Security Compliance Hub (the website at securitycompliancehub.io and the platform behind it, together "the service") is provided by Cyber3D Ltd, a company registered in England and Wales with company number 16732954, whose registered office is at 2 Village Farm, Bassingham, Lincoln, LN5 9FS ("we", "us").
These terms apply whenever you use the service: the free tools and free trial, a subscription or one-off purchase made online, or a licence arranged with us directly. "You" means the organisation that uses the service, and the people it lets use it. Where you have signed a separate agreement or order form with us (for example an MSP tenancy or a Third Party Risk Hub Enterprise plan), that agreement wins over these terms where the two differ.
Our Data Privacy Notice explains how we handle personal data, and forms part of these terms.
2For business use
The service is for organisations, and for people acting for an organisation in the course of its business. It is not offered to consumers. By creating an account or buying, you confirm that you are using the service for business purposes and, if you accept these terms for an organisation, that you have authority to bind it.
3Your account
Give accurate details when you register and keep them up to date.
Keep your sign-in details secure. Where the service asks for multi-factor authentication, set it up. You are responsible for what happens under your account.
One account is for one person. Don't share sign-in details; a team plan lets several people work together.
4What you get
Each plan includes what our pricing page described when you bought it, including its limits, such as how many Phronesis analysis runs it includes a month and how many suppliers the Third Party Risk Hub holds. In outline:
Assessment Bundle (Solo, or Team): the core compliance frameworks, with Phronesis analysis, export, the Evidence Vault and the Audit Pack.
Third Party Risk Hub: supplier questionnaires, external checks and portfolio tracking, for up to 200 suppliers.
Risk Operations (Solo, or Team): the Assessment Bundle and the Third Party Risk Hub on one subscription.
Specialist assessments (such as PE Due Diligence, SOC Maturity, CMMC and FedRAMP, HIPAA and DCC Readiness): each sold on its own, or as an add-on to the Assessment Bundle at a lower price. One bought on its own renews at the add-on price once you have the Bundle. An add-on doesn't renew if, when it comes up for renewal, you no longer have the Bundle, unless you choose to keep it on its own, at the price for it on its own.
CE One-Shot: one Cyber Essentials assessment and one Phronesis analysis, with 30 days' access to the result.
Free trial: 7 days of the core assessments, with export switched off. It ends by itself and costs nothing.
Limits are there to keep the service fair and running well. If you need more, ask us.
5Prices, payment and VAT
Prices on our website exclude VAT. UK VAT is added at checkout; a business elsewhere that gives a valid VAT number may be charged under the reverse charge instead.
Subscriptions are billed yearly in advance. The CE One-Shot is a single payment.
Online payments are taken by our payment provider, Stripe. We never see or store your full card details. Your invoices are available under Manage billing on My Hub.
The first-year price is for new customers. If your account, or its email address, has paid for a product before, or for a plan that included it, you pay its standard price from the start.
A price arranged with us directly is the price on your order or invoice.
6Renewal
A subscription renews automatically each year, and we charge the payment method on file, unless you cancel before the renewal date. It renews at the standard price then in force, not the first-year price.
If we change a standard price, we will tell you at least 30 days before the renewal it first applies to, so you can cancel first if you wish.
7Cancelling and refunds
You can cancel a subscription at any time, under Manage billing on My Hub (or by asking us, for a plan arranged with us directly). Cancelling stops the next renewal: you keep access until the end of the year you've paid for.
The rest of the current year isn't refunded, and there is no refund for part of a year.
CE One-Shot: we refund it in full if you ask within 14 days of buying and haven't yet run its Phronesis analysis. Once the analysis has run, it isn't refunded.
Moving to a different plan, such as from the Assessment Bundle or the Third Party Risk Hub to Risk Operations: contact us, and we'll credit what's left of your current year towards it.
Nothing in this section affects a refund we give under section 15 when we end the service for a reason that isn't your fault.
8Failed payments
If a renewal payment fails, Stripe tries the payment again, and My Hub shows a notice with a link to update your payment details. Your access continues meanwhile. If the payment is still outstanding 30 days after it fell due, the subscription ends and so does access to it. Your data is kept as described in section 10, so buying again picks up where you left off.
9Teams
A team plan covers its owner and the number of additional seats bought. Online, that is up to 10 additional seats; for a larger team, contact us.
The owner invites members and decides their roles, and is responsible for who they let in. Everyone on the team shares its work, and on Risk Operations, one supplier portfolio.
To change the number of seats, contact us.
If the subscription ends, the team is suspended rather than deleted: its members lose access, its data is kept, and it reopens if the owner buys again.
10Your data
Your content stays yours: your answers, notes, evidence files, reports, and the supplier records you add. You let us host, process and back it up only to provide and support the service, as our Data Privacy Notice describes, including where it is stored and for how long.
Only upload what you have the right to share with us. Don't upload special category personal data, payment card numbers or secrets the service doesn't ask for.
Suppliers. When you add a supplier or send it a questionnaire, you are responsible for having a lawful reason to do so and for the contact details you give. We run checks on a supplier's publicly available information as the Data Privacy Notice describes.
You can export your results while your plan includes export, and ask us at any time to delete your account and its data, as the Data Privacy Notice explains.
11Phronesis and your results
Scores and reports are worked out from your own answers, so they are only as accurate as those answers.
Phronesis, our AI, writes analysis and guidance that can be incomplete or wrong. Check it before you rely on it, and take professional advice where the decision matters.
Security Compliance Hub is a readiness and self-assessment platform. It does not certify, audit or issue an attestation, and a result here is not a certificate, a pass in a regulator's or certification body's assessment, or legal advice.
The frameworks belong to their owners, and are used here to help you assess yourself against them. SOC-CMM is the work of Rob van Os, used under the CC BY-SA 4.0 licence.
12Acceptable use
Don't use the service, or let anyone else use it, to:
break the law, or infringe anyone's rights;
test, probe or get round its security or limits, or access data that isn't yours (unless we have agreed a security test with you in writing);
copy, scrape, resell or rent out the service, or use it to run services for others without an MSP agreement with us;
send supplier questionnaires or notices as spam, or to people you have no business relationship with;
upload malware, or overload or disrupt the service.
13Our intellectual property
The service, its software, question sets, guidance and report designs belong to us or our licensors. While you have access, you may use the service, and use and share the reports and exports it produces for your organisation's own purposes, for example with your auditors, customers, insurers and investors. Nothing in these terms transfers ownership of our intellectual property to you.
14Availability and changes
We work to keep the service available and secure, but can't promise it will always be uninterrupted or free of errors, unless a separate agreement with you sets a service level. We may improve and change the service. We won't materially reduce what a paid plan includes during the period you have paid for.
15Suspension and ending
We may suspend or end access if you seriously or repeatedly break these terms, if a payment is overdue as described in section 8, or if we must to protect the service, its users or their data. We will tell you why, and give you a chance to put things right first unless the risk is urgent.
You can stop using the service at any time, and ask us to delete your account.
If we end a paid plan for a reason that isn't your fault, for example because we stop offering it, we will give you reasonable notice and refund the part of the year you've paid for and won't use.
Sections 10, 11, 13, 16, 18 and 19 continue after these terms end.
16Liability
Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else the law doesn't allow to be limited or excluded.
Subject to that, neither of us is liable to the other for loss of profit, revenue, business, contracts, goodwill or anticipated savings, or for any indirect or consequential loss. We are not liable for the outcome of an audit, certification or regulatory decision, or for a decision you make based on the service.
Subject to that, our total liability to you arising from or in connection with the service, in any year, is limited to the fees you paid us in the 12 months before the event giving rise to the claim.
The free tools and free trial are provided as they are, without any promise about their results.
None of this limits your obligation to pay the fees you owe.
17Changes to these terms
We may update these terms, for example when the service or the law changes. The effective date at the top shows the current version. We will email account holders about a material change at least 30 days before it takes effect; if you don't agree to it, you can cancel before then, as section 7 describes, and the terms you accepted continue until the end of the year you've paid for.
18General
These terms, the Data Privacy Notice and any order form or agreement you sign with us are the whole agreement between us about the service.
Neither of us is responsible for a delay or failure caused by events outside our reasonable control.
You may not transfer your rights under these terms without our agreement; we may transfer ours to a business that takes over the service, and will tell you if we do.
If a court finds part of these terms unenforceable, the rest still applies. Not enforcing a term straight away doesn't mean giving it up.
No one other than you and us has any right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999.
19Law and disputes
These terms, and any dispute about them or the service, are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Before going to court, please tell us about the problem so we can try to resolve it.