Terms of Service

1. Definitions

In these Terms, the following words have the following meanings:

2. The Service

VigilantGRC provides a cloud-based governance, risk and compliance (GRC) platform that enables organisations to identify, assess, manage, and report on operational and enterprise risks, audit findings, and compliance obligations. The specific features and modules available to the Customer are as specified in the relevant Order Form or subscription tier.

We may, from time to time, update, enhance, or modify the features and functionality of the Service. We will endeavour to give reasonable advance notice of any changes that materially reduce existing functionality. Where such changes are made to comply with applicable law or to address security vulnerabilities, we may implement them without advance notice.

Access to the Service is provided on a software-as-a-service (SaaS) basis. No software is delivered to or installed on the Customer's systems. VigilantGRC retains all rights in and to the Service and its underlying technology.

3. Accounts and access

Account registration. To access the Service, you must register for an account and provide accurate, complete, and current information. You agree to keep your account information up to date. Accounts are for business use only and may not be created by or for individuals under 18 years of age.

Authorised Users. The Customer may permit Authorised Users to access the Service up to the number specified in the Order Form. The Customer is responsible for ensuring that Authorised Users comply with these Terms and must promptly de-provision access for any user whose employment or engagement ends.

Account security. You are responsible for maintaining the confidentiality and security of all account credentials. You must not share credentials between users. You must notify us immediately at support@vigilantgrc.com if you become aware of or suspect any unauthorised access to or use of your account.

Enterprise SSO. Enterprise plan customers may configure single sign-on (SSO) integration. The Customer is responsible for the configuration and security of their identity provider. VigilantGRC is not liable for access issues arising from Customer-side SSO misconfigurations.

4. Subscriptions and payment

Subscription tiers. The Service is available on subscription tiers as described on our website or in an Order Form. Each tier specifies the features available and the maximum number of Authorised Users. Exceeding limits may require an upgrade.

Fees. Subscription fees are as set out in the Order Form or our published pricing page. Unless otherwise stated, fees are charged in GBP (£), exclusive of VAT and other applicable taxes, which will be added at the prevailing rate. For invoiced customers, payment is due within 30 days of the invoice date.

Automatic renewal. Subscriptions renew automatically at the end of each Subscription Term for a further term of equal length, unless either party gives written notice of non-renewal at least 30 days before the renewal date. We will send a renewal reminder at least 45 days in advance.

Price changes. We may adjust subscription fees by giving the Customer at least 60 days' written notice before the next renewal date. Continued use of the Service after such notice constitutes acceptance of the new pricing.

Late payment. Amounts outstanding beyond the payment due date may accrue interest at a rate of 4% per annum above the Bank of England base rate, compounded monthly. We reserve the right to suspend access to the Service upon 14 days' written notice if fees remain unpaid, without this affecting our right to claim the outstanding amount.

Refunds. All fees are non-refundable except as expressly required by law, or as otherwise agreed in writing. Where a paid subscription is cancelled mid-term by the Customer (other than for our material breach), no refund is due for the remainder of the term.

Free trials. We may offer free trials of the Service. At the end of a free trial, access will cease unless the Customer converts to a paid subscription. We reserve the right to modify or discontinue free trials at any time without notice.

5. Acceptable use

The Customer and its Authorised Users agree to use the Service only for lawful purposes and in accordance with these Terms and our Acceptable Use Policy. The following are expressly prohibited:

• Using the Service for any unlawful purpose, or in a manner that violates any applicable local, national, or international law or regulation.
• Uploading, transmitting, or distributing any content that is defamatory, obscene, threatening, fraudulent, or that infringes any third-party intellectual property or privacy right.
• Attempting to gain unauthorised access to any part of the Service, its underlying systems, or the data of other customers.
• Conducting any penetration test, vulnerability scan, or security assessment of the Platform without prior written consent from VigilantGRC.
• Reverse engineering, decompiling, disassembling, or otherwise attempting to derive the source code of the Service, except to the extent expressly permitted by applicable law.
• Removing, obscuring, or altering any copyright, trademark, or other proprietary notice displayed on or within the Service.
• Reselling, sublicensing, or making available the Service to third parties unless expressly authorised in the Order Form.
• Using the Service to transmit unsolicited commercial communications, spam, or phishing content.
• Introducing malicious code, viruses, Trojan horses, or other harmful content into the Service.
• Scraping, crawling, or using automated means to extract data from the Service beyond the scope of any documented API.
• Using the Service in a manner that places disproportionate load on our infrastructure or impairs performance for other customers.

We reserve the right to suspend or terminate access immediately if we determine, in our reasonable discretion, that a breach of this section has occurred or is likely to occur.

6. Customer Data and your content

Ownership. As between the parties, the Customer retains all ownership rights in and to Customer Data. Nothing in these Terms transfers any intellectual property rights in Customer Data to VigilantGRC.

Licence to process. The Customer grants VigilantGRC a limited, non-exclusive, worldwide licence to host, store, process, transmit, and display Customer Data solely as necessary to provide the Service and comply with these Terms. This licence terminates when the Customer's subscription ends or the relevant data is deleted.

Customer responsibility. The Customer is solely responsible for the accuracy, legality, and appropriateness of all Customer Data. The Customer warrants that it has all necessary rights and consents to provide Customer Data to VigilantGRC for processing through the Service.

Prohibited content. The Customer must not upload Customer Data that contains special category personal data (as defined under UK GDPR) unless a separate Data Processing Agreement (DPA) has been agreed with VigilantGRC covering such data, or unlawful content of any kind.

Data backup. While we implement commercially reasonable backup procedures, the Customer is responsible for maintaining its own backups of Customer Data. We are not liable for loss of Customer Data caused by Customer actions, software bugs, or force majeure events.

Data export. The Customer may export Customer Data at any time during the active Subscription Term using the export features of the Platform. We provide Customer Data in standard formats (CSV, JSON, or PDF as applicable). Following termination, we will retain Customer Data for 30 days to allow export, after which it will be securely deleted unless a longer period is required by law.

7. Confidentiality

"Confidential Information" means any information disclosed by one party to the other under or in connection with these Terms that is identified as confidential or that reasonably should be understood to be confidential given its nature and the circumstances of disclosure. Customer Data is the Customer's Confidential Information. Pricing, product roadmaps, and non-public technical architecture are VigilantGRC's Confidential Information.

Each party agrees to: (a) hold the other party's Confidential Information in strict confidence; (b) use it only for the purposes of these Terms; and (c) not disclose it to any third party except to its employees, contractors, or professional advisers who have a need to know and are bound by obligations of confidentiality at least as protective as those in this clause.

These obligations do not apply to information that: (i) is or becomes publicly known through no act or omission of the receiving party; (ii) was lawfully known to the receiving party before disclosure; (iii) is independently developed by the receiving party without use of the Confidential Information; or (iv) must be disclosed by law or court order, provided that the receiving party gives prompt prior written notice to the disclosing party where permitted.

These confidentiality obligations survive termination of these Terms for a period of five (5) years.

8. Intellectual property

VigilantGRC IP. All intellectual property rights in and to the Service — including the Platform software, code, architecture, user interface designs, trademarks, logos, brand names, domain names, databases, and Documentation — are and shall remain the exclusive property of VigilantGRC or its licensors. Nothing in these Terms transfers any ownership of such rights to the Customer.

Licence grant. Subject to these Terms and payment of applicable fees, VigilantGRC grants the Customer a limited, non-exclusive, non-transferable, revocable right to access and use the Service solely for the Customer's internal business purposes during the Subscription Term.

Feedback. If the Customer provides any suggestions, ideas, enhancement requests, or other feedback relating to the Service ("Feedback"), VigilantGRC may use such Feedback freely without any obligation of compensation, attribution, or confidentiality. The Customer irrevocably assigns to VigilantGRC all rights in any Feedback provided.

Third-party components. The Service may incorporate open-source software or third-party components subject to separate licence terms. VigilantGRC maintains a list of material third-party components and their licences, available upon reasonable written request.

9. Data protection

Each party shall comply with all applicable data protection laws in connection with its activities under these Terms, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Where VigilantGRC processes personal data contained within Customer Data on behalf of the Customer, VigilantGRC acts as a data processor and the Customer acts as the data controller. In such cases, the parties' respective rights and obligations are governed by a separate Data Processing Agreement (DPA), which forms part of the agreement between the parties and is incorporated into these Terms by reference.

For personal data that VigilantGRC processes for its own purposes in connection with providing the Service (such as account and billing data), VigilantGRC acts as a data controller and its processing is governed by its Privacy Policy.

Each party shall promptly notify the other of any personal data breach affecting the other party's data, and shall provide reasonable cooperation to assist with any required notifications to supervisory authorities or affected individuals.

10. Service availability and support

Uptime target. VigilantGRC targets 99.5% monthly uptime for the Platform, excluding scheduled maintenance windows. Planned maintenance will be communicated at least 48 hours in advance via our status page and in-platform notifications, and will be scheduled outside peak business hours (09:00–18:00 UK time, Monday–Friday) wherever possible.

Support. VigilantGRC provides technical support to Authorised Users via email and our in-platform help centre. Response time targets depend on the subscription tier. Enterprise plan customers receive priority support with defined response SLAs as set out in the Order Form.

Status page. We maintain a public status page at status.vigilantgrc.com where Customers can monitor real-time platform availability and subscribe to incident notifications.

Unplanned outages. In the event of an unplanned service outage exceeding 4 consecutive hours, we will provide an incident update within 2 hours of detecting the outage. Customers eligible for service credits under their Order Form may claim credits as specified therein.

11. Warranties and limitation of liability

VigilantGRC warrants that: (a) it has the right to enter into these Terms and to grant the licences herein; (b) it will perform the Service with reasonable skill and care; and (c) the Service will, in all material respects, operate in accordance with the Documentation.

Customer warrants that: (a) it has the right to enter into these Terms; (b) it will comply with all applicable laws in its use of the Service; and (c) Customer Data does not violate any third-party rights or applicable law.

Nothing in these Terms limits or excludes either party's liability for: (i) death or personal injury caused by its negligence; (ii) fraud or fraudulent misrepresentation; (iii) any liability that cannot be limited or excluded by applicable law; or (iv) the Customer's obligation to pay fees properly due under these Terms.

12. Termination

Termination for convenience. Either party may terminate the subscription at the end of the then-current Subscription Term by giving notice of non-renewal as set out in clause 4. During the Subscription Term, either party may terminate for convenience on 90 days' written notice to the other party, unless the Order Form specifies otherwise.

Termination for cause. Either party may terminate these Terms immediately by written notice if the other party: (a) commits a material breach that is incapable of remedy; (b) commits a material breach that it fails to remedy within 30 days of written notice specifying the breach; or (c) becomes insolvent, enters administration, or makes any arrangement with creditors.

Effect of termination. On termination or expiry for any reason: (a) all licences granted under these Terms immediately cease; (b) the Customer must cease all use of the Service; (c) each party must return or destroy the other's Confidential Information; and (d) any accrued payment obligations survive termination.

Customer Data on termination. Following termination, the Customer may export Customer Data within a 30-day window. After that period, VigilantGRC will permanently delete Customer Data from its systems, except as required by law. We will provide written confirmation of deletion on request.

Survival. The following clauses survive termination: Definitions, Customer Data (ownership provisions), Confidentiality, Intellectual Property, Limitation of Liability, Governing Law, and any accrued rights or liabilities.

13. Governing law and dispute resolution

These Terms and any dispute or claim arising out of or in connection with them or their subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.

Before initiating formal proceedings, the parties agree to attempt to resolve any dispute in good faith through escalation to senior management for a period of at least 30 days from the date on which one party notifies the other of the dispute in writing.

If the dispute is not resolved through good-faith negotiations, both parties irrevocably submit to the exclusive jurisdiction of the courts of England and Wales. For enterprise customers whose Order Form specifies an alternative jurisdiction, the Order Form prevails.

14. General provisions

Entire agreement. These Terms, together with any Order Forms, the DPA, and any policies incorporated by reference, constitute the entire agreement between the parties in relation to the subject matter and supersede all prior agreements, representations, and understandings, whether written or oral.

Amendments. We may update these Terms from time to time. We will provide at least 14 days' notice of material changes by email or in-platform notice. Continued use of the Service after the effective date constitutes acceptance of the revised Terms. For changes materially adverse to the Customer, the Customer may terminate the subscription within that 14-day period without penalty.

Assignment. The Customer may not assign or transfer any rights or obligations under these Terms without our prior written consent. VigilantGRC may assign its rights and obligations to any affiliate or in the context of a merger, acquisition, or sale of all or substantially all of its assets, provided the assignee assumes all obligations under these Terms.

Force majeure. Neither party shall be liable for any failure or delay in performing its obligations under these Terms to the extent that such failure or delay is caused by circumstances beyond its reasonable control, including but not limited to acts of God, war, terrorism, pandemic, government action, cyber-attacks by third parties, or failure of the internet backbone. The affected party shall promptly notify the other and use reasonable endeavours to resume performance.

Severability. If any provision of these Terms is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall continue in full force and effect.

Waiver. No failure or delay by either party to exercise any right or remedy under these Terms shall operate as a waiver of that right or remedy. A waiver of any breach shall not be deemed a waiver of any subsequent breach.

Notices. All legal notices under these Terms must be in writing and sent by email to the addresses specified in the Order Form, or by recorded post to the registered address. Notice by email is deemed received on the next business day after sending, provided no delivery failure notification is received.

Anti-bribery. Both parties shall comply with all applicable anti-bribery and anti-corruption legislation, including the Bribery Act 2010, and shall not engage in any activity, practice, or conduct that constitutes an offence under such legislation.

Third-party rights. These Terms do not confer any rights on third parties under the Contracts (Rights of Third Parties) Act 1999, unless expressly stated.

Relationship of the parties. The parties are independent contractors. Nothing in these Terms creates any partnership, joint venture, agency, employment, or franchise relationship between the parties.