INKASEC LTD
Security Questionnaire Response Service
Terms and Conditions of Service

Background

1. INKASEC Ltd provides an online service that assists business customers in responding to third-party security questionnaires and assessing the completeness of their information security documentation by analysing the documentation supplied by the customer and producing draft responses and gap analyses (the "Service").
2. The Service may also be used to assist in responding to cyber-insurance application and renewal questionnaires. The customer acknowledges that a completed insurance questionnaire forms a legal warranty to an insurer and that clause 6A (Cyber-Insurance Questionnaires) applies to any such use.
3. The Service compares a customer's documentation against the expected elements of recognised frameworks. It is a documentary assessment service. It is not an audit, a certification, a penetration test, or any form of assurance that a security control actually operates or is effective. Clause 11 (Nature and Limits of the Service) applies to the whole of these Terms.
4. By accepting these Terms (including by clicking to accept before uploading any documents), you agree to be bound by them. If you do not agree, you must not use the Service.
5. You must be at least 18 years old and authorised to bind the organisation on whose behalf you use the Service.

1. Definitions and Interpretation

1. In these Terms, unless the context requires otherwise:

• "INKASEC", "we", "us", "our" means INKASEC Ltd, a company registered in England and Wales (company number 10566243), with its registered office at 138 Deans Lane, Edgware, HA8 9NR, United Kingdom.
• "Customer", "you", and "your" mean the organisation and the individual who accepts these Terms on its behalf and purchases or uses the Service.
• "Authorised User" means an individual authorised by the Customer to use the Service under the Customer's organisation account in accordance with clause 6B.
• "Service" means the security-questionnaire-response and documentation assessment service described in the Background and clause 2, in any of its tiers.
• "Customer Materials" means any questionnaires, policies, standards, evidence, documents, and other information you upload to or supply through the Service.
• "Output" means the draft questionnaire responses, completeness scores, gap analyses, action plans, and any other materials the Service produces from the Customer Materials.
• "Sample Answers" means the free, on-screen illustrative answers described in clause 2.4.
• "Pre-Scan" means the preliminary assessment of a questionnaire and/or Customer Materials carried out before a fixed price is confirmed and before payment is taken.
• "Bundle" means the fixed-quantity, fixed-term commitment described in clause 6.
• "Shared Evidence Library" means the shared set of Customer Materials maintained by an organisation under clause 6B.
• "Insurance Questionnaire" means a cyber-insurance application, proposal, or renewal questionnaire that, when completed and submitted, forms or supports a warranty or representation to an insurer.
• "UK GDPR", "Data Protection Act 2018", "EU GDPR", "Controller", "Processor", "Personal Data", "Processing" and related terms have the meanings given in the applicable data protection legislation in force from time to time (the "Data Protection Legislation").

2. The Service and How It Works

1. The Service operates in tiers, which may include: (a) single questionnaire-response jobs; (b) the Bundle (clause 6); (c) documentation assessment and gap analysis; (d) assistance with Insurance Questionnaires (clause 6A); and (e) such further tiers (including a hosted trust-centre service) as we may make available, each subject to these Terms and any tier-specific terms.
2. Acceptance of Terms is required before any Customer Materials are uploaded or processed. No Customer Materials are processed until you have accepted these Terms.
3. After upload, we carry out a Pre-Scan to determine (a) whether the Service can process the questionnaire on an automated basis and (b) the extent to which your Customer Materials support a response. We then confirm a fixed price before any chargeable work begins.
4. Sample Answers: following the Pre-Scan and before any payment is taken, we may display to you a small number of Sample Answers generated from your own questionnaire and your own Customer Materials. Sample Answers: (a) are provided free of charge; (b) are displayed on screen only, are not downloadable, and do not form part of any deliverable; (c) are generated in the same way as paid Output, that is only from your Customer Materials and without inventing, assuming or supplying facts that your Customer Materials do not establish; and (d) are provided solely to illustrate how the Service operates. Sample Answers are illustrative only. You must not rely on them or submit them to any third party, and clauses 3 (Your Responsibilities) and 11 (Nature and Limits of the Service) apply to Sample Answers as they apply to all Output. For the avoidance of doubt, Sample Answers are generated only after you have accepted these Terms in accordance with clause 2.2.
5. We may decline to provide the Service for a particular questionnaire, or recommend that you do not proceed with it, for example, where the questionnaire cannot be processed automatically, or where your Customer Materials are insufficient to produce a useful response. In such cases, no charge is made for the declined work.
6. The Service uses automated processing, including third-party large language model (AI) services, to analyse Customer Materials and generate Output. See clause 10 (Data Protection and Data Handling) for how your data is handled in that processing.
7. Output is generated from and limited to your Customer Materials. Where your documentation does not support an answer, the relevant item is flagged to you as a gap rather than as answered. We do not invent, assume, or supply facts that your Customer Materials do not establish.

3. Your Responsibilities

1. You are responsible for the accuracy, completeness, lawfulness and adequacy of the Customer Materials you supply, and for ensuring you have the right to supply them to us.
2. You are responsible for reviewing all Output before relying on it or submitting it to any third party. Output consists of draft responses and analyses derived from your own documentation; it represents your representations to your counterparties, not ours.
3. You remain solely responsible for your own security controls, for the truth of any statement you submit to a third party, and for any decision you or any third party makes in reliance on the Output.
4. You must not use the Service to misrepresent your security posture, nor submit Output you know or ought to know to be inaccurate.
5. You must keep your account credentials secure and are responsible for activity under your account. Where the Customer has more than one Authorised User under clause 6B, this obligation applies to each Authorised User's credentials, and the Customer is responsible for the acts and omissions of each Authorised User as if they were its own.

4. Charges, Pricing and Payment

1. Charges for single questionnaire-response jobs are fixed by size band, determined by the total number of questions in the questionnaire, as published from time to time. The current published bands are: up to 30 questions, up to 100 questions, and over 100 questions. There is no upper limit on the number of questions within a single questionnaire in the top band. The price is determined by the size of the questionnaire, not by the number or proportion of questions the Service can answer. The applicable price is confirmed to you following the Pre-Scan and is payable before the chargeable work is carried out. Prices are stated exclusive of VAT.
2. Bundle charges are as set out in clause 6 and as published from time to time.
3. VAT will be added where applicable. For customers outside the United Kingdom, VAT will be handled in accordance with applicable law, including the reverse-charge mechanism where you provide a valid VAT registration number and it applies.
4. Payment is processed by our third-party payment processor, Stripe (https://stripe.com/). We do not store your full card details. Your use of that processor is subject to its terms.
5. Except as expressly stated in these Terms or required by law, charges are non-refundable once the chargeable work has been carried out, because the Pre-Scan establishes the expected scope and price before you commit.

5. Single Questionnaire-Response Jobs

1. A single job is a one-off, transactional purchase. It is not a subscription and does not renew.
2. For a single job, we process the Customer Materials you supply and deliver the Output. Retention of your Customer Materials and Output after delivery is governed by clause 10.6: upon delivery, you may choose to keep them as a reusable library or have them removed; if you make no choice, they will be deleted within 30 days.

6. The Bundle

1. The Bundle is a commitment to a fixed number of questionnaire-response jobs (currently five) within a fixed term (currently twelve months from purchase), at a fixed price published from time to time. Bundle jobs may be used for questionnaires of any size band.
2. The Bundle does not renew automatically. There is no automatic charge at the end of the term.
3. A Bundle job is consumed only when you trigger a new questionnaire-response job. We do not process your Customer Materials except when you trigger a job. Between jobs, we retain the most recent Customer Materials you supplied, so you do not need to re-upload them. If you supply updated materials with a job, we process those for that job; otherwise, we reuse the retained materials.
4. We will contact you approximately 90 days before the end of the Bundle term with a summary of your usage and the options available for any unused jobs, which may include: (a) carrying forward unused jobs into a new term (subject to a new charge); (b) converting unused jobs into an equivalent value of advisory or assessment services; or (c) converting unused jobs into a benefit toward a hosted trust-centre service, as published at the time.
5. Unless you select one of the options offered, any unused jobs expire at the end of the Bundle term, and no refund is due for unused jobs. We will have given you the 90-day notice described above before any such expiry.
6. Retention of your Customer Materials under a Bundle is addressed in clause 10 (Data Protection and Data Handling): the pack is retained for the Bundle term and deleted within 30 days of expiry or termination, unless the Bundle is extended or renewed (in which case retention continues under the new term), or unless you move to a hosted trust-centre service governed by its own terms.

6A. Cyber-Insurance Questionnaires

1. This clause applies whenever you use the Service in relation to an Insurance Questionnaire, in addition to the rest of these Terms. Where there is any conflict for such use, this clause prevails.
2. You acknowledge that a completed Insurance Questionnaire forms or supports a warranty, proposal, or representation to an insurer, that it may form the basis of a binding insurance contract, and that an inaccurate, incomplete, or misleading answer may entitle an insurer to refuse a claim, reduce a payment, or avoid the policy. The consequences of an answer are therefore more materially serious than for an ordinary security questionnaire.
3. We do not provide insurance, insurance broking, underwriting, coverage, or risk-transfer advice of any kind. We do not advise on whether any policy, answer, or level of cover is suitable for you, and nothing in the Output is such advice. We are not your insurer, broker, or adviser.
4. As with all uses of the Service, Output for an Insurance Questionnaire is drafted only from your Customer Materials. We do not warrant any answer for underwriting purposes, and we do not confirm that any control described in your documentation exists or operates. You alone are responsible for the truth, accuracy, and completeness of every answer you submit to an insurer, and the submitted answers are your warranties and representations, not ours.
5. Where your documentation does not support an answer, we do not answer it. Such items are flagged to you as questions that only you can answer. You must answer them yourself, truthfully, understanding that your answer is a warranty to your insurer. You must not rely on the Service to supply an answer that your documentation does not establish.
6. Document conversion and delivery: an Insurance Questionnaire supplied as a PDF is converted to an editable document for completion. We deliver a completed, editable document to you (not a final submission file). You are responsible for reviewing the completed document against the original questionnaire, including confirming that the wording of every question is unchanged and complete and that no content has been altered or omitted in conversion, and for producing, finalising, and submitting the final document to your insurer. We are not responsible for the final document you produce or submit, nor for any difference between the converted document and the original arising after delivery to you.
7. You must not alter, reword, or "correct" the insurer's questions. We preserve question wording as supplied; you are responsible for confirming this on review.

6B. Organisations, Shared Credits and the Shared Evidence Library

1. Organisation accounts: the Customer may authorise more than one individual (each an Authorised User) to use the Service under its organisation account, by invitation or by our recognising and suggesting the organisation to a new user (for example, on the basis of an email domain). The Customer is responsible for deciding who is authorised, for removing users who should no longer have access, and for the acts and omissions of each Authorised User in connection with the Service. Clause 3.5 applies to each Authorised User.
2. Shared credits: jobs available under a Bundle or other credit pool held by the organisation may be consumed by any Authorised User of that organisation. Invoices are issued to the party that pays. Consumption of shared credits by any Authorised User counts against the pool, and no refund or credit is due in respect of consumed or unused credits except as expressly set out in clause 6.
3. Privacy between users: a job initiated by an Authorised User, together with its Customer Materials and Output, is private to that user. Other Authorised Users of the same organisation do not obtain access to it by virtue of sharing the credit pool or the organisation account, unless the initiating user places materials in the Shared Evidence Library.
4. Shared Evidence Library: the organisation may maintain a Shared Evidence Library of Customer Materials that any Authorised User of that organisation may access and reuse for their own jobs without re-uploading. The Customer is responsible for what its Authorised Users place in the Shared Evidence Library, warrants that it has the right to share those materials within the organisation and to supply them to us, and is responsible for managing internal access to the library. Materials placed in the Shared Evidence Library are Customer Materials for all purposes under these Terms, including clauses 9 and 10.
5. Retention of the Shared Evidence Library: the Shared Evidence Library is retained while the organisation account remains in use, and clause 10.6 applies to it with the organisation as the relevant Customer. Materials placed in the Shared Evidence Library by an Authorised User remain in the library and remain available to the organisation if that user's authorisation ends, since they are the organisation's Customer Materials; the organisation may remove any item from the library at any time.

7. Intellectual Property

1. You retain all rights in your Customer Materials. You grant us a non-exclusive licence to use them only to the extent necessary to provide the Service to you.
2. As between you and us, you own the Output to the extent it incorporates your Customer Materials. We retain all rights in the Service itself, including our software, methodologies, frameworks, checklists and scoring logic, which are and remain our property.
3. You must not copy, reverse-engineer, resell, or attempt to extract the underlying methodologies, checklists or scoring logic of the Service.

8. Availability and Support

1. We aim to make the Service available, but do not guarantee uninterrupted or error-free operation. The Service is hosted on third-party cloud infrastructure in the Amazon Web Services EU (Ireland) region.
2. We may carry out maintenance and modify or discontinue features on reasonable notice, where practicable.

9. Confidentiality

1. Each party may receive the other party's confidential information. Your Customer Materials are your confidential information.
2. Each party shall keep the other's confidential information confidential, use it only to perform or receive the Service, and not disclose it except to those who need to know it and are bound by equivalent obligations, or as required by law.
3. This clause does not apply to information that is or becomes public through no breach, was lawfully known before disclosure, or is independently developed.

10. Data Protection and Data Handling

1. Both parties shall comply with the Data Protection Legislation, being the UK GDPR, the Data Protection Act 2018, and, where the Service is provided to customers in the European Economic Area, the EU GDPR (Regulation (EU) 2016/679), in each case as amended or replaced from time to time.
2. The Customer Materials primarily consist of confidential business information (such as security policies and documentation). To the extent any Customer Materials contain Personal Data, the parties acknowledge that, in respect of such Personal Data, you act as Controller and we act as Processor, processing such Personal Data only on your documented instructions to provide the Service.
3. Where we act as Processor, we shall: (a) process Personal Data only on your documented instructions; (b) ensure persons authorised to process it are bound by confidentiality; (c) implement appropriate technical and organisational security measures; (d) engage sub-processors only on terms consistent with this clause and inform you of changes; (e) assist you, so far as reasonably possible, with data-subject requests and your obligations under Articles 32 to 36 of the UK/EU GDPR; (f) delete or return Personal Data at the end of the provision of the Service as set out in these Terms; and (g) make available information reasonably necessary to demonstrate compliance.
4. Data residency: Customer Materials are stored and processed within the EU (Ireland) region of our cloud infrastructure provider. We will not transfer Customer Materials outside the UK or the EEA except where a lawful transfer mechanism under the Data Protection Legislation is in place, and we will tell you if we propose to do so.
5. Automated and AI-driven processing: the Service uses third-party large language model services to analyse Customer Materials. We will use providers that process such data within the agreed region and that do not use your Customer Materials to train their models, and we will contract with such providers on terms consistent with this clause.
6. Retention and deletion of Customer Materials:
(a) Single jobs: when the Output for a single job is delivered, you will be asked to choose one of the following. (i) Keep: we retain the questionnaire, your supporting documents, the delivered response and gap analysis, and the internal working data derived from them, as a reusable library for your future use, for a rolling period of 12 months. The 12-month period renews each time your account is used, and we will remind you before expiry. The Keep option is available only when two-factor authentication, in the form we specify from time to time, is enabled on your account; if two-factor authentication is disabled, the Keep option and access to the retained library are suspended until it is re-enabled. (ii) Remove: we delete all of the materials described in (i) promptly, including the internal working data and any cached extracts derived from your documents. (iii) If you make no choice, your Customer Materials and Output for that job are deleted within 30 days of completion of the job. Whatever you choose, your Customer Materials are deleted immediately on your request at any time, and such a request overrides any Keep election.
(b) Bundles: your most recent Customer Materials are retained for the duration of the Bundle term so that they can be reused across jobs, and are deleted within 30 days of expiry or termination of the Bundle, or earlier on your written request; if the Bundle is extended or renewed, retention continues under the new term and the deletion period runs from the end of that new term.
(c) Deletion under this clause includes deletion of the internal working data we derive from your Customer Materials in providing the Service, including any cached extracts of your documents.
7. Retention of transaction records: separately from the Customer Materials, we are required by law (including HMRC and company-law obligations) to retain financial and transaction records relating to your purchase, such as the invoice, the customer identity, what was purchased, and when, for a minimum of 7 years. We retain only the minimum metadata necessary for these legal and accounting purposes; we do not retain the content of your questionnaires or your security documentation as part of these records. The lawful basis for retaining these records, including where you have requested deletion of your other data, is compliance with our legal obligations, which overrides the right to erasure in respect of those records only. After the statutory period, these records are deleted.
8. Transition to other services: should you move to a hosted trust-centre service or any other tier, that service is governed by its own terms (which may differ, in particular as to retention, since such a service involves retaining and presenting your materials), and those terms will be presented to and accepted by you before that service begins. Where you move to such a service, the deletion provisions above are superseded by the terms of that service to the extent it requires your materials to be retained.
9. Operational and security logs: we retain operational and security logs relating to your use of the Service, which may include IP addresses, access and event records, and similar technical data. We retain these based on our legitimate interests in securing, operating, monitoring, and troubleshooting the Service, and in preventing and investigating misuse, for a period of 18 months (or longer, where reasonably necessary to investigate a specific security incident), after which they are deleted or anonymised. In addition, to detect and prevent repeated misuse of the free Pre-Scan, we may derive and retain a de-identified fingerprint of uploaded materials, together with the associated source IP address, for a shorter period of up to 90 days, used solely to detect, investigate and prevent such misuse; this shorter retention applies only to that abuse-prevention index and neither extends nor is extended by the 18-month retention above. We acknowledge that IP addresses may constitute Personal Data and we handle them accordingly.
10. Telemetry for service improvement: we retain telemetry on the operation of the Service to maintain and improve the Service, on the basis of our legitimate interests. Where this telemetry is used for improvement, we de-identify or aggregate it wherever practicable; to the extent any such telemetry references the content of your Customer Materials, it is held within the same protections, residency and confidentiality obligations as the rest of this clause and is not used to train any third party's models. This is separate from, and additional to, the position on the third-party AI provider set out above.
11. We are registered with the Information Commissioner's Office, registration number ZA284049.
12. Our Privacy Notice, available at https://inkasec.co.uk/privacy.html, explains how we handle Personal Data. It is a separate document and does not form part of these Terms; if there is any conflict between it and clause 10 in respect of our obligations to you, clause 10 prevails.

11. Nature and Limits of the Service

1. The Service is a documentary completeness service. It assesses your documentation against the expected elements of recognised frameworks and assists in drafting responses based on them. It does NOT, and does not purport to:
(a) audit, certify, accredit or assure your information security, your controls, or your compliance with any standard, law or regulation;
(b) verify, test, or confirm that any control described in your documentation actually exists, operates, or is effective in practice;
(c) constitute legal, regulatory, audit, insurance, or professional advice; or
(d) guarantee that any Output will satisfy any recipient, counterparty, auditor, insurer, or regulator.
2. Output is derived solely from your Customer Materials and reflects your representations. A favourable completeness score means your documentation addresses the expected elements; it does not mean you are secure or compliant, or that you will pass any assessment. A gap means your documentation does not address an element; it does not by itself mean a control is absent in practice.
3. We do not warrant the accuracy, adequacy or fitness of your Customer Materials, and you are responsible for verifying all Output before use or submission.
4. Any completeness score, gap analysis or internal note we provide to you is for your own use. It is not part of, and must not be presented as, any form of certification or assurance by us to any third party.
5. In relation to an Insurance Questionnaire, the limits in this clause apply with particular force: the Output is not insurance or underwriting advice, is not a warranty by us, and does not assure that any answer is acceptable to, or will be accepted by, any insurer. Clause 6A applies.

12. Limitation of Liability

1. Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be excluded.
2. Subject to clause 12.1, we are not liable for: (a) any indirect or consequential loss; (b) loss of profit, revenue, business, goodwill or anticipated savings; (c) any loss arising from your reliance on Output you did not review, or from inaccurate or incomplete Customer Materials; or (d) any decision made by you or any third party in reliance on the Output.
3. Subject to clause 12.1, and without limiting the generality of clause 12.2, we are not liable for any refusal, reduction, or avoidance of an insurance claim or policy, nor for any loss of cover, arising from any answer submitted to an insurer, the accuracy of which remains your sole responsibility under clauses 3 and 6A.
4. Subject to clause 12.1, our total aggregate liability arising out of or in connection with the Service, whether in contract, tort (including negligence) or otherwise, shall not exceed the total charges paid by you to us for the Service in the twelve months preceding the event giving rise to the claim.
5. You acknowledge that the charges reflect the allocation of risk in these Terms and that the limits in this clause are reasonable.

13. Indemnity

1. You shall indemnify us against losses, claims and reasonable costs arising from: (a) your breach of these Terms; (b) the Customer Materials or your use of the Output, including any claim that they infringe a third party's rights or misrepresent your position; or (c) any decision made by you or a third party in reliance on the Output.

14. Term and Termination

1. These Terms apply upon your acceptance and continue in effect while you use the Service. Single jobs conclude on delivery. The Bundle runs for its fixed term as set out in clause 6 and does not auto-renew.
2. Either party may terminate for the other's material breach not remedied within 30 days of notice, or immediately if the other becomes insolvent.
3. On termination, your right to use the Service ends, accrued rights survive, and we will delete or return Customer Materials in accordance with clause 10 (Data Protection and Data Handling), subject to any legal retention obligations. No refund is due for unused Bundle jobs save as set out in clause 6.

15. General

1. Force majeure: neither party is liable for delay or failure caused by events beyond its reasonable control.
2. Entire agreement: these Terms (together with any tier-specific terms) constitute the entire agreement between the parties and supersede all prior arrangements regarding the Service.
3. Variation: we may amend these Terms on reasonable notice; continued use after the effective date constitutes acceptance. Material changes affecting an active Bundle will be notified to you.
4. Assignment: You may not assign without our consent; we may assign to a successor of our business.
5. No partnership or agency is created by these Terms.
6. Third parties: a person who is not a party to the contract has no rights under the Contracts (Rights of Third Parties) Act 1999 to enforce these Terms.
7. Waiver and severance: failure to enforce is not a waiver; if any provision is invalid, the rest continues in force.
8. Notices: notices to us should be sent to info@inkasec.co.uk; notices to you may be sent to the contact details on your account.
9. Governing law and jurisdiction: these Terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, save that we may seek injunctive relief in any jurisdiction.