Terms of Service

Draft — not yet reviewed by a lawyer. This page is a starting skeleton describing the service as it actually behaves today, not a binding contract. It must not be relied on or published to real clients until reviewed and completed by a qualified commercial lawyer — including every section marked [NEEDS LEGAL INPUT] below, most of which carry real liability consequences if left unspecified.

The service

CISO on Demand provides a security assurance platform: a portal correlating threat intelligence against your organisation's own environment, a deterministic posture score and Essential Eight maturity assessment, and advisories drawn from your engagement history. Access is provisioned by our staff or your own organisation's administrator — there is no public self-signup.

Your account and data

You're responsible for keeping your account credentials and any API keys you provide (e.g. for AI features) secure, and for the accuracy of the information your organisation enters or uploads. Multi-factor authentication is required on every account.

What we don't promise (yet)

This is an actively developed platform. [NEEDS LEGAL INPUT: an explicit, lawyer-drafted service-level commitment (or explicit disclaimer of one) covering uptime, support response times, and what happens if the service is unavailable — do not let clients assume an SLA that hasn't actually been committed to.]

Liability

[NEEDS LEGAL INPUT: limitation of liability, indemnification, and what happens in the event of a security incident affecting client data — this is the single highest-stakes section on this page and should not ship without direct lawyer drafting.]

Fees and billing

Engagements are quoted and invoiced individually through our own accounting and billing systems, separate from this platform. [NEEDS LEGAL INPUT: payment terms, late-payment consequences, refund policy.]

Termination

Either party may end the engagement. Ending access follows a two-step process — your workspace is first suspended (reversible), then permanently deleted only after an explicit, confirmed request; our own audit record of the engagement is retained even after your data is deleted. [NEEDS LEGAL INPUT: notice periods, data-return obligations before deletion.]

Governing law

[NEEDS LEGAL INPUT: jurisdiction and dispute-resolution process.]

Contact

[NEEDS LEGAL INPUT: a real contact email/address.]