Last updated: 24 August 2026
This page describes how Bezeled Pty Ltd ("Cupid") protects the CPD records and evidence a practitioner or firm keeps in the service. It is written for the person doing procurement at a law firm, so it states what is in place and what is not.
Cupid helps practitioners and firms track, manage and prepare CPD records. It does not certify that anyone has met their obligations.
1.Separation between firms
Every record in Cupid belongs to exactly one workspace, and every query is scoped to that workspace. A firm cannot see another firm's practitioners, activities, evidence, sessions or credentials, and there is no shared view that spans workspaces. This is the boundary Cupid treats as absolute: a failure of it is handled as a P0 incident under section 6.
2.Who can see a practitioner's record inside a firm
Being a workspace administrator does not give access to a colleague's CPD record. Reading or writing someone else's record requires either a capability granted by the firm, or a standing grant the practitioner has made themselves and can withdraw at any time. Both are recorded in the workspace's audit trail.
A practitioner's own record, its evidence and its history remain readable and exportable by that practitioner for as long as the workspace is active.
3.Access and authentication
- Sign-in supports email and password, a one-time email link, and Google or Microsoft accounts.
- Two-factor authentication is available to every account, and a firm can require it of every member of its workspace.
- Signed-in devices are listed in account settings and can be signed out individually.
- Sign-in does not disclose whether an email address has an account.
- Authentication endpoints and public write endpoints are rate limited.
4.Evidence files and documents
Evidence, certificates and other uploaded documents are stored privately. They are served through short-lived, single-purpose links rather than public URLs, and uploads pass through an authenticated endpoint that checks the file's actual contents rather than trusting what the browser declares it to be.
5.Retention and deletion
| Data | While in use | After closure or a deletion request |
|---|---|---|
| CPD records, evidence, credentials, attendance and certificates | While the workspace is active | An export is offered first. Records and stored files are deleted within 30 days unless a documented legal hold applies. |
| Account and workspace identity data | While the account is active | Deleted or irreversibly anonymised within 30 days. Minimum billing records may be kept for seven years. |
| Application audit and security logs | Operational need | Rolling 90-day retention, unless preserved for an active incident or a legal requirement. |
| Database and object-storage backups | Disaster recovery | Daily recovery points kept for 35 days. Deleted records therefore age out of backups no later than 35 days after deletion. |
Backups exist to restore the service, not to retain data a customer has asked to have removed.
6.If something goes wrong
Cupid operates a written incident procedure: contain, escalate, assess, remediate, notify, review. A suspected disclosure of one firm's data to another is treated as the highest severity. Where an incident is likely to result in serious harm, Cupid prepares the notifications required by Australia's Notifiable Data Breaches scheme and gives affected customers a named contact.
7.Independent review
Cupid's application code is reviewed against a fourteen-point security checklist covering authorisation and object-level access, server-side validation, rate limiting, file upload handling, enumeration and injection, secret handling, personal data exposure, logging and alerting, backups, administrative interfaces, dependency advisories, environment separation, published policies and data-protection obligations. Findings are remediated and the assessment is repeated as the product changes.
8.What Cupid does not claim
- Data residency. Cupid does not currently make a claim about the country in which data or its backup replicas are stored. Ask before assuming one.
- A completed external certification. Cupid does not hold ISO 27001, SOC 2 or an equivalent third-party attestation.
- Compliance certification. Cupid records and prepares CPD evidence. It does not certify that a practitioner has met their obligations, and no output of it should be presented as proof that they have.
9.Contact
Security questions, and reports of a suspected vulnerability, go to hello@cupid.legal. Please include enough detail to reproduce the issue. Cupid will acknowledge a report and will not pursue anyone who reports one in good faith and does not access or alter another customer's data.