Privacy Policy

Effective 28 July 2026. This policy covers Gorgon Training, the training platform at training.gorgoncyber.com and its supporting services, operated by Gorgon Cyber Pty. Ltd. Gorgon Defender, Gorgon Scout, and Gorgon Form Filler have their own policies.

Summary

Gorgon Training holds personal information about two kinds of people: the administrators who run training for an organisation, and the employees they enrol. Nearly all of it is supplied by the employer. It is stored in Australia, it is never sold, and it is never used to train anybody's artificial intelligence models. This policy sets out exactly what is held, why, and who else touches it.

Who Is Responsible for What

An organisation that buys Gorgon Training decides who is enrolled and what training they are assigned. For the personal information of its employees, that organisation is the controller and we are its processor: we hold and process that information on its instructions, to deliver the training it has asked us to deliver. Employees who want their information corrected or removed should raise it with their employer first, though they are welcome to contact us directly and we will help.

For administrator accounts and for billing, we are the controller.

Information We Hold About Trainees

• Name, work email address, and the role description their employer supplied when enrolling them.
• Which classes and courses they were assigned, and why the platform proposed them.
• Progress through each lesson, recorded as the intervals of a video actually watched rather than a furthest position, because a completion record is only worth anything if it reflects what was genuinely done.
• Quiz attempts, the answers given, scores, and pass or fail outcomes.
• Certificates issued on completion, including the date and whether it was completed by the due date.
• Sign-in records for the account, held by Firebase Authentication.
• If their employer marks them as having left, that status and the date.

Information We Hold About Administrators

• Name, work email address, and the role granted to them in the console.
• An audit record of the administrative actions they take, including enrolling and removing people, changing settings, resetting a quiz, and overriding what the platform proposed. This log is deliberately append-only: on a compliance platform, who did what has to be answerable later.
• Billing contact details, the subscription status, seat counts, and a Stripe customer identifier.

Information We Hold About the Organisation

The organisation's name, website address, and the settings that tailor training content to it: the systems and tools it uses, the regulators and privacy law that apply to it, and similar business facts an administrator answers in the console. A profile of the organisation is also built from its public website, so training can refer to the business as it actually operates rather than in the abstract.

What We Do Not Hold

• Payment card details. Card data goes directly to Stripe and never passes through our servers.
• Passwords. Sign-in is by email link or an identity provider, and no password is ever set with us.
• Any special category of personal information about a trainee. Health, biometric, and similar data has no place in this product, and a role description should never contain it.
• Anything a trainee does outside the training platform. There is no monitoring of their device, their browsing, or their work.

How the Information Is Used

• To match a person to the training their role and their employer's business actually call for.
• To deliver that training, grade the quizzes, and issue certificates.
• To report progress and completion to the administrators at their employer, which is the point of the product.
• To send training reminders, overdue notices, and account emails.
• To run billing and support.
• To improve the platform in aggregate, including whether an administrator overrode what the platform proposed. Nothing that identifies an individual trainee is used this way.

We do not sell personal information. We do not use it for advertising. We do not use it to train artificial intelligence models, and our AI subprocessor is contractually bound not to train on it either.

Artificial Intelligence

Deciding which training a person needs is done with a large language model provided by Anthropic. Three things are sent to it: the employer's website address, so a profile of the business can be built; the role description the administrator wrote; and our own catalogue of classes. Trainee names and email addresses are never sent. A role description is written by an administrator, so it should describe the job rather than the person.

The model chooses from our published catalogue and cannot invent training. Its reasoning is recorded against the request so a questionable match can be reconstructed and challenged months later, and an administrator can override it.

Certificate Verification

Each certificate carries a verification code. Anyone who holds that code can look it up at our public verification address and see the trainee's name, the class completed, the organisation, the completion date, and whether it was completed on time. That is the purpose of a verification code, but it does mean a certificate code should be treated as shareable information about the person it names. Nothing else about the trainee is exposed, and codes cannot be guessed or enumerated.

Where the Information Is Stored

Personal information is stored in Google Cloud's Sydney region (australia-southeast1): the database, the training media, and the servers that hold and serve them. The console web application is served from Google Cloud's Singapore region for a technical reason (custom domains cannot be attached to Cloud Run services in the Australian region), but it holds no personal information: your browser talks to our Australian servers directly. Email is sent through Amazon Web Services in Sydney.

Subprocessors

• Google LLC (Google Cloud Platform and Firebase) - hosting, the database, training media storage, and authentication. Australia, except the console application as described above.
• Anthropic PBC - the language model that matches a role to training, and that reads the employer's public website to build a business profile. Receives no trainee names or email addresses.
• Amazon Web Services, Inc. - sends invitation, reminder, and notification email. Sydney.
• Stripe, Inc. - subscription billing and payment. Stripe's own policy governs card data.

How Long It Is Kept

Training records are compliance evidence, so they are kept for as long as the organisation's account is open. Marking somebody as departed deliberately keeps their completed training and certificates: the record that a person was trained does not stop being true when they leave, and an employer that needs to prove it was done should still be able to.

An administrator can delete a person outright, which removes their enrolments, progress, quiz results, and certificates. That is for somebody added by mistake, and it cannot be undone. When an organisation closes its account we delete its data on request. Stripe keeps billing records separately, as tax law requires.

Your Rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Write to support@gorgoncyber.com. If you are an employee enrolled by your employer, we will normally direct the request to them, because the records are theirs, and we will tell you that we have done so.

Australian users may complain to the Office of the Australian Information Commissioner if they are unsatisfied with how we have handled a privacy matter.

Security

Everything is transmitted over TLS and stored in encrypted Google Cloud services. No browser or application ever holds database credentials: every read and write goes through our own servers, which check on each request that the caller is entitled to that specific organisation's data. Training videos are served through short-lived signed links rather than from a public bucket. Quiz answers are never sent to the browser, so a trainee cannot read the answer key out of the page.

Website Analytics

The gorgoncyber.com marketing site, including this page, uses our own first-party analytics to identify the companies that visit, not the individuals. It records the visiting network address and pages viewed, and resolves the network address to an organisation where it can. The training platform itself carries no analytics or advertising trackers.

Changes to This Policy

We may update this policy as the platform develops. Material changes will be notified to account administrators before they take effect.

Contact

Questions about this policy, or about the information we hold, can be directed to support@gorgoncyber.com. Gorgon Cyber Pty. Ltd. is based in Melbourne, Australia.