Trust Centre
Security.
How you sign in, how sends are approved, and where our security checks stand.
Sign-in and access
What is in place, and what we are still checking for each client account.
- Sessions are signed. We’re confirming that this works for every client account.
- We’re confirming whether multi-factor sign-in is required for every client and admin account, and which factor it uses.
- Changing your password asks for your current password first. We’re confirming that this is live for every client.
- You can end one session or all of them, and reopen a locked account. We’re confirming that this is live for every client.
- Admin access uses a short-lived capability, which is used once. We’re confirming the named list of admin accounts, and whether admin access is logged.
- We don’t claim remote wipe. A failed remote sign-out keeps a lost phone at the sign-in screen until someone signs in on purpose. We’re confirming what a sign-out does on our servers.
- Command reads one mailbox. We’re confirming, for each client account, that nobody else who can sign in sees it.
- We won’t call our data encrypted until that’s checked. Encryption in transit and at rest is Planned · target 4 Dec 2026
Approvals and sends
What Command does today.
- Approvals wait in one queue. Approving records your yes and sends nothing.
- A Gmail reply goes out only when you confirm it on screen. The server refuses a send without that confirmation, a duplicate is refused, and no more than 30 replies go out a day.
- Drafts are never sent automatically.
- Anything you send from another app is opened in your own mail or Messages, and you send it. Command then asks whether you sent it, and “sent” is your word.
- Records carry a receipt that shows where they came from. That is built, but not live yet.
- We’re confirming which actions leave a receipt for your account: approvals, sent replies, and changes to a client record. We won’t say every action is recorded until that’s confirmed.
Essential Eight
We self-assess against the Australian Signals Directorate’s Essential Eight Maturity Model, and we’ll publish the result. It is a self-assessment, not a certificate.
Planned · target 4 Dec 2026
Maturity level reached: not assessed yet. Our target is Maturity Level One.
| Strategy | Where we are | What we’re checking |
|---|---|---|
| 1. Application control | Not yet checked | Which applications run on the systems we manage, including the VM and staff devices. |
| 2. Patch applications | Not yet checked | Patch cadence for the app stack and the browser. |
| 3. Configure Microsoft Office macro settings | Not yet checked | Whether Office runs with macros allowed on any Camber & Casper or client device. |
| 4. User application hardening | Not yet checked | Browser and staff device settings. |
| 5. Restrict administrative privileges | Partly checked | Admin entry uses a short-lived capability, used once. We’re confirming the named list of admin accounts and a review date. |
| 6. Patch operating systems | Not yet checked | The VM’s operating system and its patch cycle. |
| 7. Multi-factor authentication | Partly checked | The authentication code checks for MFA. We’re confirming that it’s required for every client and admin sign-in. |
| 8. Regular backups | Partly checked | A pre-migration backup passed a quick check. We’re confirming scheduled backups, where they’re held, and a full restore test. |
SMB1001
Planned · target 4 Dec 2026
SMB1001 is a cyber security standard for small businesses. It is issued by a third party, in tiers. We’ll use its name only once a certificate is issued, at the tier we earn.
Google CASA security assessment
Planned · target 29 Jan 2027
Google requires an annual independent security assessment, called CASA, for apps that read Gmail at scale. Reading Gmail for clients other than the first account waits on it. Until the letter is issued, we don’t say Google has approved us. When it is issued, we’ll say what it covers and give its date.
Last reviewed 15 October 2026.