Last updated: 8 September 2026
These are our Online Purchase Terms, the terms that apply when a business purchases and uses the CyberSec Compliance platform. If we separately agree a bespoke consultancy engagement with you under a signed Proposal or Statement of Work, our Master Terms of Business govern that engagement instead.
These terms are between CyberSec Compliance Ltd, company number 17285687, registered office Unit A, 82 James Carter Road, Mildenhall, Bury Saint Edmunds, IP28 7DE, UK ("we", "us"), and the business or organisation identified at checkout ("you").
Our services are intended for business customers. By placing an order you confirm that you are acting wholly or mainly for business purposes and have authority to bind the organisation you're ordering for. If you are seeking to purchase as a consumer, please contact us first rather than completing checkout.
If we separately agree a Proposal or Statement of Work for consultancy or implementation support, that agreement and our Master Terms of Business will govern those services and take priority where expressly stated.
Depending on the package you select, the services may include guided questionnaires, framework mapping, generated security policies and procedures, registers, plans, readiness materials, a Statement of Applicability, a Targeted Improvement Plan, Cyber Essentials/CE+ readiness materials, evidence tools, the customer portal, and ongoing drift/change review features.
The precise features included are those stated on the relevant product and checkout pages at the time of purchase. We may improve or replace non-material features, provided the overall paid service isn't materially reduced during a period you've paid for.
Some packages may include optional consultancy or implementation support, for example, explaining findings, helping you tailor and embed policies, workshops, or working with your internal team or MSP on actions. Any such support is limited to the scope stated at the point of purchase.
We are a compliance-readiness and cybersecurity consultancy provider, not a certification body, regulator, insurer or insurance broker. We do not ourselves issue ISO/IEC 27001, Cyber Essentials or Cyber Essentials Plus certification, or regulatory CAF approval.
We do not operate or secure your own IT environment, or copies of documents you store outside the platform, our responsibility is to operate and protect the CyberSec Compliance platform and your data held within systems under our control (see Sections 11 and 12).
Even where we help you implement policies, processes or control improvements, your organisation remains responsible for approving changes, operating and maintaining controls, keeping information accurate, managing risk, and ensuring actual practices match your documentation.
Using the platform, generating documentation, receiving consultancy, or reaching a high readiness score does not guarantee certification, audit success, tender success, insurance placement, renewal, or claim payment.
Your order is an offer to buy the selected services. A contract is formed when we accept payment and send an order/account confirmation, or when we make the paid services available to you, whichever happens first.
If we can't accept an order, for example because of a pricing error, legal restriction, suspected fraud, or service unavailability, we'll notify you and refund any amount taken for the unaccepted order.
The contract consists of the checkout summary, these terms, our Privacy Policy, and any document expressly incorporated at checkout. The checkout summary takes priority for package, price, access period and billing cycle.
You're responsible for providing complete and accurate information. Generated documents, mappings, action plans and recommendations depend on your answers and evidence, we don't independently verify every answer or configuration unless separately agreed.
You must keep login credentials confidential, use reasonable security measures for authorised users, and promptly notify us at info@cyberseccompliance.co.uk if you suspect unauthorised account access.
You're responsible for deciding whether recommendations are appropriate, implementing and maintaining policies, procedures and controls, obtaining internal approvals, and ensuring your personnel, IT/MSP and other providers perform their responsibilities. This doesn't reduce our responsibility for your data while it remains stored or processed within systems under our control.
You must not share access outside authorised users, bypass access controls, interfere with the platform, upload malicious code, scrape or reverse-engineer protected parts of the platform, or use the services unlawfully.
Prices are shown at checkout in GBP and, unless stated otherwise, are exclusive of VAT where applicable. Payment is due in advance through the payment method available at checkout, processed by our payment provider, Stripe, we don't receive or store your full card details.
Our packages are billed in two parts: a one-off upfront fee at signup, followed by a recurring monthly subscription fee for continued access to the portal. The upfront fee covers your initial setup, document generation, and your first 30 days of portal access. The recurring monthly fee then begins automatically once that initial 30-day period ends, and is what keeps your portal account active and accessible from that point onward. You authorise our payment provider to collect the subscription charge on each renewal date until cancellation, non-payment, or expiry (see Section 7). The exact amounts and billing cycle will be shown before purchase, and we'll give reasonable notice of a material price increase before it takes effect for a future renewal.
Your initial access period is 30 days from account activation, covered by your one-off upfront fee. Your first recurring monthly charge is then taken automatically at the end of that 30-day period, and renews monthly from there unless cancelled.
You can request cancellation at any time from within your portal account, or by contacting us. Cancellation takes effect at the end of the current paid billing period unless stated otherwise; no further renewal charge will then be taken.
Continued access to the portal depends on the recurring fee being paid. If a recurring card payment fails, or a manually-invoiced payment isn't received by its due date, we treat this the same way as a cancellation you requested yourself, we'll try to notify you and may retry the payment, but if it isn't resolved, the same 30-day grace period and revocation process described below applies automatically, without you needing to take any action.
After cancellation, non-payment, or expiry, we provide a 30-day grace period so you can download any documents you need. Once that period ends, your portal access is revoked and your data is then deleted or anonymised, subject to legal retention obligations and backup cycles. If you later want to reactivate your account, this is treated as a new signup and the standard package fee shown on our Pricing page applies again.
Documents you validly downloaded before access ends may continue to be used under Section 10.
Because our packages provide immediate platform access and generate organisation-specific documents, fees are generally non-refundable once you've submitted the relevant questionnaire or generated bespoke documents, except where required by law or where we agree otherwise.
If you believe you purchased the wrong package, were charged in error, or haven't begun using paid features, contact us promptly, we'll consider reasonable correction, package-transfer or refund requests in good faith.
Cancelling a recurring subscription prevents future renewal charges but doesn't ordinarily create a pro-rata refund for the current paid billing period.
We aim to keep the platform available and reliable but don't guarantee uninterrupted or error-free access. We may carry out planned or emergency maintenance, security work and updates.
We take reasonable steps to protect and back up the platform and your data held within systems under our control, but we don't guarantee that data or documents can always be recovered in the event of a system failure, outage, or other unforeseen loss. You should download and keep your own local copy of any policy, document or other evidence generated for you as soon as it's available, and download a fresh copy again whenever you update your answers or regenerate a document, don't rely on the portal as your only copy. Once downloaded or transferred to your own systems, your responsibilities for that copy are set out in Section 12.
We may temporarily suspend an account where reasonably necessary to address a security risk, suspected misuse, legal requirement, or overdue payment.
You retain ownership of information and materials you provide. Subject to payment of applicable fees, you own the organisation-specific content of documents generated specifically for you from your answers.
We retain all rights in the platform, software, policy/template libraries, methodologies, questionnaires, mappings, workflows, know-how and materials that existed independently of your organisation-specific content.
We grant you a perpetual, worldwide, non-exclusive, royalty-free licence to use our underlying material embedded in downloaded documents as part of those documents, for your own business, compliance, audit, certification-readiness, procurement and insurance purposes.
You must not extract or resell our template library, software, methodology or mappings as a standalone product, sublicense them to third parties as a template service, or use them to build a competing product or service.
We treat non-public business and security information you provide, including questionnaire responses used to populate your policies and other documents, as confidential, and use it only to provide, secure, support and administer the services, subject to lawful disclosure requirements.
Our Privacy Policy explains how we process personal data for account administration, service delivery, billing, security and related purposes, and forms part of these terms.
Where we process personal data solely on your behalf as processor, we'll process it on your documented instructions, apply appropriate security and confidentiality measures, use subprocessors under appropriate contractual protections, assist with relevant UK GDPR obligations where reasonably required, and delete or return the data at the end of the service subject to lawful retention and backup cycles.
You're responsible for having a lawful basis to provide personal data to us, and for giving any privacy information required to individuals whose data you enter into the services.
We maintain appropriate technical and organisational measures designed to protect your data under our control, including information supplied through questionnaires and used to generate, populate or update your policies and other documents.
Our responsibility for protecting your data continues for so long as it's retained or processed within systems under our control. Downloading a policy or other document doesn't end our obligations in relation to questionnaire responses, your data, or copies of documents that remain within our systems.
Once you download, export or otherwise transfer a document or your data from the platform to a system, device, storage location or service controlled by you or a third party acting on your behalf, you're responsible for the security, storage, access controls, use, disclosure, retention, backup and processing of that downloaded or transferred copy. We're not responsible for loss, unauthorised access, disclosure, corruption, alteration or deletion of a downloaded or transferred copy to the extent arising after it has left systems under our control, except to the extent caused by our breach of these terms.
If we become aware of a material security incident affecting your data within systems under our control, we'll notify you without undue delay where required by applicable law or where notification is reasonably necessary for you to protect your organisation.
If you purchase consultancy or implementation support, we'll provide it with reasonable care and skill within the agreed scope. This may include policy/process implementation, governance routines, control design, action planning, workshops, evidence review, and advice to your internal team or MSP.
Consultancy and implementation support don't transfer responsibility for your own systems or information to us. We may help you adopt and implement policies, procedures and compliance controls, but you remain responsible for your organisation's decisions, approvals, operation of its environment, and the security of copies of documents stored outside our platform.
We may advise your internal IT team or MSP on technical actions needed to support a policy or framework requirement, but we don't make production configuration changes, administer systems, or operate technical controls.
Framework mappings and readiness materials support preparation and evidence management, they are not a substitute for your organisation actually operating the documented controls.
Standards, scheme requirements, auditor interpretations, insurer underwriting criteria and procurement requirements can change. We may update the platform and content, but we don't guarantee that every external body will interpret or apply a requirement in the same way.
You should obtain independent legal, insurance, certification or specialist technical advice where an issue falls outside the scope of our services.
Nothing in these terms excludes or limits liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any liability that can't lawfully be excluded or limited.
Subject to that, we're not liable for indirect or consequential loss, or for loss of profit, revenue, business, anticipated savings, goodwill, opportunity, or loss arising from a third party refusing certification, accreditation, a tender, insurance or a claim.
We're not liable to the extent loss is caused or increased by inaccurate or incomplete information you provide, failure to implement or maintain controls, misuse of documents, acts or omissions of your IT provider or another third party, or your failure to appropriately secure, store, back up or control access to downloaded or transferred copies after they've left systems under our control. This doesn't limit our responsibility for your data that remains within systems under our control.
Our total aggregate liability arising out of or in connection with the services is limited to the fees you paid or were required to pay us for the affected package during the 12 months immediately before the event giving rise to the claim. If the claim arises during the first 12 months, the cap is the fees paid or payable for the affected order.
We may suspend or terminate access if you materially breach these terms, fail to pay fees when due, misuse the services, create a material security risk, or use the services unlawfully. Where a breach can reasonably be remedied, we'll normally give you a reasonable opportunity to remedy it, unless urgent suspension is needed for security or legal reasons.
On termination, accrued payment obligations and provisions intended to survive, including intellectual property, confidentiality, liability, data protection and governing law, continue to apply.
We may update these terms for future orders at any time. For an active recurring subscription, we may make reasonable changes to reflect law, regulation, framework changes, security, service improvements or business changes.
If we make a material change that's materially adverse to an active subscriber, we'll give reasonable advance notice. If the change isn't required by law or urgent security necessity and you don't accept it, you may cancel the affected subscription before the change takes effect. We'll update the "Last updated" date above whenever we make a change.
We may use employees, contractors and subprocessors to provide the services and remain responsible for our contractual obligations. You may not assign your contract without our prior written consent, not to be unreasonably withheld or delayed; we may assign it as part of a bona fide sale, reorganisation or transfer of the relevant business.
If any provision is invalid or unenforceable, the remainder continues in force. A delay in enforcing a right is not a waiver. These terms and your order form the entire agreement for the purchase and don't exclude liability for fraud or fraudulent misrepresentation.
Nothing creates a partnership, joint venture or agency. No person other than you and us may enforce these terms under the Contracts (Rights of Third Parties) Act 1999.
These terms and any non-contractual obligations arising from them are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.
If you have a complaint or dispute, contact us first at info@cyberseccompliance.co.uk so we can try to resolve it promptly. Legal notices may be sent to our registered office or to a legal/contact email address we've notified. We may send account and contractual notices to the email address registered to your account.