These Terms govern your access to and use of the Compliance One website and platform. We've written them to be readable rather than intimidating — but they are still the binding rules, so they're worth a look. By using the service, you agree to them. Together with our Acceptable Use Policy, Privacy Policy, and Data Processing Addendum, they form the full agreement between you and Compliance One.
To keep things clear: the service means the Compliance One website and platform. You (or the customer) means the organisation or person using it. Customer content means the data you upload — your evidence, documents, and records. An order means the plan or agreement under which you subscribe.
Compliance One is a multi-framework governance, risk, and compliance platform. It helps you manage ISO 27001, SOC 2, ISO 42001, ISO 22301, ISO 27701, ISO 27017, HIPAA, PCI DSS, NIS2, the EU AI Act, Singapore’s Cyber Essentials, Cyber Trust and DPTM, and the Philippines DPA from a single control set. We're always improving it, so features may change over time — but we won't materially reduce the core functionality of a paid plan during its term without letting you know.
You're responsible for your account and everything that happens under it, so keep credentials secure and switch on the protections we offer (like multi-factor authentication). Give us accurate details and keep them current. If you spot unauthorised use of your account, tell us promptly so we can help.
Your use of the service must follow our Acceptable Use Policy, which is part of these Terms. In short: use it for its intended purpose, don't try to break or abuse it, and don't use it to harm others or break the law.
You own your customer content. We don't claim it, sell it, or use it to train AI models. You simply grant us the limited permission we need to host, process, and secure it in order to provide the service. We handle it as described in our Privacy Policy and, for personal data, our Data Processing Addendum.
We own the platform itself — the software, design, and content we create (except your customer content and any open-source components under their own licences). These Terms don't transfer that ownership to you; they grant you the right to use the service while your subscription is active.
If you send us ideas or suggestions, thank you — we love those. You grant us a free, perpetual right to use that feedback to improve the service, with no obligation to you. It never gives us any rights over your customer content.
We may offer trials, proofs of concept, or beta features. These are provided as is, may change or be withdrawn, and can carry different terms we'll tell you about. Evaluate them, but don't rely on a beta feature for a production obligation until it's generally available.
Paid plans are billed as set out in your order. Our pricing is based on the frameworks you run, not per-seat, so your bill doesn't balloon as your team grows. Fees are non-refundable except where the law requires otherwise or your order says so, and we'll give you notice before any renewal price change so there are no surprises.
The service connects to other tools you choose — for example your cloud provider or identity system — to collect evidence. Those integrations are governed by the third party's own terms, and we're not responsible for their services. We only access what you authorise, and only to do the job you asked us to.
We take our own security seriously. Our programme is built to align with the information-security and AI frameworks we support, we host on AWS with a choice of three data regions (EU, US, and Asia-Pacific), and we isolate each organisation's data. The specifics live in our Security Policy, Privacy Policy, and DPA, and enterprise customers can request our current security documentation.
We'd love to mention that you're a customer (name and logo) in our marketing, but we'll only do so with your permission, and we'll stop if you ask.
We work hard to keep the service reliable, accurate, and available. But the service supports your compliance programme — it doesn't itself guarantee that you'll pass an audit or satisfy a regulator; that depends on the work you do with it. To the extent the law allows, the service is provided as is, and our liability is limited as set out in your agreement with us. Nothing here limits liability that can't legally be limited.
You may not use the service if you're barred from doing so under applicable export-control or sanctions laws, and you agree not to use it in violation of them.
You can stop using the service at any time. We may suspend or end access if these Terms are seriously breached — but we'll act reasonably and, where appropriate, give you a chance to fix the problem first. When your subscription ends, you'll have a reasonable window to export your data before we delete it, as described in the DPA.
If we update these Terms, we'll change the date above and, for material changes, give reasonable notice rather than editing quietly. Continuing to use the service after a change means you accept the updated Terms.
If any part of these Terms is found unenforceable, the rest still applies. Our not enforcing a right isn't a waiver of it. You may not assign these Terms without our consent; we may assign them to an affiliate or in connection with a merger or sale. Neither party is liable for delays caused by events beyond its reasonable control (force majeure).
For enterprise customers, the governing law and dispute-resolution venue are set out in your order form or master agreement, which take precedence over this section. Otherwise, these Terms are governed by the applicable law of the jurisdiction in which Compliance One operates, applied in good faith.
If anything here is unclear, we'd genuinely rather you ask than guess. Email hello@complianceonecloud.com.