Terms of service

1. Who we are

SurePosture is provided by [Company legal name], a company registered in England and Wales (company number [Companies House number]), registered office [Registered office address] (“we”, “us”). These terms form an agreement between us and the organisation that creates a SurePosture workspace (“you”). The person accepting them confirms they are authorised to bind that organisation. SurePosture is for business use only; it is not offered to consumers.

2. The service

SurePosture assesses the configuration of Microsoft 365 tenants you connect, using read-only permissions granted by each tenant's administrator, and produces findings, scores, reports, baselines and Cyber Essentials readiness views. Optional automated changes are available only where a tenant administrator grants the separate write permissions and you switch automation on for that tenant.

We will provide the service with reasonable skill and care and may improve or change it over time. We will not make a change that materially reduces the core functionality of your plan during a paid period without telling you in advance. We aim for high availability but do not guarantee the service will be uninterrupted; current status is shown on the status page.

SurePosture is independent and is not affiliated with, endorsed by or sponsored by Microsoft Corporation. It relies on Microsoft services that we do not control.

3. Accounts and security

You are responsible for the people you invite to your workspace, the roles you give them and everything done under your accounts. Keep sign-in details confidential, use two-step verification or Sign in with Microsoft, and remove people who no longer need access. Tell us promptly at [security contact email] if you suspect unauthorised access.

4. Authority to connect tenants

You must only connect a Microsoft 365 tenant that belongs to you or that you are authorised to assess by its owner, such as a client who has engaged you as their managed service provider or consultant. You confirm that, for every tenant you connect, you have that authority and any notices or agreements your client needs, and that the tenant administrator granting consent is entitled to do so. You will stop using a tenant's data and disconnect it when that authority ends.

5. Acceptable use

You must not, and must not allow anyone else to:

• use SurePosture to access, test or collect information about a tenant without authority;
• attempt to breach the security of SurePosture or other customers' data, or probe it except under our vulnerability disclosure policy;
• copy, resell or provide SurePosture as a service to others except as your plan allows, or reverse engineer it except where the law permits;
• use it in breach of law, including data protection law, or to build a competing product;
• overload the service, or use automated means to access it other than the features and API we provide.

6. Trial, plans and fees

• A new workspace starts with a free trial for the period shown at sign-up. No payment details are needed for the trial, and nothing is charged unless you choose a paid plan.
• Paid plans are billed in advance, monthly or annually, at the prices shown on our pricing when you subscribe, plus VAT. Payments are processed by Stripe.
• Subscriptions renew automatically at the end of each period until cancelled. You can cancel at any time in Settings; cancellation takes effect at the end of the period you have paid for, and fees already paid are not refunded except where the law requires.
• Plan limits (such as tenants, seats and history retained) apply as described on the pricing page. You can change plan at any time; upgrades take effect immediately.
• We may change prices with at least 30 days' notice, taking effect from your next renewal. If a payment fails and is not resolved within 14 days of our reminder, we may suspend paid features.

7. Changes to tenants

SurePosture never changes a tenant unless automation has been enabled for it, a change has been proposed, a dry run has succeeded and the change has been approved in SurePosture by an authorised person. You decide which changes to make and are responsible for them and their effect on your or your client's environment, including communicating with affected users. Review each proposed change before approving it, and use the rollback provided where appropriate.

8. What results mean

Findings, scores and reports reflect the configuration SurePosture could read at the time, using the permissions and licences available. Checks that could not run are reported as not assessed. SurePosture helps you identify and prioritise improvements; it does not guarantee that a tenant is secure or free from compromise, and it is not a substitute for professional judgement. Cyber Essentials readiness is an aid to preparing for assessment; it is not certification, which is awarded only by an IASME certification body.

9. Ownership

You (or your clients) own the data read from your tenants and the content you add. You give us the rights we need to process it to provide the service, as set out in the data processing agreement. You may share the reports SurePosture produces with the clients they relate to. We own SurePosture, its software, rules, report templates and documentation; you receive a non-exclusive right to use them while your subscription lasts. If you send us suggestions, we may use them freely.

10. Confidentiality

Each of us will keep the other's confidential information confidential, use it only for this agreement, and disclose it only to people who need it and are bound by similar duties, or where the law requires.

11. Data protection

Where we process personal data from your tenants on your behalf, we do so as your processor (or sub-processor, where you act for a client) under the data processing agreement, which forms part of these terms. How we handle the personal data of the people who use SurePosture is described in the privacy notice, and what we read, keep and protect is set out on the data protection page.

12. Suspension and ending

• You may cancel your subscription at any time in Settings, and ask us to close your workspace at any time by emailing [privacy contact email].
• We may suspend access immediately if needed to protect the service or others, or if you seriously breach these terms; we will tell you why and restore access once the issue is resolved.
• Either of us may end this agreement by notice if the other seriously breaches it and does not put it right within 30 days of being asked to.
• When the agreement ends, access stops. You can export reports before then. We delete your workspace data within 30 days of closure, except records we must keep by law (such as billing records).

13. Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.

Subject to that, neither of us is liable for loss of profit, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss. Each party's total liability arising from this agreement in any 12-month period is limited to the fees you paid us in the 12 months before the event giving rise to the claim.

14. Changes to these terms

We may update these terms. We will give at least 30 days' notice by email of changes that materially affect you; if you do not agree, you may cancel before they take effect. The date at the top shows when they last changed.

15. Law and disputes

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Before starting proceedings, please contact us at [support email] so we can try to resolve the matter.