Continuity and exit

The principle

Your assurance history is yours, and it is only useful if it survives us. Get Frank references your systems of record rather than becoming one, so the thing you would lose if we disappeared is not your evidence, which stays where it always was, but the record of scope, decisions, confidence windows and pointers that ties it together. This page says how that record leaves the service, in three situations.

At any time

The registers you supplied, the statement of applicability workbook and the risk, incident and other registers you loaded, are yours and stay where you keep them. The service holds what it read from them, each observation with a pointer back to the row it came from, and never the only copy. The bytes of a file you uploaded are not part of any export after their retention window has passed, so keep your own copy of every source file; the service is not a store for it.

What the service holds for your organisation, every record with its identifiers, timestamps, provenance pointers and decision history, the statement of applicability and coverage rollup among them as data, leaves as one complete export in a documented JSON structure, available for your continuity planning. The service produces it when we start it, and an owner of your organisation fetches it from their own session; we never handle it as a file. It is provided on request, at most once a year outside termination, and delivered within 20 business days. The structure is the service’s own data model, so the export is readable without the service, and it carries the date it was taken.

On termination

Whichever party terminates, and for whatever reason, you have 30 days from the date termination takes effect to request the complete export, which we deliver within that window. When the window closes we delete or de-identify everything we hold for you within 30 days, except what the law requires us to keep. Backup copies are gone within seven days after that, the nightly dumps because we delete them and the point-in-time backups at the end of the hosting provider’s seven-day retention, so no copy remains later than 37 days after the export window closes.

If we cease to trade

If Get Frank Pty Ltd decides to stop providing the service, or becomes unable to, we give every customer at least 30 days’ written notice at its security contact, or as much notice as the circumstances allow if it is less, and say why. During that period the service keeps running, and we produce the complete export for every customer whether or not they ask. The notice tells your security contact that it is ready, where an owner of your organisation fetches it, and that an export can be fetched until the last day of service: each one can be fetched for 14 days after it is produced, and we produce a fresh one before it expires for as long as the service runs. If your organisation has fetched none a week before one expires, we remind your security contact. If nobody at your organisation can sign in to fetch it, If nobody can sign in below applies. The notice period takes the place of the 30 days after termination described above, so the last day of service is the last day an export can be fetched. On the next business day we delete everything we hold for every customer, except what the law requires us to keep, and the last backup copy is deleted within seven days after that.

An export is fetched by an owner of your organisation from their own session. In two cases we also give that access to someone your organisation names: while your organisation’s access is suspended under the terms of service, and after we have given notice that we are ceasing to trade. In either case, if nobody at your organisation can sign in to fetch the export, your security contact tells us who is to be given access to fetch it, whether that is whoever holds the address or someone else. The address is the authority: we confirm the request by a message we send to it, and check no one’s identity or position. If the address cannot be reached or nobody answers at it, whoever shows they control your organisation’s domain, by adding to its DNS a record we give them, has the same say. Naming someone gives them access to fetch the export and nothing more, and that access ends when the newest export expires. It leaves any role they already hold in the service as it was. While your organisation’s access is suspended, though, nobody there can reach anything in the service but the export, whatever role they hold.

An export is a snapshot

An export preserves your record, not your posture. Every confidence window in it keeps expiring on its own date whatever happens to the service or to us (see the service levels), so an export is your posture as of the day it was taken and starts going stale from that moment, exactly as the service would show. That is not a limitation of the export; it is what makes it honest.

Changes

We update this page as the service evolves, by publishing a new text with a new “Effective from” date; that date at the top is the date the text applies from and says which text applies, and the current text stays in force until the replacement is published. This page is part of the terms of service, and their Changes section applies to it: before we publish a change we send your security contact the full proposed text at least 30 days ahead with the publication date, and a change that is materially adverse to you carries the termination right set out there. Monitor this page for the latest text; earlier texts are available on request.

— Get Frank Pty Ltd