Code of Conduct

01Purpose, and who this applies to

This Code sets out how Advit Pty Ltd (ACN 682 221 638), trading as Averro Technologies (Averro), does business. It applies to every director, employee, contractor, subcontractor and work-experience participant of Averro, and to any supplier or delivery partner acting on our behalf.

It is not a summary of the law. Complying with the law is the floor, not the standard. Where this Code sets a higher expectation than the law requires, the higher expectation applies. Where a client’s own policy is stricter than this Code, we work to the client’s policy.

02Our commitments, in short

The rest of this document is the detail. If you remember nothing else, remember these.

1. We protect what clients trust us with — their data, their systems and their reputation.
2. We use privileged access only for the work we were engaged to do, and we log it.
3. We give the advice we would give if there were no money in it.
4. We take no commission, rebate or benefit that could colour a recommendation.
5. We tell the client the bad news early, in plain English, in writing.
6. We keep a human accountable for anything an automation does.
7. We treat everyone — colleagues, clients, competitors, suppliers — with respect.
8. We speak up when something is wrong, and nobody is punished for doing so.

03Client trust and confidentiality

Client information is confidential by default, whether or not it is marked, whether or not a non-disclosure agreement is in place, and whether or not the engagement has ended.

We do

• Treat everything we learn about a client’s systems, finances, people, incidents and plans as confidential, indefinitely.
• Limit access to client information to the people who need it to do the work.
• Store client information in systems we control and have assessed, and nowhere else.
• Return or securely destroy client information when an engagement ends, on request and in accordance with the engagement terms.
• Get written permission before naming a client, describing their environment, or using their logo in any proposal, tender, case study or marketing material.

We do not

• Discuss one client’s environment, incidents or commercial terms with another.
• Reuse a client’s confidential material — documents, architectures, data — on another engagement, even in anonymised form, without permission.
• Move client data into a personal account, a personal device, or an unapproved third-party tool, including a consumer AI assistant.
• Speak publicly about a client’s security incident. Ever. Disclosure is the client’s decision and their legal obligation, not ours.

04Privileged access to client systems

Administrative access is the most dangerous thing we hold. It is granted for a purpose and it is used for that purpose only.

How we use it

1. Access is used only to perform work within the agreed scope of the engagement, or to respond to an incident affecting that client.
2. Every administrator uses a named, individually attributable account. Shared administrator accounts are not used where the platform supports an alternative, and where one is unavoidable its use is logged and time-boxed.
3. Multi-factor authentication is mandatory on every account we hold into a client environment. No exceptions, including for short engagements.
4. Access is reviewed at least quarterly and removed within one business day of a person leaving Averro or rolling off an engagement.
5. Client credentials are held in an approved secrets manager. They are never stored in a document, a spreadsheet, a ticket, a chat message, an email or a personal password manager.
6. We never ask a client for a password over email, chat or phone, and we never ask a client to email one to us.

Curiosity is not authorisation

05Honest advice and independence

Clients pay us for judgement. Judgement is worthless if it is for sale.

Commissions and vendor incentives

• We do not accept a referral fee, commission, rebate, kickback, sales incentive or margin from a vendor that would be affected by which product we recommend.
• Where we resell or bundle anything, the arrangement and the margin are disclosed to the client in writing before they commit.
• Vendor certifications, partner tiers and training are normal and useful. Vendor sales targets are not something we ever carry.

How we give advice

• We state the option we rejected and why, so the client can see the shape of the decision rather than only its conclusion.
• We say “you do not need this” when it is true, including when it costs us the work.
• We do not present a target, a benchmark or a projection as an achieved result.
• We do not claim a certification, accreditation, partner tier or client relationship we do not hold.
• We do not use fear of a breach as a sales technique. Risk is described accurately, with its likelihood, not dramatised.

06Conflicts of interest

A conflict is not misconduct. Concealing one is.

You must declare, in writing, any circumstance where your personal interest could reasonably be seen to influence your work. That includes a financial interest in a supplier or competitor, a close personal relationship with a client contact or a decision-maker in a procurement, outside employment or consulting in our industry, a directorship, and any gift or hospitality above a nominal value.

Declare it as soon as you become aware of it, not at the next review. We will then decide together how to manage it — which may mean recusing yourself, adding a second reviewer, disclosing it to the client, or declining the work.

Competing engagements

We may work for organisations that compete with each other. Where we do, we tell both, we keep the delivery teams and the information separate, and we will decline an engagement where those separations cannot be made real.

07Bribery, corruption, gifts and hospitality

We do not offer, give, request or accept a bribe, a secret commission, or any improper benefit intended to influence a decision, in any country, under any circumstances, including where it is described as customary. This includes facilitation payments.

Modest, occasional business hospitality is acceptable — a working lunch, a vendor briefing, a conference ticket. It is not acceptable if it is frequent, extravagant, in cash or a cash equivalent, offered around a live tender or procurement decision, or something you would not want disclosed to the client or published.

Anything of more than nominal value must be declared. If you are unsure whether something is nominal, it is not; declare it.

08Fair dealing and honest marketing

We compete on the quality of our work.

• We describe our services, capabilities and results accurately. We do not mislead by omission, by implication, or by putting a caveat where nobody will read it.
• We do not disparage a competitor. If asked to compare, we describe the trade-off factually.
• We do not use another firm’s confidential information, and we do not ask a candidate or a new starter to bring any.
• We comply with competition law. We do not fix prices, rig bids, allocate markets or agree with a competitor not to approach each other’s clients or staff.
• Testimonials and case studies describe real engagements, with the client’s written permission, and are not edited to change their meaning.

09Responsible use of AI and automation

We build systems that act on our clients’ behalf. That has to come with rules, and these are ours.

1. A person stays accountable. Every automation has a named owner at the client and at Averro. “The system did it” is never an answer.
2. Consequential actions keep a human in the loop. Anything that moves money, commits the client contractually, contacts a customer under the client’s name, or deletes data requires human approval before it takes effect.
3. Failure is graceful. Every automation degrades to the manual process it replaced, never to silence. A stopped automation must be visible.
4. Data boundaries are agreed in writing. Before we build, we agree with the client what data any model may see, where it is processed, whether it may be retained, and whether it may be used for training. We default to no retention and no training.
5. Client data does not go into consumer AI tools. Personal accounts and unapproved assistants are out of scope for any client material, including code, logs and configuration.
6. We disclose automation to the people affected by it. If an automation writes to a client’s customer, the client knows, and we advise them on their own disclosure obligations.
7. We test for the harm, not just the happy path. Before an automation goes live we ask what it does to the worst-case input, and who is hurt if it is wrong.
8. We do not build systems whose purpose is to deceive, to profile people unlawfully, to evade a regulator, or to make a consequential decision about a person — employment, credit, access to a service — without human review and a route to challenge it.

Where a client’s use case is subject to a specific regime — privacy, anti-discrimination, consumer credit, health records — we say so and recommend they take advice. We are technology professionals, not their lawyers.

10Privacy and personal information

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and in accordance with our Privacy Policy.

When we handle personal information on a client’s behalf we do so only on their instructions and only for the purpose of the engagement. We collect the minimum we need, we do not keep it longer than the engagement requires, and we do not use it for our own purposes.

If we become aware of unauthorised access to, or disclosure or loss of, personal information — ours or a client’s — we escalate immediately under clause 16 and assist the client to meet their obligations under the Notifiable Data Breaches scheme. We do not wait to be certain before raising it.

11Respect at work, and the positive duty

Everyone working with Averro is entitled to a workplace free from discrimination, harassment, sexual harassment, bullying and victimisation. That applies on client sites, at industry events, in chat channels and online, not only in an office.

What the positive duty means we actually do

1. Leadership owns this. A director is accountable for the standard, not the HR inbox.
2. We assess the risk deliberately — including the risks specific to how we work: lone work on client sites, out-of-hours contact, junior people placed inside another organisation’s culture, and client staff who are not bound by this Code.
3. Expectations are set in writing, before someone starts, and repeated — not filed.
4. Reporting is supported and there is more than one way to do it (clause 16).
5. We measure and review, at least annually, and change what is not working.
6. We transparently record what we found and what we did about it.
7. We consult the people affected rather than deciding on their behalf.

Those seven lines are the AHRC’s standards for meeting the positive duty, written as what we do rather than as a summary of a guideline.

The rest of the standard

• We do not discriminate on the basis of race, colour, national or ethnic origin, sex, sexual orientation, gender identity, intersex status, age, disability, religion, pregnancy, marital or relationship status, family responsibilities, breastfeeding, carer status, industrial activity, or political belief — the attributes protected by the Equal Opportunity Act 2010 (Vic) and the Commonwealth discrimination Acts.
• Vilification on the basis of race or religion is unlawful in Victoria under the Racial and Religious Tolerance Act 2001 and is a serious breach of this Code.
• We recruit, pay and promote on merit and on the requirements of the role.
• We make reasonable adjustments for people with disability, in recruitment and at work. Ask; it is not a favour, it is an obligation, and it will not count against you.
• We take a complaint seriously, handle it confidentially so far as we are able, and do not retaliate against the person who raised it. Victimisation is separately unlawful.
• This expectation runs both ways. Where a client’s staff behave this way toward ours, we raise it with the client, and we will withdraw people from a site if it is not resolved. Our duty is to our people; it is not suspended because the conduct happened on someone else’s premises.

12Health, safety and psychological health

We comply with occupational health and safety law in every jurisdiction we operate in, and with the site rules of any client premises we attend.

Psychological health is a safety duty, not a wellbeing programme

The Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic) commenced on 1 December 2025. They require Victorian employers to identify psychosocial hazards and eliminate or reduce the resulting risks so far as is reasonably practicable — hazards including bullying, sexual harassment, aggression or violence, high job demands, low job control, poor support, and exposure to traumatic content.

Several of those are ordinary features of this work if it is run badly. We name the ones that apply to us:

• High job demands and low control during an incident, when someone is responsible for an outcome they cannot fully influence.
• Out-of-hours and on-call work, and the sleep disruption that comes with it.
• Aggression from a client under pressure during an outage or a breach.
• Exposure to distressing material — security work can put a person in front of content they did not expect and did not choose.
• Isolation for people placed alone inside a client’s organisation.

These are assessed and controlled like any other hazard: identified, recorded, given a control, and reviewed. Someone who has worked an incident overnight is stood down the following day; that is a control, not a courtesy.

The right to disconnect

• Nobody is expected to work while unwell, and nobody is expected to attend a site they reasonably believe is unsafe. Stop, and tell someone.
• Incidents are debriefed. If something was distressing, that is a legitimate thing to say and support is arranged.
• You may report a hazard, or a psychosocial risk, directly to WorkSafe Victoria. You do not need our permission and you will not be disadvantaged for it.

13Working in regulated and critical sectors

We advertise work in government, defence, utilities and energy, telecommunications, banking and insurance. Each of those carries obligations that do not apply to ordinary commercial work, and they attach to us as a supplier as well as to the client.

Critical infrastructure

The Security of Critical Infrastructure Act 2018 (Cth) imposes reporting, register and risk-management-programme obligations on responsible entities for critical infrastructure assets, and expressly reaches the supply chain hazard — which is us.

• Before we take on work touching a critical infrastructure asset, we establish with the client in writing whether their Critical Infrastructure Risk Management Program applies to our access, and what it requires of us.
• We tell the client immediately if we become aware of a cyber security incident affecting an asset they are responsible for, because their reporting clock under Part 2B is short and it is their obligation, not ours, that is on the line.
• We do not sub-contract access to a critical asset without the client’s written agreement.

Government work

• Commonwealth work is delivered against the Protective Security Policy Framework and the ACSC Information Security Manual where the contract requires it, and we say plainly when a control is not yet met rather than asserting compliance.
• Where we perform a function of a public nature on behalf of a Victorian public authority, we may be a public authority ourselves under s 4(1)(c) of the Charter of Human Rights and Responsibilities Act 2006 (Vic), and must act compatibly with the Charter. We establish that at contracting, not afterwards.
• Victorian government data is also subject to the Privacy and Data Protection Act 2014 (Vic) and the Victorian Protective Data Security Standards, which are not the same instrument as the Commonwealth Privacy Act.
• Clearances, citizenship and eligibility requirements are met before a person starts, never retrospectively.

14Modern slavery and our supply chain

We do not tolerate forced labour, child labour, debt bondage, human trafficking or deceptive recruitment in our operations or in our supply chain.

Technology supply chains carry real exposure — hardware manufacturing, electronics assembly, mineral extraction, offshore data-labelling and outsourced support. We take that seriously rather than assuming a services business is unaffected.

What we do about it

• We expect suppliers and subcontractors to meet the standards in this Code, and we say so in writing when we engage them.
• We give preference, where the choice is otherwise close, to suppliers who publish a modern slavery statement or an equivalent assessment.
• We investigate credible concerns raised about a supplier, and we will end a supplier relationship over a substantiated finding that they will not remediate.
• We do not use unpaid work, and we pay our subcontractors on the terms we agreed.

Averro is not currently a reporting entity under the Modern Slavery Act 2018 (Cth). The obligations in this clause are ones we take on regardless.

15Assets, records and what we tell clients

Averro assets — devices, accounts, licences, tooling and intellectual property — are provided for work. Incidental personal use is fine; use that creates legal, security or reputational risk is not.

Client-owned assets stay client-owned. Every tenancy, domain, subscription and cloud account we set up is registered in the client’s name with their billing, and we hand over cleanly when an engagement ends, including documentation and administrative access.

Records and reporting

• Timesheets, invoices, expenses, incident records and reports are accurate and complete. We do not round up, pad, or bill for work not done.
• When we get something wrong — an outage we caused, a misconfiguration, a missed patch, an estimate we will overrun — the client hears it from us, early, in writing, with what we are doing about it. We do not let a client discover our mistakes for themselves.
• We do not alter, backdate or destroy a record to change how an event appears.
• People are paid correctly and on time — wages, penalties, superannuation, on-call allowances and subcontractor invoices. Deliberate underpayment is a criminal offence in Victoria under the Wage Theft Act 2020 and, since 1 January 2025, a Commonwealth criminal offence under the Fair Work Act 2009. An honest mistake gets corrected and back-paid as soon as it is found; that is the difference between the two.

16Speaking up

If you see something that breaches this Code, the law, or your own sense of what is right, raise it. That includes something you are unsure about, and something you may have done yourself.

How to raise it

1. Raise it with your engagement lead or a director. This resolves nearly everything.
2. If that is not appropriate, or you have raised it and nothing happened, email contactus@averrotech.com marked for the attention of a director.
3. You may raise a concern anonymously. We will act on it, though it may limit our ability to investigate or to keep you informed.

Protection

You can also report directly to a regulator — the Office of the Australian Information Commissioner, the Australian Securities and Investments Commission, the Fair Work Ombudsman, the Australian Cyber Security Centre or a State work health and safety regulator — and you do not need our permission to do so.

17Breaches of this code

A breach is dealt with proportionately, on the facts, after the person concerned has had a fair opportunity to respond.

Outcomes range from a conversation and additional training through to a formal warning, removal from an engagement, termination of employment or contract, and referral to a regulator or to the police. Deliberate misuse of client access, concealment of an incident, and retaliation against someone who spoke up are treated as the most serious categories.

Where a supplier or delivery partner breaches this Code, we will require remediation and may terminate the relationship.

18Review and questions

This Code is reviewed at least annually and whenever our services, obligations or risk profile change materially. The date at the top of this page records the last change.

A code only works if people can ask about it without it being a formal event. If you are unsure whether something is allowed, ask first — asking is always cheaper than explaining.