Penetration testing Australia, pen test
OWASP scans and authorised exploitation against systems you own, with evidence on every confirmed finding. A tool, not a testing-services firm.
Security testingFor teams in Australia · updated 2026-10-12
What changes when you buy from Australia
Automated testing tools for Australian teams: WCAG 2.1 and 2.2 AA audits for the Disability Discrimination Act and the 2025 AHRC digital guidelines, API and load testing, and security scans with evidence. Transfer terms under the Privacy Act.
The laws a testing buyer in Australia has to satisfy
Checked on 2026-10-12: 2 of 3 read at the statute, regulator or government page; the rest from law-firm or practitioner summaries, marked as such. A law changes; this table carries the date so you can tell when it needs re-checking.
| Law or standard | What it requires of you | Status as checked | Source read |
|---|---|---|---|
| Disability Discrimination Act 1992 | It is unlawful to discriminate on the ground of disability in the provision of goods, services and facilities, which the Commission and the courts have applied to websites and apps. | Compilation No. 39, in force from 14 October 2024. | www.legislation.gov.auprimary source |
| AHRC Guidelines on Equal Access to Digital Goods and Services (2025) | Guidance issued under section 67(1)(k) of the Act on what equal access means in practice, referencing WCAG, AS EN 301 549 and ISO 30071-1. | Issued April 2025, as reported by accessibility practitioners; the Commission’s own pages could not be fetched for this check, so the exact WCAG level the guidelines name is unverified here. | intopia.digitalsecondary source |
| Privacy Act 1988 and the Privacy and Other Legislation Amendment Act 2024 | The Australian Privacy Principles, including APP 8 on cross-border disclosure, under which you stay accountable for an overseas recipient; the 2024 amendments add transparency obligations for automated decisions and a statutory tort, with further tranches pending. | The amendment Act received assent on 10 December 2024; automated-decision transparency starts on 10 December 2026 according to law-firm summaries. | www.legislation.gov.auprimary source |
Where your data goes, and what covers it
Customer data is hosted in Mumbai, India. Under Australian Privacy Principle 8 you remain accountable for the overseas disclosure; the contractual safeguards are agreed with you at contract stage on the Data Processing Addendum, which applies by reference on every plan.
The full table of instruments by regime is section 5 of the Data Processing Addendum; the current state of every certification we do and do not hold is on the trust centre.
The accessibility target for Australia
WCAG at the level your policy names: AS EN 301 549 carries WCAG 2.1 AA, and many public bodies now specify 2.2 AA. The audit runs against WCAG 2.2 A, AA and AAA and reports at the level you select.
Audits map findings to sixty-six country standards and export a conformance report; how the accessibility module works.
The words Australia uses for the need, mapped
The same job has a different name in every market, and sometimes the honest answer is that the name describes a service we are not.
Essential Eight
A maturity model for your organisation’s controls, not a product rating. The scanner’s report on vulnerable components and missing headers is evidence for the patching strategies, nothing more.
What a scan reportsTest automation tools Australia, automated testing
Record once in a real browser, heal with a person in the loop, run only what a change touches.
Test recorderWCAG 2.2 AA audit, website accessibility audit Australia, DDA website compliance
Audits against WCAG 2.2 with a conformance report at the level you select.
Accessibility auditsLoad testing, API testing
Load profiles from a recorded flow; REST, GraphQL, gRPC and SOAP in the API studio.
API testing studioBilling and support hours
Prices are quoted in US dollars on every plan, before any tax your jurisdiction applies to imported software services. Self-serve plans are paid by card; Enterprise agreements are invoiced. If procurement needs a quotation with your tax identifiers, ask through the contact form (topic: billing). GST on imported services purchased by a business is normally handled under the reverse-charge rules; confirm with your finance team.
Sydney and Melbourne are 4.5 hours ahead of Indian Standard Time (5.5 hours in daylight-saving time); Perth is 2.5 hours ahead. An Indian morning is an Australian afternoon. Response targets by plan are on the service levels page.
Plans and caps are on the pricing page; response targets by plan are on the service levels page.
Questions teams in Australia ask
Does the audit satisfy the 2025 AHRC guidelines?
The guidelines reference WCAG and AS EN 301 549; the audit runs against WCAG 2.2 and reports at the level you select, so it produces the evidence those documents ask for. Whether a given service meets its obligations is an assessment you or your advisers make from that evidence.
Will this make us Essential Eight compliant?
No tool does. The Essential Eight is a maturity model for your organisation’s own controls. The security scanner reports vulnerable components and missing security headers on your web applications, which is evidence for the patching strategies, not a maturity rating.
Where is our data?
In Mumbai, India, on a server we operate. Under APP 8 you remain accountable for the overseas disclosure, so the safeguards are written into the addendum we sign with you. Enterprise customers can run the platform on their own infrastructure instead.
Next step
Start on the Free plan, or bring one flow from your own product and we record it live.