Security at Kicking Pixels, Gatheroo & MWA
At the Kicking Pixels Group (including Kicking Pixels, Gatheroo and MyWebAdvantage), safeguarding the security, reliability, privacy, and compliance of your data is our utmost priority. While we are at the beginning of our journey towards Cyber Security and ISO compliance, rest assured that we are committed to continuously enhancing our practices to meet the highest standards of data protection.
We are dedicated to implementing measures that prioritise the safety and privacy of your information. We already implement robust encryption protocols to secure your data both at rest and in transit. Additionally, we utilise trusted sub-processors such as AWS and Bitbucket, enhancing our internal processes to bolster security and reliability, to further ensure the safety and integrity of your information.
Our commitment to your security extends beyond mere compliance; it’s embedded in every facet of our operations. As we navigate this journey, we invite you to explore our Trust Center for updates, insights, and supporting documentation on our ongoing efforts to uphold the integrity of your data.
Controls
Subprocessors
Amazon Web Services
Bitbucket
Office365
FAQs
Yes. Our development team follows secure coding guidelines and conducts peer reviews, automated scanning, and QA testing.
While our primary market is Australia, we align with GDPR principles and support data subject rights where applicable.
Yes. We can provide a signed DPA on request or as part of vendor onboarding for compliance purposes.
Yes. A copy of our ISO 27001 certificate is available upon request and included in procurement documentation where required.
Data and Privacy
The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
Changes to information processing facilities and information systems shall be subject to change management procedures.
Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.
The organisation shall determine the boundaries and applicability of the information security management system to establish its scope. When determining this scope, the organisation shall consider:
- the external and internal issues referred to in 4.1;
- the requirements referred to in 4.2;
- interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.
The scope shall be available as documented information.
ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organisation’s information security requirements.
Procedures and measures shall be implemented to securely manage software installation on operational systems.
The organisation shall implement appropriate procedures to protect intellectual property rights.
The organisation shall conduct internal audits at planned intervals to provide information on whether the information security management system:
- conforms to the organisation’s own requirements for its information security management system; the requirements of this document;
- is effectively implemented and maintained.
The organisation shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.
When establishing the internal audit programme(s), the organisation shall consider the importance of the processes concerned and the results of previous audits.
The organisation shall:
- define the audit criteria and scope for each audit;
- select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
- ensure that the results of the audits are reported to relevant management;
Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.
An inventory of information and other associated assets, including owners, shall be developed and maintained.
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date.
When a Nonconformity occurs, the organisation shall:
- React to the nonconformity, and as applicable:
- take action to control and correct it;
- deal with the consequences
- evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by;
- reviewing the nonconformity;
- determining the causes of the nonconformity;
- and determining if similar nonconformities exist, or could potentially occur
- implement any action needed;
- review the effectiveness of any corrective action taken; and
- make changes to the information security management system, if necessary.
- Corrective actions shall be appropriate to the effects of the nonconformities encountered.
- Documented information shall be available as evidence of:
- the nature of the nonconformities and any subsequent actions taken,
- the results of any corrective action.
When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
Personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
Off-site assets shall be protected.
Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organisation’s classification scheme and handling requirements.
Infrastructure Security
The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
Changes to information processing facilities and information systems shall be subject to change management procedures.
Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.
The organisation shall determine the boundaries and applicability of the information security management system to establish its scope. When determining this scope, the organisation shall consider:
- the external and internal issues referred to in 4.1;
- the requirements referred to in 4.2;
- interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.
The scope shall be available as documented information.
ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organisation’s information security requirements.
Procedures and measures shall be implemented to securely manage software installation on operational systems.
The organisation shall implement appropriate procedures to protect intellectual property rights.
The organisation shall conduct internal audits at planned intervals to provide information on whether the information security management system:
- conforms to the organisation’s own requirements for its information security management system; the requirements of this document;
- is effectively implemented and maintained.
The organisation shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.
When establishing the internal audit programme(s), the organisation shall consider the importance of the processes concerned and the results of previous audits.
The organisation shall:
- define the audit criteria and scope for each audit;
- select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
- ensure that the results of the audits are reported to relevant management;
Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.
An inventory of information and other associated assets, including owners, shall be developed and maintained.
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date.
When a Nonconformity occurs, the organisation shall:
- React to the nonconformity, and as applicable:
- take action to control and correct it;
- deal with the consequences
- evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by;
- reviewing the nonconformity;
- determining the causes of the nonconformity;
- and determining if similar nonconformities exist, or could potentially occur
- implement any action needed;
- review the effectiveness of any corrective action taken; and
- make changes to the information security management system, if necessary.
- Corrective actions shall be appropriate to the effects of the nonconformities encountered.
- Documented information shall be available as evidence of:
- the nature of the nonconformities and any subsequent actions taken,
- the results of any corrective action.
When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
Personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
Off-site assets shall be protected.
Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organisation’s classification scheme and handling requirements.
Internal Security Procedures
The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
Changes to information processing facilities and information systems shall be subject to change management procedures.
Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.
The organisation shall determine the boundaries and applicability of the information security management system to establish its scope. When determining this scope, the organisation shall consider:
- the external and internal issues referred to in 4.1;
- the requirements referred to in 4.2;
- interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.
The scope shall be available as documented information.
ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organisation’s information security requirements.
Procedures and measures shall be implemented to securely manage software installation on operational systems.
The organisation shall implement appropriate procedures to protect intellectual property rights.
The organisation shall conduct internal audits at planned intervals to provide information on whether the information security management system:
- conforms to the organisation’s own requirements for its information security management system; the requirements of this document;
- is effectively implemented and maintained.
The organisation shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.
When establishing the internal audit programme(s), the organisation shall consider the importance of the processes concerned and the results of previous audits.
The organisation shall:
- define the audit criteria and scope for each audit;
- select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
- ensure that the results of the audits are reported to relevant management;
Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.
An inventory of information and other associated assets, including owners, shall be developed and maintained.
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date.
When a Nonconformity occurs, the organisation shall:
- React to the nonconformity, and as applicable:
- take action to control and correct it;
- deal with the consequences
- evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by;
- reviewing the nonconformity;
- determining the causes of the nonconformity;
- and determining if similar nonconformities exist, or could potentially occur
- implement any action needed;
- review the effectiveness of any corrective action taken; and
- make changes to the information security management system, if necessary.
- Corrective actions shall be appropriate to the effects of the nonconformities encountered.
- Documented information shall be available as evidence of:
- the nature of the nonconformities and any subsequent actions taken,
- the results of any corrective action.
When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
Personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
Off-site assets shall be protected.
Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organisation’s classification scheme and handling requirements.
Organisational Security
The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
Changes to information processing facilities and information systems shall be subject to change management procedures.
Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.
The organisation shall determine the boundaries and applicability of the information security management system to establish its scope. When determining this scope, the organisation shall consider:
- the external and internal issues referred to in 4.1;
- the requirements referred to in 4.2;
- interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.
The scope shall be available as documented information.
ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organisation’s information security requirements.
Procedures and measures shall be implemented to securely manage software installation on operational systems.
The organisation shall implement appropriate procedures to protect intellectual property rights.
The organisation shall conduct internal audits at planned intervals to provide information on whether the information security management system:
- conforms to the organisation’s own requirements for its information security management system; the requirements of this document;
- is effectively implemented and maintained.
The organisation shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.
When establishing the internal audit programme(s), the organisation shall consider the importance of the processes concerned and the results of previous audits.
The organisation shall:
- define the audit criteria and scope for each audit;
- select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
- ensure that the results of the audits are reported to relevant management;
Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.
An inventory of information and other associated assets, including owners, shall be developed and maintained.
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date.
When a Nonconformity occurs, the organisation shall:
- React to the nonconformity, and as applicable:
- take action to control and correct it;
- deal with the consequences
- evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by;
- reviewing the nonconformity;
- determining the causes of the nonconformity;
- and determining if similar nonconformities exist, or could potentially occur
- implement any action needed;
- review the effectiveness of any corrective action taken; and
- make changes to the information security management system, if necessary.
- Corrective actions shall be appropriate to the effects of the nonconformities encountered.
- Documented information shall be available as evidence of:
- the nature of the nonconformities and any subsequent actions taken,
- the results of any corrective action.
When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
Personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
Off-site assets shall be protected.
Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organisation’s classification scheme and handling requirements.
Product Security
The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
Changes to information processing facilities and information systems shall be subject to change management procedures.
Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.
The organisation shall determine the boundaries and applicability of the information security management system to establish its scope. When determining this scope, the organisation shall consider:
- the external and internal issues referred to in 4.1;
- the requirements referred to in 4.2;
- interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.
The scope shall be available as documented information.
ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organisation’s information security requirements.
Procedures and measures shall be implemented to securely manage software installation on operational systems.
The organisation shall implement appropriate procedures to protect intellectual property rights.
The organisation shall conduct internal audits at planned intervals to provide information on whether the information security management system:
- conforms to the organisation’s own requirements for its information security management system; the requirements of this document;
- is effectively implemented and maintained.
The organisation shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.
When establishing the internal audit programme(s), the organisation shall consider the importance of the processes concerned and the results of previous audits.
The organisation shall:
- define the audit criteria and scope for each audit;
- select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
- ensure that the results of the audits are reported to relevant management;
Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.
An inventory of information and other associated assets, including owners, shall be developed and maintained.
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date.
When a Nonconformity occurs, the organisation shall:
- React to the nonconformity, and as applicable:
- take action to control and correct it;
- deal with the consequences
- evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by;
- reviewing the nonconformity;
- determining the causes of the nonconformity;
- and determining if similar nonconformities exist, or could potentially occur
- implement any action needed;
- review the effectiveness of any corrective action taken; and
- make changes to the information security management system, if necessary.
- Corrective actions shall be appropriate to the effects of the nonconformities encountered.
- Documented information shall be available as evidence of:
- the nature of the nonconformities and any subsequent actions taken,
- the results of any corrective action.
When the organisation determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
Personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
Off-site assets shall be protected.
Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organisation’s classification scheme and handling requirements.
Amazon Web Services
Bitbucket
Office365
Stripe
WPEngine
Client Control and Support
You can report issues via our Gatheroo contact form, support email, or directly through the Trust Center issue submission form.
Yes. We're always open to client feedback and feature requests. Submit yours through support or your account contact.
Yes. We offer onboarding calls, documentation, and ongoing support tailored to your team's needs.
Our platforms allow full control over the information you request, including custom fields, templates, and permissions.
Absolutely. We support procurement and compliance teams with documentation, calls, and pre-filled questionnaires where needed.
Compliance and Legal
Yes. We adhere to the APPs, which govern the handling of personal information under Australian law.
While our primary market is Australia, we align with GDPR principles and support data subject rights where applicable.
Yes. We can provide a signed DPA on request or as part of vendor onboarding for compliance purposes.
Yes. A copy of our ISO 27001 certificate is available upon request and included in procurement documentation where required.
Relevant portions of our SoA can be shared under NDA for security assessments or vendor due diligence.
We only respond to lawful requests backed by appropriate documentation and notify customers where legally permitted.
Data Protection and Privacy
All data is hosted on AWS infrastructure in Australia. This ensures compliance with Australian data sovereignty laws and high availability. All websites built and hosted reside of managed WPEngine hosting, based in Australia.
Within Gatheroo we only access client documents when necessary for support, and only with written permission. Users retain ownership of data at all times.
Yes. All Gatheroo data is encrypted at rest and in transit using industry-standard encryption protocols such as TLS 1.2+ and AES-256.
Data is retained for the duration of your service agreement, or as required by law. Upon termination, data is deleted according to our retention schedule.
Yes. You can export Gatheroo Request data at any time. Data deletion requests are also supported and processed securely.
Your data is securely deleted after a 30-day grace period unless otherwise agreed. You may request immediate deletion if preferred.
Currently, all hosting is in Australia. For enterprise clients with specific data residency requirements, custom arrangements may be available.
Platform Operations
We deploy regular updates for improvements, bug fixes, and security patches. Critical vulnerabilities are addressed immediately.
We monitor uptime 24/7 and follow a disaster recovery plan in case of outages. Key services are hosted with redundancy across regions.
Automated backups are performed daily and stored securely in geographically redundant locations. Regular restore testing is part of our process.
Yes. Our development team follows secure coding guidelines and conducts peer reviews, automated scanning, and QA testing.
Yes. Gatheroo supports Zapier and other workflow tools. Additional custom integrations are available on request.
We have redundancy plans and monitoring in place. Affected users are notified promptly, and failovers are used where possible.
Security and Access
ISO 27001 is the international standard for information security management systems (ISMS). It outlines best practices and controls for maintaining the confidentiality, integrity, and availability of data. Being certified means we have undergone rigorous third-party audits to prove we follow security best practices.
Yes. Gatheroo, MyWebAdvantage, and Kicking Pixels operate under a certified ISMS that complies with ISO 27001:2022 standards. This ensures consistent and comprehensive security across all services.
Yes. MFA is enforced for all internal systems and sensitive client environments to protect accounts from unauthorised access.
We follow the principle of least privilege. Access is granted based on role and reviewed regularly. All activity is logged and monitored.
Our security policies are reviewed annually or whenever there is a significant change in systems or regulatory requirements.
Yes. We use automated monitoring tools and alerts to detect threats. Logs are regularly reviewed, and suspicious activity is escalated immediately.
Remote access is secured using VPNs, MFA, device encryption, and endpoint protection tools, ensuring that all connections are secure.
We have a documented incident response plan. All incidents are assessed, contained, and communicated based on severity, with post-mortems to prevent recurrence.