Information Security Policy

Staff Awareness & Training

All Real Bytes staff complete mandatory security awareness training at onboarding and annually thereafter. Training covers phishing recognition, data handling, password hygiene, and incident reporting procedures. Simulated phishing campaigns are run quarterly to reinforce awareness.

Customer Data Handling & Offboarding

For managed services clients, Customer Data is accessed only to provide the contracted Services and is treated as confidential. Access controls, logging and least-privilege principles apply to all engineer activity inside a client environment.

When an engagement ends, Real Bytes makes any Customer Data we hold available to the client for a 60 day Offboarding Period. After that period, we may (subject to applicable law) permanently and irretrievably delete Customer Data in accordance with our usual practices, including secure wipe or disposal of storage devices. Full details are in our Terms and Conditions.

Third-Party Risk Management

All third-party vendors and subcontractors with access to Real Bytes systems or client data are assessed prior to engagement. We require evidence of appropriate security controls, conduct periodic reviews, and maintain data processing agreements (DPAs) where required under Australian privacy law.

Cyber Incident Reporting

Where required by law, Real Bytes may notify and cooperate with relevant Australian authorities (including the Australian Cyber Security Centre) in relation to a cyber incident, including by providing information reasonably necessary to meet legal or regulatory obligations. Unless required by law, Real Bytes has no obligation to make any external report on a client's behalf. Critical infrastructure clients are supported through their own obligations under the Security of Critical Infrastructure Act 2018 (Cth).