Last updated 14 October 2026. This disclaimer applies to ISI, an information security incident recording and analysis tool operated by WebGen Services Pty Ltd (ABN 35 650 143 561). It should be read together with our Terms of Service and Privacy Policy.
ISI has no independent knowledge of your systems, your organisation or the event you are recording. Everything it produces — the questions it asks, the contradictions it raises, the risk picture, the findings, the control measures it names and the remediation it proposes — is derived solely from the information you enter, the evidence you attach and the answers you provide.
It follows that the output can only be as complete, as accurate and as current as that input. If evidence is missing, partial, mistaken or out of date, the output will be too, and it will not necessarily say so. The tool cannot detect what it has not been told. It cannot verify that a log is genuine, that a statement is truthful, that a system is configured as described, or that an account of events is complete. Where it expresses confidence in a conclusion, that confidence is an estimate of how well the conclusion follows from the material supplied — not a measure of whether the material itself is right.
You are responsible for what you put in, for keeping it current as an investigation develops, and for recognising when something important has not been recorded.
ISI does not provide, and must not be relied upon as, legal advice, regulatory advice, advice on notification obligations, insurance advice, forensic findings, expert opinion, a certification, an audit, an assurance engagement or a determination of any kind. No part of its output constitutes a professional opinion, and no professional relationship arises between you and WebGen Services Pty Ltd by your use of the tool.
In particular, where the tool comments on whether an incident appears notifiable under a privacy or data protection regime, that comment is an observation drawn from the material you supplied and is expressly flagged as an opinion rather than a determination. Whether a notification obligation exists, to whom, within what time, and in what form, is a legal question that depends on facts and jurisdiction, and it must be answered by a qualified adviser. Do not treat silence from the tool on any obligation as an indication that no obligation exists.
Parts of the analysis are produced using automated systems, including large language models. Such systems can be confidently wrong. They can misread evidence, overlook what is significant, and state things that are not so. Every output is advisory, is to be checked, and is not a substitute for competent human judgement.
ISI is designed to be used by, or under the supervision of, people competent to interpret its output — information security practitioners, incident responders, privacy and legal advisers, and others with the training and context to weigh what it says against what they know. It is one input to an investigation, not the investigation. It does not replace forensic examination, preservation of evidence, legal review, insurer notification, regulator engagement, or any obligation you owe under law, contract or policy.
Decisions taken in response to an incident — containment, notification, disclosure, remediation, discipline, litigation, public statements — are yours. You make them, and you are responsible for them. The same applies to anyone you choose to share a report with: how a recipient interprets it, what they advise on the strength of it, and what they do next are matters between you and them.
Evidence in ISI is append-only. Corrections and withdrawals add to the record rather than replacing it, and a report can be reproduced exactly as it stood on any past date. That is a feature of the record, not a warranty about it: a report generated on one date may be superseded by evidence gathered later, and a historical report may contain material since withdrawn. Reports are marked accordingly. Check the date on any report before relying on it, and do not quote a historical report forward as though it reflected the current position.
To the maximum extent permitted by law, and subject to the paragraph below, WebGen Services Pty Ltd accepts no liability for any loss, damage, cost or expense — including without limitation regulatory penalties, legal costs, business interruption, loss of data, loss of profit, reputational harm or any indirect or consequential loss — arising from or in connection with:
Nothing in this disclaimer excludes, restricts or modifies any guarantee, right or remedy you may have under the Australian Consumer Law or any other law that cannot lawfully be excluded. Where our liability cannot be excluded but may be limited, it is limited at our option to resupplying the service or paying the cost of having it resupplied.
By creating an account and using ISI you acknowledge that you have read and understood this disclaimer; that you are responsible for the accuracy and completeness of the information you enter; that the output is an aid to an investigation rather than a conclusion, an opinion or advice; and that you will have it interpreted by a person competent to do so before acting on it.
If any of this is unclear, or if you would prefer an investigation conducted on your behalf rather than a tool to conduct your own, write to webgen@webgen.com.au before you proceed.