Legal
Terms & Legal
Last updated: 6 October 2026
About this website · Free external check · Snapshot · Assessments and other work · Credits · Payments, refunds and cancellations · Your reports · Your portal · Email · Your data · Confidentiality · Liability · This website · Intellectual property · Governing law · Contact
About this website
This website provides general information about RG Labs and the services we offer. It is informational only and does not constitute professional, security, legal, or financial advice. A client relationship begins when you buy a Snapshot or sign an agreement with us, not by reading this site.
Free external check
The free external check reads information about a domain that is already publicly available: DNS records, published mail authentication records, TLS and web server configuration, certificate transparency logs, and internet-exposed service information. It does not attempt to authenticate to any system, does not attempt to exploit any weakness, and does not access anything a member of the public could not.
You must be authorised to request a check of any domain you submit. By submitting a domain you warrant that you own it, operate it, or have the permission of the person who does. We record that confirmation with the time of submission, the originating IP address and the browser user agent.
Submitting a domain you are not authorised to submit is a breach of these terms. We may refuse or withdraw service, and you indemnify us against any claim arising from a check you requested without authorisation.
Free checks are limited to three per domain and three per email address in a rolling quarter. We may apply further limits to prevent misuse.
Results are a point-in-time indication based on publicly visible information. They are not a comprehensive security assessment, and a good result does not mean you are secure.
Snapshot
A Snapshot is a credentialed, read-only scan of one cloud platform — Microsoft 365, Azure, AWS or Google Cloud — run by an engineer, with the evidence and the vendor's fix for each finding. Each platform is a separate Snapshot.
- Access. You grant read-only access as an application registration that you create, can inspect, and can revoke yourself at any time. By granting it you confirm you are authorised to do so for that tenant or account.
- Delivery. Your results are delivered in your portal within 3 business days of your read-only access being in place. Once they are delivered you can revoke the access; we recommend you do.
- What it doesn't include. A maturity rating or framework grade, engineer attestation of controls a scanner can't see, a readout session, or a prioritised roadmap. Those are part of a Security Controls Assessment.
Assessments and other work
A Security Controls Assessment (including an Essential Eight assessment), an AI Security Review, engineering and advisory work are each delivered under a written agreement and statement of work that set out scope, deliverables, fees and responsibilities. Where those documents conflict with this website, those documents apply.
Credits
What you pay for one step can count towards the next:
- Snapshot. What you paid for it, in full, comes off a Security Controls Assessment that you pay for within 90 days of paying for the Snapshot.
- Security Controls Assessment. Half of what you paid for it, after any Snapshot credit, capped at $5,000, comes off engineering work that you pay for within 90 days of paying for the assessment. For example, a $9,500 assessment with a $1,000 Snapshot credit is $8,500 paid, which credits $4,250.
Credits are worked out on amounts excluding GST. Each credit applies once, to the next step only: a Snapshot credit can't be used on engineering, and credits don't stack. A credit isn't cash, can't be transferred to another organisation, has no refund value, and lapses at the end of its 90 days. If the payment that earned a credit is refunded, the credit goes with it. Your portal shows any credit you hold and the date it lapses.
Payments, refunds and cancellations
RG Labs is registered for GST. Prices displayed are exclusive of GST. GST of 10% is calculated and added at checkout, and the inclusive total is shown before you confirm payment. Fees are charged in Australian dollars and processed by our payment provider, Stripe. We email you a tax invoice showing our ABN for every payment.
- Snapshots and assessment reports are prepared specifically for you. Once a report has been delivered, the fee is non-refundable. If you have paid but the report has not yet been delivered, email us and we'll refund it in full. If a delivered report contains an error, we'll correct it promptly.
- Annual Re-assessment is billed annually in advance. You can cancel at any time from your portal (Account → Profile) or by emailing us, and we'll confirm by email within one business day. Cancelling stops the next renewal; quarterly re-assessments continue to the end of the year you've paid for. We don't provide pro-rata refunds for part of a year except where required by law.
- Failed payments. If a renewal payment fails, we'll let you know and our payment provider will retry it. If it stays unpaid, the Annual Re-assessment stops and no further quarterly re-assessments are scheduled. Reports already delivered stay available in your portal for the retention period in our Privacy Policy, whether or not you renew.
Nothing in these terms limits any rights you have under the Australian Consumer Law, including the guarantees that services be provided with due care and skill and be fit for their stated purpose.
Your reports
A report we deliver to you is yours to use for your organisation's own purposes. You can share it with your board, auditors, insurers, customers, regulators and advisers. Please share it whole or quote it accurately, and don't present it as a certification or as current after its date: each report states what could be observed on the date it was produced. The methods, tooling and templates behind it remain ours (see Intellectual property).
Your portal
Your portal is where your results, reports, credits and settings live. Everyone on your account signs in with a one-time code sent to their own email address, so keeping those mailboxes secure is part of keeping your portal secure. Ask us to add or remove someone; a removal takes effect at once. We may suspend a sign-in to protect you or the platform.
We email you about things you've asked for: your result summary, your reports, invoices, renewals and your account. The only marketing email we send is a monthly check-in, and only if you ask for it — by ticking the separate, unticked box on the free check, or in your portal under Account → Data and privacy. Every check-in has a one-click unsubscribe that needs no login. See section 11 of our Privacy Policy.
Your data
How we collect, store, use and delete your information is set out in our Privacy Policy, which forms part of these terms.
In short: assessment data is held in Cloudflare's Oceania region, your cloud credentials never reach our platform, and we delete your assessment data 12 months after delivery (or 12 months after an Annual Re-assessment ends) unless you choose to keep it longer. You can request deletion at any time from your portal, with no reason required.
Confidentiality
What we see in your environment, and every finding about it, is your confidential information. We use it only to deliver what you've asked for. We don't disclose it to anyone without your written consent, except to the service providers that run our platform (listed in our Privacy Policy) or where the law requires it, and where the law lets us, we tell you first.
In return, please keep confidential anything of ours that isn't public and that we share with you about how we work, such as our tooling, scoring and templates. This doesn't limit your right to share your own reports (see Your reports).
Neither of us has to keep confidential information that is public through no fault of our own, that we already lawfully held, or that we received lawfully from someone else. These obligations continue after you stop using our services, and for findings, credentials and personal information they have no end date.
Liability
Nothing in these terms excludes, restricts or modifies any guarantee, right or remedy you have under the Australian Consumer Law that can't lawfully be excluded.
- What a scan can tell you. The free check, a Snapshot and a re-assessment each report what could be observed, with the access you gave, on the day they ran. None of them can find every weakness or guarantee that you won't have a security incident. What you do about the findings is your decision.
- Consumer guarantees. Our services aren't of a kind ordinarily bought for personal, domestic or household use. Where the Australian Consumer Law allows it, our liability for a failure to meet a consumer guarantee is limited, at our option, to supplying the service again or paying the cost of having it supplied again.
- Indirect loss. Neither of us is liable to the other for indirect or consequential loss, or for lost profit, revenue, savings, goodwill or data, however it arises.
- Limit. Each party's total liability to the other in connection with a Snapshot or an Annual Re-assessment, however it arises (including negligence), is limited to the fees paid for it in the 12 months before the event that caused the claim. The free check costs nothing, and to the extent the law allows, we provide it as is and accept no liability for it.
- What the limit doesn't cover. Fraud, wilful misconduct, or deliberate disclosure of the other's confidential information; death or personal injury; your obligation to pay fees; and your indemnity for a check or access you weren't authorised to request or grant.
This website
We aim to keep the information on this site accurate and current, but we make no warranty that it is complete, error-free, or up to date, and we accept no liability for any reliance placed on it. The site is provided "as is". This paragraph is about the website's general information, not about work you pay for, which carries the guarantees above.
Intellectual property
The RG Labs name, logo, content, and design on this site are our property and may not be reproduced without permission. Frameworks, templates, tooling and methodologies we develop remain ours unless a signed agreement says otherwise. Your rights to use the reports we deliver to you are set out under Your reports.
External links
This site may link to third-party websites. We don't control those sites and aren't responsible for their content or practices.
Governing law
These terms are governed by the laws of Victoria, Australia, and you submit to the non-exclusive jurisdiction of its courts.
Contact
Questions about these terms? Email hello@rglabs.com.au.