Terms of service.

Definitions

In these terms the following words have the meanings given here.

The service

The Platform lets the Customer run a structured information security risk assessment: answer a control questionnaire, generate and review draft risks, record asset values and exposure, apply likelihood and impact ratings, compute risk weight, priority band and annualised loss expectancy, assign owners and treatments, and produce a risk register with an append-only audit trail behind it.

We will provide the Platform with reasonable skill and care, and will make it available in line with the service levels stated on the Order Form or, where none are stated, on a commercially reasonable basis. Planned maintenance is notified in advance where practicable.

We may change how the Platform works. Where a change removes a material function the Customer relies on, we will give notice of at least [GUUT to supply] days and, if the Customer objects, the Customer may terminate the affected subscription and receive a refund of fees paid for the unused period.

What the Platform is not

Zikomo is a tool for conducting and recording risk assessments. It is not a certification, an audit, an audit opinion, an attestation, a statement of regulatory compliance, or legal advice.

Using the Platform, completing a questionnaire within it, or producing a risk register from it does not certify the Customer against ISO/IEC 27001 or any other standard, does not constitute an internal or external audit, and does not demonstrate to any regulator that the Customer is compliant with anything. Certification can be issued only by an accredited certification body, on the basis of its own audit. An audit opinion can be given only by an auditor. Legal advice can be given only by a qualified legal practitioner. GUUT is none of these things and does not act as any of them.

The Customer remains solely responsible for its own risk decisions. The scores, priority bands, loss figures and draft risk statements the Platform produces are the output of a calculation applied to inputs the Customer chose: its own scales, its own asset values, its own likelihood and impact judgements, its own risk appetite. They are an aid to judgement, not a substitute for it. The Customer decides which risks to accept, modify, transfer or outsource, who owns them, and what it tells its board and its regulator. GUUT does not accept risk on the Customer's behalf and cannot do so: under ISO/IEC 27001, residual risk acceptance is the risk owner's act.

The Customer is responsible for the accuracy and completeness of what it enters. A register is only as sound as the assessment behind it, and the Platform cannot know about a risk nobody recorded.

Accounts, Users and security

The Customer may authorise Users up to the number stated on the Order Form. Each User must have a distinct named account. Accounts must not be shared, and credentials must not be issued to anyone who is not a User.

The Customer is responsible for its Users. That means: keeping the User list current and removing access promptly when someone leaves or changes role; ensuring Users keep credentials confidential and use the multi-factor authentication the Platform requires; and the acts and omissions of its Users under the Agreement, as if they were the Customer's own.

The Customer must tell us without undue delay, and in any event within [GUUT to supply] hours, if it suspects a credential has been compromised or an account has been used without authority. We may suspend an account immediately where we reasonably believe it is being used to attack the Platform or to reach another tenant's data, and we will tell the Customer why.

Acceptable use

The Customer and its Users must not: attempt to access another tenant's data or any part of the Platform they are not authorised to reach; probe, scan or test the security of the Platform except under our responsible disclosure process, which is set out on the security page; reverse engineer, decompile or copy the Platform except to the extent the law permits despite this restriction; resell, sublicense or provide the Platform as a service to a third party without our written agreement; upload malicious code, or content the Customer has no right to upload; use the Platform to store personal data it has no lawful basis to process; or use the Platform in a way that damages its integrity or its availability to others.

We may suspend access where use breaches this section and the breach is material or continuing. Where circumstances allow, we will ask the Customer to put it right first.

Customer Data

The Customer owns its Customer Data. Nothing in the Agreement transfers ownership of assessment content to GUUT. The Customer grants us only the licence we need to host, process, back up, display and transmit that content in order to provide the Platform, and to do so for as long as the Agreement runs.

We do not use Customer Data to train, fine-tune or evaluate machine learning models, and we do not share it between tenants. We do not use it to build benchmarks or marketing material unless the Customer asks us to in writing and approves the wording. How we handle personal data within Customer Data, and the processor and controller split, is set out in the privacy notice and in the data processing agreement.

The Customer is responsible for having the right to put into the Platform what it puts in, including any evidence file it uploads.

Intellectual property

GUUT owns the Platform: its software, its scoring engine, its interfaces, its database structure, its documentation, its name and its marks. The Customer receives a non-exclusive, non-transferable right to use it during the term, for its own internal business purposes, and nothing more.

GUUT also owns the Control Guidance: the plain-English explanatory text we author to sit alongside control references, along with our draft risk statements, our question wording and our templates. The Customer may use and reproduce that material internally, including in its own risk register and board papers, but may not publish it, license it onward or sell it.

The text of the ISO standards is the copyright of the International Organization for Standardization and is not reproduced in the Platform. Zikomo refers to control references and clause numbers, and provides GUUT's own description of what a control is asking for. It does not contain the standard's text. Customers who need the standard itself must obtain a licensed copy from ISO or a national standards body. Nothing in the Agreement grants any right in the standards, and nothing in the Platform should be treated as a substitute for reading them.

Where the Customer gives us feedback or suggestions, we may use them to improve the Platform without owing anything for them. Feedback is not Customer Data.

Fees and payment

Fees, the currency, the billing frequency and the payment term are set out on the Order Form. Unless the Order Form says otherwise: invoices are payable within [GUUT to supply] days of the invoice date; fees are exclusive of value added tax, withholding tax and any other duty, which the Customer pays in addition where the law requires; and fees are not refundable except where these terms expressly say so.

We may increase fees at renewal on at least [GUUT to supply] days written notice before the renewal date. We may charge interest on late payment at [GUUT to supply: rate and basis], and may suspend access where an undisputed invoice is more than [GUUT to supply] days overdue, after written warning. Suspension does not delete Customer Data.

Where a Customer adds Users mid-term, the additional fee is charged pro rata for the remainder of the term.

Term, termination and export

The subscription runs for the initial term on the Order Form and renews for successive periods of the same length unless either party gives written notice of at least [GUUT to supply] days before the end of the then current term.

Either party may terminate immediately on written notice if the other commits a material breach and does not remedy it within [GUUT to supply] days of being asked to, or if the other becomes insolvent, enters administration or liquidation, or an equivalent event occurs under the law that applies to it.

Data export on termination. For [GUUT to supply] days after termination or expiry, the Customer may export its Customer Data through the Platform in a machine-readable format, including the risk register, the assessment responses and the audit trail. We will provide reasonable assistance with that export at no additional charge. After that period we delete Customer Data in line with the retention periods in the privacy notice, subject to the separate retention of audit events described there. We will confirm deletion in writing on request. The Customer should not rely on us as its only copy: exporting before the window closes is the Customer's responsibility.

Sections on intellectual property, confidentiality, liability, indemnities and governing law survive termination, along with any obligation to pay fees already due.

Warranties and disclaimers

Each party warrants that it has the authority to enter into the Agreement. We warrant that we will provide the Platform with reasonable skill and care, that we have the right to license it, and that we will not knowingly introduce malicious code into it.

Beyond those warranties, and to the fullest extent the law allows, the Platform is provided as it is. We do not warrant that it will be uninterrupted or error free, that it will meet every requirement the Customer has, that it will detect every risk relevant to the Customer, or that any output will satisfy a particular auditor, certification body or regulator. All conditions and warranties implied by statute or common law are excluded to the extent the law permits their exclusion.

Nothing in the Agreement excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded.

Limitation of liability

Subject to the paragraph immediately above, and to the extent the law allows: neither party is liable for loss of profit, loss of revenue, loss of anticipated savings, loss of business opportunity, loss of goodwill, or regulatory fines imposed on the other party, in each case whether direct or indirect; and each party's total aggregate liability arising out of the Agreement in any twelve month period is limited to [GUUT to supply: cap, commonly expressed as the fees paid in the preceding twelve months].

The Customer accepts that the fees have been set on the basis of this allocation of risk, and that the Platform supports the Customer's risk decisions rather than making them. We are not liable for a decision the Customer took, or failed to take, on the strength of an assessment recorded in the Platform.

[GUUT to supply] · counsel to confirm whether local law caps, or invalidates, any part of this section, and whether a separate higher cap should apply to breach of confidentiality or to a data protection breach.

Indemnities

We will defend the Customer against a third party claim that the Platform, used in accordance with the Agreement, infringes that third party's intellectual property rights, and will pay damages finally awarded or agreed in settlement. If such a claim arises, we may at our option procure the right for the Customer to continue, modify the Platform so it no longer infringes, or terminate the affected subscription and refund fees for the unused period. This indemnity does not apply to a claim arising from Customer Data, from use in breach of the Agreement, or from combination with anything we did not supply.

The Customer will indemnify us against claims arising from Customer Data, including a claim that content it uploaded infringes a third party's rights or was processed without a lawful basis, and from its use of the Platform in breach of section 5.

An indemnity applies only if the indemnified party notifies the other promptly, gives it control of the defence, and cooperates reasonably. Neither party may settle a claim in a way that admits liability for the other without consent.

Confidentiality

Each party may receive information the other treats as confidential, including Customer Data, security documentation, pricing and product roadmaps. Each party will keep the other's confidential information confidential, use it only for the Agreement, and disclose it only to those of its staff and advisers who need it and are bound by equivalent obligations.

These obligations do not apply to information that is public through no breach, that the receiving party already held without restriction, or that it developed independently. Where disclosure is required by law, by a court or by a regulator, the disclosing party may make it, and will tell the other party first where it is lawfully able to.

Confidentiality obligations continue for [GUUT to supply] years after termination, and indefinitely for Customer Data and for anything that is a trade secret.

Governing law and disputes

The Agreement and any dispute arising out of it are governed by the laws of [GUUT to supply: governing law].

The parties will first try to resolve any dispute by escalation: a named contact on each side within [GUUT to supply] days, then a senior executive on each side within a further [GUUT to supply] days. If that fails, the dispute is referred to [GUUT to supply: the courts of a named jurisdiction, or arbitration under named rules, seat and number of arbitrators]. Nothing prevents either party from seeking urgent injunctive relief from any competent court.

[GUUT to supply] · counsel to advise whether a single governing law works across the markets Zikomo sells into, or whether regional variants are needed for customers whose regulator requires local law and local dispute resolution.

General

Neither party may assign the Agreement without the other's written consent, except to a successor of substantially the whole of its business. Neither party is liable for delay caused by an event outside its reasonable control, provided it tells the other and works to resume. If a provision is held unenforceable, the rest stands. A failure to enforce a right is not a waiver of it. The Agreement is the entire agreement between the parties on its subject matter and replaces earlier discussions. No third party may enforce it.

Notices must be in writing to the addresses on the Order Form, and take effect on delivery, or on the next working day if delivered outside working hours.

Changes to these terms

We may update these terms. Where a change is material, we will notify the Customer's nominated administrator in writing at least [GUUT to supply] days before it takes effect. If the Customer objects to a material change, it may terminate the affected subscription before the change takes effect and receive a refund of fees paid for the unused period. Continued use after the effective date means the updated terms apply. The version number and last updated date at the top of this page always show the current text, and we keep previous versions available on request.