Support policy
Effective from · All documents
How to reach us
Email [email protected] from an address on your organisation’s account. Say what you were doing, what you expected, what happened, and how urgent it is using the severities below. We may ask you to confirm a request through an authorised user before acting on anything that changes your data or your account.
Hours
Support is staffed on business days, 09:00 to 17:00 Australian Eastern Standard Time (Brisbane; no daylight saving), excluding Queensland public holidays. A request received outside those hours is treated as received at the start of the next business day, except a severity 1 request, which we watch for at all hours and act on as soon as it is seen.
Severities and response
| Severity | Means | We respond within | We aim to resolve or work around within |
|---|---|---|---|
| 1 | The service is unavailable to your organisation, or you have reason to believe your data has been altered, lost or exposed | 4 hours, any time | 1 business day |
| 2 | A function you rely on is broken or wrong and there is no workaround; posture, decisions or evidence are misreported | 1 business day | 3 business days |
| 3 | Anything else: a defect with a workaround, a question, a request | 3 business days | As agreed with you |
Response means a person has read the request, confirmed the severity or told you why it is different, and said what happens next. Resolution targets are what we aim for, not a guarantee; where we will miss one we say so before the time passes, not after.
What support covers
- Using the service: navigation, scopes, projections, decisions, evidence pointers, exports.
- Getting your content in: workbook and register mappings, the connectors the service supports, and what to do when ingestion reports a problem.
- Identity: connecting your identity provider. The service is bring-your-own-identity only; there are no local accounts or passwords, and we cannot create one.
- Defects: anything the service does that its documentation says it should not, or fails to do that its documentation says it should.
- Your data: retention settings, exports, deletion, and the requests described in the data processing agreement.
What support does not cover
Support is help with the product. It is not an assessment of your posture, and it does not produce findings, recommendations or documents for you. The service is a tool you run on yourself; we help your people run it and we never produce the answers as a deliverable, because that would be consultancy. If you want that kind of help, it is a separate engagement with someone else, and our independence policy says why.
Support also does not cover your own systems, your identity provider’s configuration beyond what the service needs, or content you have removed or replaced yourself.
Maintenance and incidents
Planned maintenance that will interrupt the service is announced by email to your security contact at least 2 business days ahead and done outside business hours where we can. Unplanned interruptions and security incidents are handled as the service levels and data processing agreement set out.
Escalation
If a response is late or you disagree with how a request is being handled, say so on the same thread and ask for it to be escalated. It goes to the person accountable for the service, who takes it up personally within 1 business day.
Changes
We update this policy as the service evolves, by publishing a new text with a new “Effective from” date; that date at the top is the date the text applies from and says which text applies, and the current text stays in force until the replacement is published. This page is part of the terms of service, and their Changes section applies to it: before we publish a change we send your security contact the full proposed text at least 30 days ahead with the publication date, and a change that is materially adverse to you carries the termination right set out there. Monitor this page for the latest text; earlier texts are available on request.
— Get Frank Pty Ltd