Service termsand policies.

These Terms apply to everyone who uses the Services:

• Customers: organisations that buy a plan;
• Authorised Users: people who use the Services under a Customer’s plan; and
• Invited Participants: people invited to share, view, sign or collaborate on content.

Customers must make sure their Authorised Users and Invited Participants comply with these Terms and the policies on this page. Those users have access only while a Customer’s paid plan supports it.

Organisations can buy a plan under these Terms alone or sign a separate agreement with DekkoSecure such as a master services agreement, order form or service level agreement (a “Signed Agreement”). Arrange one at dekkosecure.com/contact.

If documents conflict they apply in this order:

• the Signed Agreement;
• these Terms;
• the Privacy Policy and Acceptable Use Policy; and
• documentation referred to in these Terms.

“Customer Content” means the files, messages, meetings, signatures and other material users upload, create or share in the Services. Customers and their users keep all rights in it.

The Services are zero-knowledge. Customer Content is encrypted on users’ devices before it reaches DekkoSecure. Keys are handled automatically in the background on those devices. Only the people a user shares content with can open it. DekkoSecure cannot read it.

You grant DekkoSecure the limited rights it needs to store, replicate and transmit encrypted Customer Content in order to provide the Services. It uses those rights for nothing else.

What zero-knowledge means for these Terms

Most online services can read the content they host. DekkoSecure cannot. That changes several parts of these Terms:

• Recovery. DekkoSecure cannot restore content a user or administrator deletes.
• Support. DekkoSecure sees content only when a user chooses to share it. That access is logged and limited to the content shared.
• Legal requests. If the law requires disclosure DekkoSecure can provide only what it holds in readable form: account information and metadata.
• Enforcement. DekkoSecure enforces the Acceptable Use Policy through metadata, activity logs and reports of misuse. It never reads Customer Content.
• Responsibility. Customers and their users are responsible for what they upload and share.

Keep your credentials confidential. Do not share your password or let anyone else use your account. Do not use another user’s credentials.

If you believe someone has accessed your account without authorisation tell your organisation’s administrator or DekkoSecure support immediately.

You are responsible for all activity under your account. DekkoSecure is not liable for loss caused by unauthorised access that results from your actions or omissions.

Your use of the Services is subject to the Acceptable Use Policy on this page. It forms part of these Terms.

DekkoSecure may suspend or end access that breaches the Policy or the law or that poses a security or operational risk.

Customers must make sure everyone in their tenancy complies with the Policy.

DekkoSecure may add, change or remove features to improve performance, usability, security or compliance.

During a plan’s term DekkoSecure will not materially reduce the core functions of the plan the Customer bought.

Where practicable DekkoSecure gives notice of material changes through in-app notifications, release notes or email.

The Services run on third-party infrastructure including Microsoft Azure and Oracle Cloud Infrastructure (the “Service Providers”).

DekkoSecure takes reasonable measures to keep the Services secure, reliable and performant. Incidents at Service Providers and other events beyond DekkoSecure’s reasonable control can affect availability. They are not a breach of these Terms.

Uptime commitments and support response times are set out in a service level agreement that forms part of a Signed Agreement. Without one no specific uptime or response time is guaranteed. Request the service level agreement at dekkosecure.com/contact.

Encrypted Customer Content is stored on Microsoft Azure Zone-Redundant Storage. It is replicated across three physically separate availability zones in the same region so content stays available if one zone fails.

DekkoSecure does not keep point-in-time backups of Customer Content. A file removed by a user or administrator is permanently deleted and DekkoSecure cannot recover it. Customers are responsible for keeping their own long-term archives.

DekkoSecure keeps encrypted backups of the components that run the Services: application code, configuration and operational databases.

DekkoSecure collects only the personal information needed to operate, secure and support the Services. It never sells it or uses it for marketing.

Each instance keeps its data in its own country: Australia for DekkoCore-AU, Canada for DekkoCore-CA and the United States for DekkoCore-US and DekkoDEMS.

The Privacy Policy on this page has the detail.

Customers buy a plan for the Services. Each plan runs for the term in its order or Signed Agreement (the “Plan Term”). A Plan Term is at least 12 months unless DekkoSecure agrees otherwise.

Renewal

DekkoSecure provides the Services expecting each plan to be renewed. It will contact the Customer before the Plan Term ends. The Customer must complete its renewal in good time.

If a renewal is still being finalised when a Plan Term ends DekkoSecure may keep the Services running. The renewed Plan Term then starts the day after the previous one ended and fees apply from that date.

When a plan ends

If a plan ends without renewal the Customer’s tenancy becomes read-only. Its Authorised Users can still sign in and download content.

DekkoSecure will email the Customer’s administrator at least 30 days before deleting data. After that it may disable access and permanently delete the tenancy’s data. Deleted content cannot be recovered.

Fees and payment

Fees are invoiced in advance for each Plan Term and exclude GST and similar taxes. Prices are fixed for the Plan Term. DekkoSecure may change prices for a renewed term with at least 30 days’ notice before the current term ends.

Fees are not refundable except as set out under Suspension and termination.

If an invoice is more than 14 days overdue DekkoSecure may suspend access after written notice. Access returns once the overdue amount is paid. If it is still unpaid 30 days after suspension DekkoSecure may end the plan. The tenancy then becomes read-only and its data is deleted as set out above.

Users without their own plan

Authorised Users and Invited Participants use the Services through a Customer’s plan. Invited Participants lose access to a tenancy when its plan ends. Authorised Users keep read-only access until its data is deleted. Any user’s access ends when the Customer removes them.

DekkoSecure may disable or delete any account that no active paid plan supports. That includes accounts created only to receive shared content and accounts from ended trials.

Users can download any content they have access to at any time. Files are decrypted on the user’s device as they download. Administrators of larger tenancies can use DekkoSecure’s bulk export tools.

DekkoSecure cannot read Customer Content so it cannot export it for a Customer. A user with access must download it. DekkoSecure provides documentation and support to help. Hands-on export assistance is available as a paid service.

Administrators can download up to six months of audit log history in the app. Customers using the Azure Log Analytics workspace integration hold their logs in their own systems.

After a plan ends the tenancy stays read-only for at least 30 days so content can be exported.

“Confidential Information” is non-public information one party discloses to the other in connection with the Services. Customer Content is the Customer’s Confidential Information.

Each party must use the other’s Confidential Information only to provide or receive the Services and protect it with at least reasonable care. It may share it only with personnel, advisers and Service Providers who need it and are bound to keep it confidential.

This does not cover information that is public through no fault of the receiving party, that it already knew, that it develops independently or that it lawfully receives from a third party.

A party may disclose Confidential Information where the law requires it. Where the law allows it must notify the other party first and disclose only what is required.

DekkoSecure and its licensors own all intellectual property in the Services including the software, documentation and trade marks. Customer Content stays the Customer’s.

DekkoSecure grants each user a non-exclusive and non-transferable right to use the Services while their account is active and subject to these Terms.

You must not copy, modify, reverse engineer, resell or sublicense the Services except where the law permits.

DekkoSecure may use any feedback you give it without obligation.

DekkoSecure provides the Services with reasonable care and skill.

To the extent the law permits DekkoSecure does not guarantee the Services will be uninterrupted or error-free or fit for a particular purpose. Warranties not set out in these Terms are excluded.

This does not affect rights that cannot lawfully be excluded including the consumer guarantees under the Australian Consumer Law.

DekkoSecure hosts Customer Content without being able to read it. The Customer controls that content and is responsible for it.

The Customer must indemnify DekkoSecure against any claim, loss or cost (including reasonable legal costs) arising from Customer Content or from a breach of the Acceptable Use Policy by the Customer, its Authorised Users or its Invited Participants.

DekkoSecure will tell the Customer promptly about any such claim and where reasonable let the Customer manage the defence. The indemnity is reduced to the extent DekkoSecure caused the loss.

Nothing in these Terms excludes or limits any right that cannot lawfully be excluded including the consumer guarantees under the Australian Consumer Law.

To the extent the law permits DekkoSecure is not liable for indirect or consequential loss or for loss of profits, revenue, data or goodwill however it arises.

To the extent the law permits DekkoSecure’s total liability in connection with the Services is limited to the fees the Customer paid in the 12 months before the event giving rise to the claim or AUD 100 if that is more.

Where liability for a non-excludable guarantee can be limited it is limited to supplying the Services again or paying the cost of having them supplied again.

A Signed Agreement may set different limits.

You may stop using the Services at any time. Stopping early does not end a Customer’s Plan Term or entitle it to a refund.

A Customer may end its plan if DekkoSecure seriously breaches these Terms and does not fix the breach within 30 days of written notice. DekkoSecure will then refund the prepaid fees for the unused part of the Plan Term.

DekkoSecure may suspend or end access if you breach these Terms, if the law requires it or if continued access would cause harm or liability to DekkoSecure, other users or third parties. Where practicable and lawful it will tell the Customer’s administrator first or promptly afterwards.

DekkoSecure may stop providing the Services outside a paid Plan Term as set out under Plans, renewal and payment.

When access ends the right to use the Services ends immediately. Data is then deleted as set out under Plans, renewal and payment and in the Privacy Policy.

Fees owed, Confidentiality, Intellectual property, Indemnity and Limitation of liability continue to apply after termination.

DekkoSecure may update these Terms. The date at the top of this page shows when they last changed. Where practicable DekkoSecure gives notice of material changes through in-app notifications, email or release notes.

Continued use of the Services after notice means you accept the updated Terms.

An update that disadvantages a Customer with a paid plan applies to that Customer from its next renewal. Updates required by law or made for security apply when published.

An update does not change a Signed Agreement unless both parties agree in writing.

DekkoSecure may transfer its rights and obligations under these Terms to a related company or to a buyer or successor of its business in a sale, merger or restructure. It will tell Customers when it does.

A Customer may not transfer its plan to another organisation without DekkoSecure’s written agreement.

DekkoSecure gives notices by email to the administrator address registered in the Customer’s tenancy. Customers must keep that address current.

Customers give notices to DekkoSecure by email to [email protected].

An email notice is treated as received on the next business day unless the sender gets a delivery failure.

These Terms are governed by the laws of New South Wales, Australia. This applies to every instance unless local law requires otherwise. Each party submits to the non-exclusive jurisdiction of the New South Wales courts.

A Signed Agreement may set a different governing law and jurisdiction.

These Terms, the policies on this page and any Signed Agreement form the entire agreement between you and DekkoSecure about the Services. They replace any earlier versions and prior communications.

No term is to be interpreted against a party because that party drafted it.

This Privacy Policy explains how DekkoSecure collects, uses, stores and protects personal information when you use the Services.

DekkoSecure handles personal information in line with the Privacy Act 1988 (Cth) and where they apply GDPR, PIPEDA, HIPAA and equivalent laws.

The Services are zero-knowledge. Your files, messages and other content stay encrypted. Only you and the people you share them with can open them.

DekkoSecure plays two roles depending on the data:

• Data in a Customer’s tenancy. DekkoSecure handles it on the Customer’s behalf and instructions. This covers Customer Content, user accounts, Invited Participants’ details and audit logs.
• DekkoSecure’s own records. DekkoSecure decides how this data is used. This covers billing and sales contacts, support correspondence, security monitoring, records kept to meet legal obligations and accounts no Customer supports.

Requests about data in a tenancy go to the Customer’s organisation. DekkoSecure will help it respond.

DekkoSecure collects only what it needs to operate, secure and support the Services.

Information you provide

• Name and email address when you create an account or accept an invitation.
• Organisation details such as department, tenancy name or domain.
• Support requests and other correspondence.
• Optional profile or configuration details you choose to provide.

Information collected automatically

• Login activity with timestamps and IP addresses for audit and security logging.
• Browser and device information such as the user-agent string and operating system.
• Error reports, performance diagnostics and usage telemetry.
• Records of events such as uploads, downloads and collaboration actions. These never include file contents.

Information we do not collect

• Your decrypted files, messages, videos or documents.
• Biometric, financial or sensitive personal information unless supplied through an authorised customer workflow.
• Tracking cookies, behavioural analytics or advertising identifiers.

We use information only to:

• authenticate accounts and control access;
• maintain, optimise and monitor the Services;
• audit security and detect and respond to threats;
• support and troubleshoot; and
• comply with the law and enforce the Terms of Service and Acceptable Use Policy.

All customer content is end-to-end encrypted. Only authorised users in your organisation and the participants you share with can open it.

A user may choose to share specific content with DekkoSecure personnel, for example to help with troubleshooting. That access covers only the content shared. It is logged, limited in time and bound by confidentiality.

Account information, metadata and encrypted content are held in sovereign cloud environments in the country of each instance:

• DekkoCore-AU (au.dekko.io): Australia
• DekkoCore-CA (ca.dekko.io): Canada
• DekkoCore-US (us.dekko.io): United States
• DekkoDEMS (fusion.dekko.io): United States

Data is replicated within its country for resilience. It never leaves that country unless the Customer authorises it or the law requires it.

DekkoSecure cannot open your encrypted content and never sells personal information. Limited access to system information happens only:

• For support you request. Limited metadata may be accessed to diagnose a problem. Content is accessed only where you share it.
• For legal obligations. Where a law, subpoena or regulatory order requires it and only to the minimum needed. Encrypted content stays encrypted. DekkoSecure can disclose only account information and metadata.
• By Service Providers. The infrastructure and security partners DekkoSecure engages, including Microsoft Azure, Oracle Cloud Infrastructure and email delivery providers. Each is bound by confidentiality and data protection obligations.

All such access is controlled, limited in time, logged and auditable.

Account information is kept while your organisation has an active tenancy. Activity logs are kept for operational and compliance purposes in line with the laws of each country where the Services operate.

When an account or tenancy is deleted its data is securely erased under DekkoSecure’s retention schedule. Encrypted files are permanently deleted when a user or administrator removes them and cannot be recovered.

DekkoSecure may keep limited records for as long as legal, regulatory or audit obligations require. They are minimal, access-controlled and purged when the retention period ends.

The Services use only essential session cookies for authentication and security. They do not use advertising, cross-site or behavioural tracking cookies.

Depending on where you are you may have the right to access, correct, copy or delete your personal information and to restrict or object to certain processing.

If your information is held in an organisation’s tenancy contact that organisation first. It controls that data and DekkoSecure will help it respond. Send other requests to [email protected].

We may verify your identity before acting and may keep limited records where the law requires.

DekkoSecure applies technical and organisational measures consistent with:

• Australian ISM (PROTECTED)
• GO-ITS 25.21 (Ontario)
• CJIS Security Policy
• HIPAA Security Rule
• GDPR (General Data Protection Regulation)

Controls include encryption, network isolation, audit logging, vulnerability management, malware scanning and multi-factor authentication. Access to operational systems is limited to vetted personnel on a least-privilege basis.

The cloud infrastructure DekkoSecure uses holds its own certifications including ISO 27001, SOC 2 and regional government accreditations.

Organisations evaluating the Services can request DekkoSecure’s security documentation including architecture and IRAP documentation and completed security questionnaires at dekkosecure.com/contact.

DekkoSecure is an enterprise service and not intended for anyone under 18. We do not knowingly collect personal information from minors. If we find any we delete it.

DekkoSecure keeps data in the Customer’s selected country. A cross-border transfer happens only with the Customer’s explicit authorisation and under safeguards consistent with GDPR, PIPEDA and other applicable laws.

We may update this Privacy Policy to reflect changes in law, technology or our operations. Updates take effect when published. The date at the top of this page shows when the policy last changed.

We tell you about material changes through in-app notifications or email where appropriate.

By creating an account or using the Services you acknowledge that you have read this Privacy Policy and consent to the handling of information it describes.

This Acceptable Use Policy (“Policy”) sets out the rules for using the Services. It applies to everyone who uses them: Customers, Authorised Users and Invited Participants (“Users”).

Users must:

• use the Services only for lawful and authorised purposes;
• take reasonable steps to protect the confidentiality of information shared through the Services;
• comply with applicable laws, contracts and organisational policies;
• follow DekkoSecure’s documentation and security requirements; and
• report suspected misuse or unauthorised access to their organisation’s administrator or DekkoSecure support immediately.

Users must not use the Services to:

• Break the law, including by storing or sharing unlawful, defamatory, discriminatory or obscene content.
• Undermine security, including by attempting to bypass encryption, authentication or access controls or introducing malware.
• Access anything without authorisation, including other users’ data or the infrastructure that runs the Services.
• Disrupt or degrade the Services, including through denial-of-service attacks, automated scraping or excessive traffic.
• Infringe the intellectual property, privacy or data protection rights of others.
• Spam, phish, harass or use chat, messaging or video to intimidate or deceive anyone.
• Get around controls, including by removing or altering security mechanisms or metadata or working around usage limits.

Users are responsible for making sure content they upload or share meets their privacy, confidentiality and data handling obligations. Sensitive or classified information must only be uploaded to authorised environments and handled by authorised personnel.

The Services are zero-knowledge. DekkoSecure cannot view or modify content. It may restrict or disable an account where the law requires it or to protect the integrity of the Services.

All users including Invited Participants share responsibility for using the Services within reasonable limits. Avoid excessive activity that could affect access for your organisation or others such as repeated large transfers, automated retrievals or high-volume sharing unrelated to legitimate business.

DekkoSecure monitors aggregate usage. If usage looks abnormal or excessive it may notify the Customer’s administrators, restrict certain activity or apply technical controls to prevent service degradation.

Customers remain responsible for their organisation’s overall use of the Services.

DekkoSecure does not inspect encrypted content. It may monitor metadata and activity logs for operational, security and compliance purposes.

DekkoSecure may suspend or end access immediately if it reasonably believes a user’s actions breach this Policy, threaten the security or stability of the Services or put other users at risk. Where practicable and lawful it will tell the Customer’s administrator first or promptly afterwards.

Serious or unlawful activity may be referred to the appropriate authorities.

To report abuse or a suspected breach of this Policy email [email protected].

DekkoSecure may update this Policy to reflect legal, security or operational changes. Where practicable it gives notice through in-app messages or the DekkoSecure knowledge base. Continued use of the Services after an update means you accept it.

By creating an account or using the Services you agree to comply with this Policy and the Terms of Service.