The service
The service maps compliance controls from selected frameworks, executes control tests against systems you connect, generates evidence records and tracks remediation of failed controls. Features available to you depend on your plan, as set out in your order.
Not professional advice or certification
The service automates compliance operations and evidence gathering. It does not provide legal, regulatory or audit advice, and it does not replace qualified compliance professionals or the formal judgment of an auditor, assessor or regulator.
Use of the service does not by itself make your organisation compliant with, or certified against, any framework. Decisions about scope, risk acceptance and compliance status remain yours.
Accounts
- You must provide accurate sign-up details and keep login credentials confidential.
- You are responsible for activity under your workspace and for the users you invite.
- Tell us promptly through the contact form if you suspect unauthorised access.
System connections
You decide which systems to connect and grant only the permissions you are authorised to grant. You confirm that you have the right to let the service read data from those systems for the purpose of testing controls. You may revoke any connection at any time.
Your data
You keep ownership of all data in your workspace, including evidence records. We use it only to provide and secure the service for you. You can export your evidence during your subscription and on request when it ends. How we handle personal data is described in the Privacy Policy.
Acceptable use
- Do not connect systems you are not authorised to access or test.
- Do not attempt to probe, disrupt or bypass the security of the service.
- Do not use the service to create misleading evidence or misrepresent your compliance status.
- Do not resell or provide the service to third parties unless agreed in writing.
Fees
Fees, billing periods and contract length are set out in your order. Unless the order says otherwise, fees are payable in advance for each billing period and are non-refundable once that period has started.
Availability and changes
We work to keep the service available and to maintain framework mappings as standards change. We may improve or modify features over time. We will not materially reduce the core functionality of your plan during a paid term without notice.
Liability
To the extent permitted by law, the service is provided without warranties beyond those stated in your order, and neither party is liable for indirect or consequential losses. Our total liability in any twelve month period is limited to the fees paid for the service in that period.
Termination
Either party may end the agreement as set out in your order, or immediately if the other materially breaches these terms and does not fix the breach within thirty days of notice. On termination, access ends and your data is handled as described in Your data.
Governing law
These terms are governed by the laws of India, and the competent courts in India have jurisdiction over any dispute.