a control weakness? | Partial | Shared | We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours, and assess a possible eligible data breach under the Privacy Act 1988 (Cth) within 30 days. We do not yet commit to tell each customer of a control weakness that has not affected its data. Your part: watch this Trust Centre's assessments for a status that changes. |
| CPS 230 para 37 | For each critical operation the entity sets tolerance levels: the longest disruption, the most data loss, and the minimum service it would accept. What recovery time and data loss should we plan for if Pyron fails? | Partial | Shared | The database is backed up continuously and can be restored to any moment in the last 35 days. It is protected from deletion, a final snapshot is taken if it is ever deleted, and an earlier version of a replaced or deleted file is kept for 30 days. A full restore from backup has not yet been tested. The Business Continuity Policy schedules one every quarter. No recovery time objective is set: no full restore has been tested yet. Your part: set your tolerance levels with Pyron's single-zone database and untested restore in view. |
| CPS 230 para 41 | The entity notifies APRA within 24 hours of a disruption to a critical operation outside tolerance. Will Pyron tell us when the service is disrupted? | Partial | Shared | Alerts that need someone page our on-call engineer through All Quiet. On-call is one engineer, with no second line. We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours, and assess a possible eligible data breach under the Privacy Act 1988 (Cth) within 30 days. We do not yet commit to tell customers of an outage within a set time: the 48-hour notice is for security incidents affecting your data. Your part: notify APRA within 24 hours if a disruption of Pyron takes a critical operation outside its tolerance. |
| CPS 230 paras 42 and 43 | The entity tests its business continuity plan every year, including a disruption at a material service provider. Can a disruption of Pyron be part of our exercise? | Partial | Shared | The Business Continuity Policy sets out what is backed up, how a failure is handled and who leads recovery, with a recovery point of about five minutes and a restore test every quarter. The recovery time is unknown until the first restore test, which has not yet run, and the plan has not been exercised. Your part: include a disruption of Pyron in your own exercises. |
| CPS 230 para 47(c) | The entity manages the risks of fourth parties its material service providers rely on. On whom does Pyron rely to deliver the service? | Partial | Shared | Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history. The Supplier Security Policy sets how a provider is chosen (what it will receive and where, its security, its data processing terms, and how we would leave it) and has each one reviewed every year. Copies of each provider's data processing terms are still being collected. Your part: record the providers Data locations names as fourth parties. |
| CPS 230 para 52(a) | Before relying on a material service provider, the entity assesses its ability to provide the service on an ongoing basis. Can Pyron keep providing it? | Partial | Shared | The database is backed up continuously and can be restored to any moment in the last 35 days. It is protected from deletion, a final snapshot is taken if it is ever deleted, and an earlier version of a replaced or deleted file is kept for 30 days. The application runs on servers in two availability zones, with the path that answers requests spread across both. The production database runs in a single availability zone, with no standby, and we make no uptime commitment. The Business Continuity Policy sets out what is backed up, how a failure is handled and who leads recovery, with a recovery point of about five minutes and a restore test every quarter. The recovery time is unknown until the first restore test, which has not yet run, and the plan has not been exercised. Your part: weigh the single-zone database and the untested restore in your due diligence. |
| CPS 230 para 52(b) | The entity assesses the risks of the provider's location and concentration, and of the parties it relies on. Where is Pyron delivered from? | In place | Shared | Your records and files are stored in Australia, and the AI runs in Australia: Pyron's services may call only Amazon Bedrock's Australian models. Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history. Your part: assess the concentration in Amazon Web Services, which hosts your records, files and backups. |
| CPS 230 para 53(a) | The formal agreement specifies the services and their service levels. What service levels does Pyron offer? | Partial | Shared | A customer uses Pyron only under a written agreement with Techly Operations, in which the terms between us are agreed (Website Terms, clause 3.3). The production database runs in a single availability zone, with no standby, and we make no uptime commitment. Your part: agree any service level you need in the written agreement. |
| CPS 230 para 53(b) | The formal agreement sets out each party's rights and responsibilities, including ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity. Where are these set out? | Partial | Shared | A customer uses Pyron only under a written agreement with Techly Operations, in which the terms between us are agreed (Website Terms, clause 3.3). A Data Processing Agreement is not yet written. Until it is, the Privacy Statement sets out how customer data is handled, kept, returned and deleted. Your part: agree these in the written agreement. |
| CPS 230 para 53(c) | The formal agreement lets the entity meet its legal and compliance obligations. How does Pyron support ours? | Partial | Shared | A customer uses Pyron only under a written agreement with Techly Operations, in which the terms between us are agreed (Website Terms, clause 3.3). A Data Processing Agreement is not yet written. Until it is, the Privacy Statement sets out how customer data is handled, kept, returned and deleted. Personal information is handled as our Privacy Statement and the Data Protection and Privacy Policy set out, under the Privacy Act 1988 (Cth), and a Data Protection Officer is accountable for it. Your part: name the obligations Pyron must support in the written agreement. |
| CPS 230 para 53(d) | The formal agreement requires the provider to notify the entity of the material service providers it relies on. How will we hear of Pyron's providers and changes to them? | Partial | Shared | Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history. A Data Processing Agreement is not yet written. Until it is, the Privacy Statement sets out how customer data is handled, kept, returned and deleted. Your part: watch our Privacy Statement's revision history, and agree notice of a change in the written agreement. |
| CPS 230 para 53(e) | The formal agreement makes the provider liable for any failure of its sub-contractors. Is Pyron liable for its providers? | Partial | Shared | A customer uses Pyron only under a written agreement with Techly Operations, in which the terms between us are agreed (Website Terms, clause 3.3). A Data Processing Agreement is not yet written. Until it is, the Privacy Statement sets out how customer data is handled, kept, returned and deleted. Your part: agree it in the written agreement. |
| CPS 230 para 53(f) | The formal agreement says which parts continue through a force majeure event. Which parts of the service continue? | Partial | Shared | A customer uses Pyron only under a written agreement with Techly Operations, in which the terms between us are agreed (Website Terms, clause 3.3). A Data Processing Agreement is not yet written. Until it is, the Privacy Statement sets out how customer data is handled, kept, returned and deleted. Your part: agree it in the written agreement. |
| CPS 230 para 53(g) | The formal agreement lets the entity terminate all or part of the arrangement. How do we leave, and what happens to our data? | Partial | Shared | A customer uses Pyron only under a written agreement with Techly Operations, in which the terms between us are agreed (Website Terms, clause 3.3). A Data Processing Agreement is not yet written. Until it is, the Privacy Statement sets out how customer data is handled, kept, returned and deleted. People can export a table's records as a spreadsheet. When a subscription ends there is a 30-day export window, then deletion within 90 days; deleting a workspace removes its database schema, its files, its stored secrets and its single sign-on connection, and backups age out on their normal rotation. Your part: agree the right to terminate all or part of the service in the written agreement. |
| CPS 230 para 54 | The formal agreement gives APRA access to documentation, data and information about the service, the right to visit the provider, and the provider's agreement not to impede APRA. Will Pyron give APRA these rights? | Partial | Shared | A customer uses Pyron only under a written agreement with Techly Operations, in which the terms between us are agreed (Website Terms, clause 3.3). A Data Processing Agreement is not yet written. Until it is, the Privacy Statement sets out how customer data is handled, kept, returned and deleted. No published Pyron document yet gives APRA these rights. Your part: include APRA's access in the written agreement. |
| CPS 230 para 55(c) | For each material arrangement, the entity can execute its business continuity plan if needed. What happens to our critical operation if Pyron is unavailable? | Partial | Shared | The database is backed up continuously and can be restored to any moment in the last 35 days. It is protected from deletion, a final snapshot is taken if it is ever deleted, and an earlier version of a replaced or deleted file is kept for 30 days. The production database runs in a single availability zone, with no standby, and we make no uptime commitment. A full restore from backup has not yet been tested. The Business Continuity Policy schedules one every quarter. The Business Continuity Policy sets out what is backed up, how a failure is handled and who leads recovery, with a recovery point of about five minutes and a restore test every quarter. The recovery time is unknown until the first restore test, which has not yet run, and the plan has not been exercised. Your part: plan how you would run the operation without Pyron within your tolerance levels. |
| CPS 230 para 55(d) | For each material arrangement, the entity can conduct an orderly exit. Can we leave Pyron in an orderly way? | In place | Shared | People can export a table's records as a spreadsheet. When a subscription ends there is a 30-day export window, then deletion within 90 days; deleting a workspace removes its database schema, its files, its stored secrets and its single sign-on connection, and backups age out on their normal rotation. Your part: plan your exit, and export what you need within the export window. |
| CPS 230 para 59 | The entity monitors the provider's performance against service levels, the effectiveness of its controls and both parties' compliance. How can we monitor Pyron? | Partial | Shared | This Trust Centre publishes our security overview, where each kind of data is held and these self-assessments, openly and each with a version and a date. People whose role allows it can export the audit trail, filtered or whole, as a spreadsheet or as a file for a security system (one event per line), and each export is itself recorded. There is no published status page or report on service levels. Your part: review this Trust Centre at each review of the arrangement, and your workspace's audit trail. |
| CPS 230 para 60(b) | The entity notifies APRA before entering a material offshoring arrangement, including where data or personnel will be offshore. Is any of the service performed outside Australia? | In place | Shared | Your records and files are stored in Australia, and the AI runs in Australia: Pyron's services may call only Amazon Bedrock's Australian models. Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history. Your part: decide from Data locations whether your arrangement is material offshoring, and notify APRA before it starts if it is. |