# Information Security & Data Protection Training Programme

**SyncMate — WYHEN Pty Ltd (ABN 57 688 078 999)**
Version 1.0 · Effective 31 August 2026 · Owner: Founder/Technical Operator · Review: annually

## 1. Purpose and scope

This programme ensures every person with access to SyncMate systems or customer data understands their security and privacy obligations. It applies to **all personnel** — the Founder, any employee, contractor, or third party granted access — without exception. Completion is a precondition of access.

## 2. Training components

### 2.1 Induction module — before any access is granted
Mandatory. Estimated 90 minutes. Covers:
- The nature of the data we hold: accounting firms' clients' financial documents and transactions, and why it is sensitive.
- Our role as Data Processor and the customer's role as Controller.
- Australian Privacy Principles and the Notifiable Data Breaches scheme.
- Client confidentiality: the rule that customer data is accessed only when required to resolve a specific support ticket, and never browsed.
- Credential hygiene: Xero-based authentication with mandatory two-step verification; password manager use; no credential sharing; no credentials in code, chat or email.
- Phishing and social engineering, including pretexting as a customer.
- Incident reporting: what to report, to whom, and the 24-hour customer-notification obligation.
- Acceptable use of devices: full-disk encryption, screen lock, current OS patches, no customer data on personal or removable storage.

### 2.2 Annual refresher — every 12 months
Mandatory. Estimated 60 minutes. Re-covers the induction content, updated with the past year's incidents, near-misses, threat landscape changes, and any changes to our policies, subprocessors or architecture.

### 2.3 Quarterly awareness update — every 3 months
Estimated 15–30 minutes. A short written brief on current threats relevant to us: active phishing campaigns targeting accounting and Xero users, credential-stuffing trends, supply-chain and dependency compromises, and any ACSC or OAIC advisory of relevance. Delivered from the threat intelligence process (A7).

### 2.4 Secure development module — before writing or reviewing code
Mandatory for anyone contributing code. Estimated 2 hours. Covers:
- OWASP Top 10 and the OWASP ASVS controls we hold ourselves to.
- Tenant isolation: how Row-Level Security works here, why every new table needs policies and grants, and why service-role access must never be reachable from the browser.
- Authorisation-before-action: verifying the caller in every server function.
- Input validation and safe handling of uploaded files.
- Secrets handling: managed secret store only, never in source or logs.
- Secure code-review checklist and the promotion gates in A3/A8.

## 3. Records

For each person and each training event we record: name, role, module, date completed, version of the material, and a signed or electronically acknowledged attestation. Records are retained for the duration of the engagement plus 7 years and are available to customers as evidence on request.

## 4. Non-completion

Access is not granted until induction is complete. Failure to complete an annual refresher within 30 days of its due date results in suspension of administrative access until completed.

## 5. Effectiveness review

Annually the Founder reviews: completion rates, incidents or near-misses attributable to a knowledge gap, and whether the material still reflects the architecture and threat landscape. Material is updated accordingly.

## 6. Current status

As at the effective date, WYHEN is operated by a single principal, who has completed the induction and secure-development modules and is subject to the annual refresher and quarterly update cycle on the same terms as any future employee or contractor.