Techly Supplier and Third-Party Security Policy

Purpose

Pyron runs on other companies' services, and a customer's data is only as safe as the weakest of them. This policy sets out how Techly Operations Pty Ltd (Techly) chooses those providers, what it requires of them, and how it keeps checking.

Scope

Every third party that receives Customer Data or personal information from Techly, hosts part of Pyron, or provides a tool Techly uses to build and run it.

The providers that receive data

Part 6 of the Privacy Statement is the authoritative list, and Data locations says what each one receives.

Provider	What it does for Pyron	Where
Amazon Web Services	Hosting, storage, backups, email delivery, single sign-on and Amazon Bedrock for Pyron AI	Australia
Cloudflare	Network security and delivery, page rendering and running customer automations	Its data centre nearest the user, normally in Australia but not guaranteed
Grafana Labs	Operational logs, metrics and traces	Australia
Permit.io	Authorisation	United States
Functional Software (Sentry)	Error reporting	European Union
Steel	Remote browsers for browser automation, an optional feature nothing uses by default	United States
All Quiet and Slack	Alerting Techly's on-call staff	Outside Australia

Suppliers of Techly's own tools also hold Techly's information: GitHub holds Pyron's source code and runs its checks, and Google Workspace holds staff email, the enquiries sent through the website, and the accounts Pyron Support signs in with.

Choosing a provider

Before a provider receives Customer Data or personal information, the Technical Director records:

• what it will receive, and where it will hold and process it;
• its security: an independent certification or audit report where it has one, such as ISO/IEC 27001 or SOC 2, and how it protects and separates customers' data;
• its data processing terms, which must bind it to use the data only to provide its service, to protect it, to tell Techly about a breach, and to delete it when the service ends;
• how Techly would leave it: getting the data back, and having it deleted.

Then:

• Customer records and files are stored in Australia. A provider that would store them anywhere else is not used.
• The Privacy Statement comes first. A provider that will receive personal information is named in the Privacy Statement before it receives any.
• The directors decide whether to adopt a provider that will receive Customer Data.

Contracts

Each provider that receives personal information must have data processing terms in place. Most of these providers include them in their standard terms. Techly is collecting a copy of the terms that apply to each provider, and records where a provider's terms fall short of this policy as a risk until they are resolved.

Watching providers

• Every year, the Technical Director reviews each provider: whether it is still needed, what it receives and where, its latest security report, and any change to its terms. The review is recorded.
• Between reviews, a provider's security incident, a change to where it processes data, or a change to its terms triggers a review of that provider.
• Each provider has the least access it needs, through credentials Techly can revoke.

Leaving a provider

When Techly stops using a provider, it removes the provider's access, asks it to delete what it holds, and updates the Privacy Statement and this Trust Centre.

Who is responsible

• The Technical Director owns this policy, assesses providers and runs the annual review.
• The directors approve every provider that will receive Customer Data.
• The Data Protection Officer keeps the Privacy Statement's list of providers accurate.

Review

The Technical Director reviews this policy every year, at the annual review of providers.