Terms of service

Who we are

Get Frank is provided by Get Frank Pty Ltd, a company registered in Queensland, Australia. Its ACN is 703 155 757. “We” and “us” mean that company.

Acceptance

By using Get Frank you accept these terms on behalf of the organisation you represent. If you do not have authority to do so, do not use the service.

These terms include the data processing agreement, the sub-processors and hosting page, the service levels, the support policy and the continuity and exit page. Each carries the date it applies from, shown at the top as “Effective from”, and the published text applies; the section on changes below says how they are updated.

What the service is

Get Frank is an assurance posture system — a system of record for time-bounded confidence claims. It is not a certifying body. It does not issue certificates. It does not guarantee compliance with any framework or regulation. The service surfaces what is true and what is assumed; the responsibility for acting on that truth remains yours.

What the service is not

The service is not legal advice, audit advice, or a substitute for qualified professional review. Outputs are designed to be defensible — that is, traceable to evidence, scope, and known limitations — but defensibility is not the same as a regulatory pass.

Acceptable use

You will not use the service to mislead a board, regulator, customer, or auditor. We reserve the right to terminate any account used to manufacture appearances of compliance that are not supported by evidence.

You also will not misuse the service — including attempting to gain unauthorised access to it or to another customer’s data, interfering with its security or availability, probing or scanning it without our written consent, or using it for any unlawful purpose. We may investigate suspected abuse and suspend or terminate access to protect the service and its users.

Preview features

Where we mark a feature in the service as a preview, it is offered as it stands, without the commitments in the service levels, and we may change it substantially or withdraw it. Do not rest a claim to a board, regulator, customer or auditor on a preview feature alone. We tell your security contact when one becomes a standard part of the service. Withdrawing a preview never removes a record your organisation has already made with it: that record stays in your assurance history and in your export.

Access and identity

The service is bring-your-own-identity. Your users sign in through your organisation’s identity provider; there are no local accounts and no passwords, and we cannot create one. You control who in your organisation can reach the service and with what role, and you are responsible for what those users do in it. Tell us without delay if you believe a credential or session has been compromised.

Your security contact

Your organisation keeps a security contact in the service’s settings: one email address, to which we send every notice these terms and the documents they include promise you. It starts as the address of the person who opened your organisation’s account, and an owner or administrator of your organisation can change it. It can be a shared mailbox, and it can sit outside your organisation, with a security provider you engage, for example. A new address takes effect only when someone reading it follows the confirmation link we send there, and the address it replaces is told what changed, when and by whom. Keep it current: a notice we send to the security contact in force when we send it is notice to you.

Your security contact receives notices. Beyond that it is not authority over your organisation’s content: being your security contact, or being named by it, does not entitle anyone to receive that content or to act for your organisation in the service, except in the two cases the continuity and exit page sets out, where nobody at your organisation can sign in to fetch its export while its access is suspended or after we give notice that we are ceasing to trade. Who acts for your organisation is yours to control, as Access and identity above sets out.

Fees

Fees are charged for active scopes under assurance and additive projections beyond the baseline, in line with our published pricing. Paid plans may be subject to a separate signed agreement that overrides this section. We do not charge per user. We do not meter activity. Honest self-reporting does not increase fees.

If an invoice is unpaid 14 days after it falls due, we tell your billing contact and your security contact. If it is still unpaid 14 days after that, we may suspend your organisation’s access to the service until it is paid, and if it is unpaid 60 days after it fell due, we may terminate under Termination. Suspension does not cut you off from your records: while access is suspended you can still request the complete export, and we deliver it as the continuity and exit page sets out, whether or not the invoice has been paid.

Our bank and payment details never change by email alone. If you receive a request to pay us to different details, confirm it with us by phone on a number you already hold for us before you pay.

Your data

Your data stays yours. You keep every right you hold in the files, records, and content your organisation puts into the service. You grant us only the licence we need to host, process, and display that content in order to deliver the service to you, keep it secure, and meet our legal obligations.

How we handle personal information in your content is set out in the data processing agreement, which forms part of these terms.

What you upload can carry personal information about people who are not our users — a supplier’s contact, the owner of a risk, the person an incident concerns. That information is yours to account for, and what you warrant about it each time you supply it is set out under your obligations in the data processing agreement. Our privacy notice sets out what they can expect of us and directs them back to you. Where one of them asks us for access or correction, we will tell them you hold the record and let you know they asked.

Do not upload sensitive information as the Privacy Act 1988 (Cth) defines it. The service is not built to hold it. Where it reaches us regardless, tell us; what we then do with it is set out in the data processing agreement.

We do not sell your data. We do not use it to train machine-learning models, and we do not use one customer’s content to build or improve anything for another. Where we measure how the service is used — which features get used, where things fail, how long work takes — those measurements come from application events rather than from the content you upload, and we use them to improve the service for everyone who uses it. They are aggregated, and they identify neither you nor your organisation.

Our intellectual property

The service — the software, the assurance model it implements, the interface, the design system, and the documentation — remains ours or our licensors’. These terms give you the right to use the service, not any ownership of it. You will not copy it, reverse-engineer it, or build derivative works from it, except where the law gives you that right despite this clause.

What the service produces from your data — your posture records, decisions, claims, and exports — is yours to use as you see fit, including with your auditors, customers, and regulators. Where an output carries material that is ours or a third party’s, such as framework text or the structure of the assurance model itself, you get the right to use that material as part of the output. Ownership of it does not pass to you, and it stays subject to the section above.

If you send us feedback or suggestions, you give us a perpetual, worldwide, royalty-free licence to use them to improve the service, with no obligation or payment to you. That covers the idea, not your data: where feedback carries your files or records, those remain governed by Your data above.

Retention, backups, and your own records

Frank references your systems of record; it does not become one. The contents of a file you upload are a transit artefact: we hold them so ingestion can be replayed without asking you to resubmit everything. Once your configured retention window passes — 30 days by default, 365 at the most — they become eligible for removal and are erased by a cleanup that runs daily. The record of the upload, including its name, size, content hash, and column mapping, is part of your assurance history and is kept. Keep your own copy of every source file; the service is not a store for it.

Erasure removes data from the service’s active storage. Copies in database backups persist until the backup is deleted, on the terms set out in our privacy notice. We give no warranty that data can be recovered from a backup: restoration is a recovery measure for us, not an export route for you.

Service levels and support

What we commit to on availability, maintenance, backups and incidents is in the service levels; how to get help and how quickly we respond is in the support policy. Both are stated for the design-partner phase and say so.

Termination

You may terminate at any time by written notice. Termination takes effect at the end of the billing period in which 30 days from our receiving the notice end, or on a later date you name in it. You pay for that period and nothing after it. Where a separate signed agreement sets a fixed term, that agreement says how the term ends.

We may terminate without cause by written notice to your security contact, taking effect no sooner than 90 days after we send it. Your posture history is a record other people rely on, and moving it takes longer than switching off a tool.

Either party may terminate by written notice, taking effect when it is given, if the other:

• commits a material breach of these terms and does not remedy it within 14 days of being told of it in writing, or commits a material breach that cannot be remedied; or
• becomes insolvent, has a liquidator, administrator, receiver or manager appointed over it or any of its assets, or enters into an arrangement with its creditors, other than for a solvent restructure.

Termination for a reason you did not choose the timing of, or that is ours, does not wait for the end of a billing period. That covers termination by you under the paragraph above, under Events outside our control or Transfer, or over a change under Changes, each of which takes effect when your notice is given or on a later date you name in it, and termination by us without cause. Where one of these takes effect part-way through a billing period you have paid for, we refund the fees for the rest of that period. We make no refund where we terminate for your breach, your insolvency or non-payment.

On termination, you have 30 days from the date termination takes effect to request the complete export of your assurance records, which we deliver within that window. We delete or de-identify what we hold within 30 days of that window closing, subject to backup expiry and to anything we are required by law to keep. How the export works, and what happens if we cease to trade, is in continuity and exit.

Liability

To the extent permitted by law, our aggregate liability is limited to the fees paid in the 12 months preceding the claim, or AUD 1 if no fees have been paid.

Neither party is liable to the other for loss of profit, revenue, savings or goodwill, for the cost of business interruption, or for any indirect or consequential loss, however it arises. Nor are we liable for the outcome of an audit, certification, tender or regulatory review that relied on the service: as What the service is not says, what the service records is your organisation’s account of its posture, and the judgement made on it is the reviewer’s. This paragraph does not limit fees you owe us or your liability under Your indemnity.

Where the Australian Consumer Law gives you a guarantee that cannot be excluded, these terms do not exclude it. The service is not of a kind ordinarily acquired for personal, domestic or household use, so to the extent the law allows, our liability for failing to meet such a guarantee is limited, at our option, to supplying the service again or paying the cost of having it supplied again.

Nothing in these terms excludes or limits liability for fraud or wilful misconduct, or any other liability that cannot lawfully be excluded or limited.

Your indemnity

You indemnify us against loss and costs, including reasonable legal costs, arising from a claim by a third party that the content your organisation supplied to the service infringes their rights or was supplied in breach of the warranty in the data processing agreement, or that arises from your organisation’s use of the service in breach of Acceptable use. The indemnity does not extend to loss to the extent we caused or contributed to it. We tell you promptly of any such claim, let you conduct its defence at your cost, settle nothing in your name without your consent, and take reasonable steps to keep the loss down.

Events outside our control

Neither party is liable for a failure or delay in meeting these terms caused by an event beyond its reasonable control, for as long as the event lasts and provided it takes reasonable steps to limit its effect. A failure of one of our own providers is not such an event unless it is caused by one: we chose them, and the sub-processors and hosting page is ours to answer for. Such an event does not excuse paying what is owed, and it does not excuse telling you: the notices the service levels and the data processing agreement promise still go out, as soon as the event allows. If an event stops the service for more than 30 consecutive days, either party may terminate by written notice.

Transfer

We may transfer these terms, with the documents they include, to an entity that takes over the service as part of a sale, merger or restructure. We tell your security contact at least 30 days before the transfer, naming the entity. The entity takes these terms on as they stand, including where your content is held, and any later change to them is made as Changes below sets out. If you do not want to continue with that entity, you may terminate by written notice given before the transfer, and Termination applies as if we had terminated.

You may transfer these terms only with our written consent, which we will not unreasonably withhold, for example where your organisation restructures and the service passes to the entity that continues its operations.

Notices

A notice to us under these terms is given by email to [email protected]. It is given when it reaches that mailbox, or on the next business day in Queensland if it arrives outside business hours there. A notice to you is given as Your security contact above sets out.

Changes

We update these terms and the documents they include as the service evolves, by publishing a new text with a new “Effective from” date. That date, at the top of each, is the date the text applies from and says which text applies. The text published at any time is the text in force: publishing a change is what brings it into effect, so the current text stays in force until the replacement is published. Monitor these pages for the latest text; earlier texts are available on request.

Before we publish a change to these terms or to any document they include, we send your security contact the full proposed text at least 30 days ahead, with the date on which we will publish it. The exceptions are a change that only adds to what we commit to you, corrects an error without changing the substance, or is required by law, which we may publish at once and tell you about when we do.

If a change is materially adverse to you, you may terminate by written notice given before it is published, without penalty, and the change does not apply to you during your export window under Termination. The sub-processors and hosting page carries its own objection right on the same footing.

General

If a court finds any part of these terms unenforceable, that part is read down as far as is needed to make it enforceable, or severed if it cannot be, and the rest of these terms continues to apply. Nothing in these terms makes either party the partner, employee, agent or joint venturer of the other. Where these terms say “including” or “for example”, what follows illustrates and does not limit.

Governing law

These terms are governed by the laws of Queensland, Australia. Disputes are subject to the exclusive jurisdiction of the courts of Queensland, Australia.

— Get Frank Pty Ltd