Security and compliance
information.
SMB1001:2026 Gold, issued by CyberCert.
Black Shard Pty Ltd holds SMB1001:2026 Gold (Level 3), issued by CyberCert. The certificate can be verified through CyberCert’s public registry.
- Standard
- SMB1001:2026 Gold (Level 3)
- Held by
- Black Shard Pty Ltd · ABN 66 696 910 773
- Issued by
- CyberCert
- Active
- 16 June 2026 to 17 June 2027
- Basis
- Formal director attestation against the standard’s 27 controls
The team also holds an Exemplar Global Certified Lead Auditor credential for ISO/IEC 27001:2022 (certificate C-560291, valid to 25 August 2027). This is an individually held professional credential.
If the standard is unfamiliar, start with our SMB1001 reference page.
Frameworks we work against.
Our engineering and security work uses the ASD Essential Eight, ASD Information Security Manual, CIS Controls and Australian Privacy Principles, plus other frameworks where relevant to the engagement. Where Black Shard self-assesses against a framework rather than holding an independent certification, we identify it as a self-assessment.
ASD Essential Eight
Self-assessed · Maturity Level 2
The Australian Signals Directorate’s eight mitigation strategies, the baseline Australian government supply chains ask for. Black Shard self-assesses its own environment at Maturity Level 2 against ASD’s published maturity model, with the uplift completed in August 2026 and the evidence on file. This is a self-assessment.
Privacy Act 1988 · Australian Privacy Principles
Self-assessed
The Australian Privacy Principles apply to Black Shard as an Australian organisation handling personal information. Collection limits, purpose, access and correction, and notifiable breach handling are built into the systems we operate.
ASD Information Security Manual (ISM)
Self-assessed
The Australian Government framework for systems that handle official information. Where an engagement carries government obligations, controls are designed and operated against the ISM.
CIS Controls v8
Self-assessed
The Center for Internet Security vendor-neutral critical security controls, used as a cross-check on the Australian frameworks in our engineering and operations.
Hosting platform.
Production workloads run on Microsoft Azure in Australian regions, primarily Australia East. Azure’s infrastructure is IRAP-assessed to PROTECTED and holds ISO 27001 and SOC 2 at the platform level. Those assessments belong to Microsoft as the platform provider.
Microsoft’s IRAP assessment ↗The programs we belong to.
Xero Developer Partner Program
Development partner
We build Xero integrations for regulated businesses: trust account reconciliation, bank feeds and finance automation.
Twilio Partner Connection
Consulting partner
We build messaging, voice and verification into the platforms we deliver.
Apple Developer Program
Organisation
We publish the iOS apps we build on the App Store under the Black Shard organisation account.
Operational security.
- Access to client environments.
- Access to client environments is limited to what an engagement requires.
- Administrative privilege.
- Administrative access to the firm’s own infrastructure runs over a private network with key-based SSH authentication. The control plane sits behind an identity-aware access layer restricted to the firm’s own domain. Credentials are held in a secrets vault with owners and rotation recorded.
- Encryption.
- Data is encrypted in transit and at rest.
- Backups.
- Production data is backed up on schedule, including database dumps and repository bundles, and backup health is checked by the firm’s own monitoring every 15 minutes.
- Australian hosting and audit trails.
- Client data is hosted in Australian Azure regions where applicable. The systems we operate for clients carry their own audit records: the GRM LAW portal keeps an append-only audit ledger enforced on every state change, and the Stone Leaf Capital portal keeps a compliance audit log sealed monthly into hash-manifested archives.
- Release controls.
- Source is held in private repositories. Continuous-integration checks run on each change to the platforms that carry them.
- Edge and public site.
- Hosted systems sit behind a web application firewall and CDN, with origins locked to the edge provider’s addresses. Cookie use on the public site is limited to Google Analytics and, with visitor consent, Google Ads measurement.
- Third parties.
- Third parties are kept to the minimum required to deliver the service, weighted toward providers that hold their own independent assessments. Australian regions are used for services that host client data.
Black Shard maintains professional indemnity, public liability and cyber insurance. Certificates of currency are available on request.
Platforms we use.
The systems we build and operate run on these platforms and services in production. We also build and operate on AWS, Google Cloud and client-run infrastructure when the engagement calls for it.
Platforms we use
Coordinated disclosure.
If you believe you have found a vulnerability in a Black Shard system, email info@blackshard.com.au with enough detail to reproduce it. We acknowledge reports within 48 hours, we do not take legal action against good-faith research, and we credit reporters who want it. Our security.txt is published per RFC 9116.
Incident response.
Security incidents follow a defined path for identification, containment and communication. Black Shard complies with the Privacy Act 1988 Notifiable Data Breaches scheme, notifying affected parties and the OAIC when required.
Procurement and due diligence.
Security questionnaires are answered in writing on request.