GuideBeam processes sensitive career, personality, and psychometric data. We take that responsibility seriously — with consent-based sharing, AI de-identification, and infrastructure you can trust.
Our data principles
You always know what data we collect, why we collect it, and who has access. No surprises.
You control what is shared — with practitioners, institutions, and AI. Nothing is shared without your explicit permission.
We only collect what is needed for career guidance. We never sell your data and never share it with employers.
Consent model
GuideBeam uses a consent-based data sharing model. Your psychometric results, career profile, and session history are private by default.
When you connect with a career practitioner, you choose which assessments and profile sections they can view. You can revoke access at any time.
If you are enrolled through an institution, they see aggregate progress and completion status — not your raw assessment answers or private career notes.
Every data access is logged. Practitioner access windows are time-limited and fully auditable by both the client and the institution.
Your practitioner
Assessment results, career profile
Your institution
Completion status, aggregate progress
Employers
No access
AI privacy
GuideBeam uses AI for career matching, roadmap generation, and coaching. Your personal details are always scrubbed before any data leaves our servers — enabled by default, with no opt-out needed.
Your profile, assessments, and career history are stored securely in our database. Names, companies, and contact details are identified from your profile.
Before sending any prompt to AI, personal identifiers are replaced with generic placeholders. "Jane Smith at Acme Corp" becomes "[PERSON_1] at [ORG_1]".
AI processes the de-identified data and returns recommendations. We restore your real details in the response before you see it. The AI never sees your identity.
Before (your data)
After (what AI sees)
De-identification is enabled by default for all accounts. There is no reason to send your identity to an AI, so we simply don't.
Infrastructure
From the network layer to the application layer, security is built in — not bolted on.
All connections use TLS 1.3. Data moving between your browser, our servers, and our database is encrypted end-to-end.
Your data is stored with AES-256 encryption. Database backups are encrypted. Even in the unlikely event of physical media theft, your data is unreadable.
GuideBeam runs on SOC 2 Type II certified infrastructure. Our hosting provider maintains rigorous physical security, access controls, and operational procedures.
Industry-standard authentication with support for email/password, magic links, and social login. Sessions are encrypted and expire automatically.
Compliance
We operate under Australian privacy law and align with international best practices.
GuideBeam complies with all 13 Australian Privacy Principles (APPs) under the Privacy Act 1988, including data collection, use, disclosure, and cross-border transfer requirements.
While headquartered in Australia, our privacy practices are aligned with the EU General Data Protection Regulation. We support data portability, right to erasure, and data access requests.
We are compliant with the Australian NDB scheme. In the unlikely event of an eligible data breach, affected users and the OAIC are notified within the mandatory timeframe.
You can export or delete your data at any time. When you delete your account, your personal data is permanently removed within 30 days. We do not retain data beyond its stated purpose.
Common questions
If you have specific security or compliance requirements — especially for institutional deployments — we are happy to discuss them in detail.
