Sentinel42 Platform Terms of Service

1.1 These terms govern your access to and use of the Sentinel42 compliance platform, including the ISMS27001 service (the “Platform”), whether on a free trial or a paid subscription taken out through our website. By creating an account or clicking to accept, you agree to them on behalf of the organisation you represent (“you”). If you do not have authority to bind that organisation, do not create an account.

1.2 The Platform is provided by Sentinel42 Ltd, a company registered in England and Wales with company number 17286468, whose registered office is at 66 Paul Street, London EC2A 4NA, VAT registration number 523629883 (“Sentinel42”, “we”, “us”). You can contact us at info@sentinel42.com.

1.3 The Service Level Agreement (S42-SLA-001) and the Data Processing Agreement (S42-DPA-001, published at www.sentinel42.com/dpa) form part of these terms for paid subscriptions. Our privacy notice explains how we handle personal data about you and your users as a controller.

1.4 The Platform is for business use only and is not offered to consumers.

2.1 You must give accurate details when you sign up and keep them up to date, including the legal name of your organisation and its total headcount (see clause 4.2). You are responsible for everyone who uses the Platform under your account (“Users”), for keeping credentials confidential, for enabling multi-factor authentication where offered, and for telling us promptly if you suspect an account has been compromised.

2.2 Every subscription includes an unlimited number of Users within your organisation. Credentials must not be shared between individuals.

3.1 A free trial gives you access to the Platform for fourteen (14) days from signup with no payment details required. At the end of the trial your account converts to a paid subscription only if you choose one; otherwise access ends.

3.2 Trial accounts are provided as-is for evaluation: the Service Level Agreement does not apply, and we may deactivate a trial that is not converted and delete its data thirty (30) days after the trial ends. You can export your data during the trial and during that period.

3.3 Trial data you enter is treated as your Customer Data under clause 9, including our commitments on ownership and not training AI models on it.

4.1 Subscriptions are sold in four tiers — Starter, Business, Scale and Enterprise — banded by the number of people in your organisation, with the features and current prices shown at www.sentinel42.com/pricing at the time you subscribe. Prices are in pounds sterling and exclude VAT.

4.2 “Employees” means your organisation’s total headcount, including permanent and fixed-term employees, workers and contractors, whether or not they use the Platform. You declare your headcount when you subscribe and again at each renewal. If it grows beyond your tier’s band during a subscription period, tell us within thirty (30) days and your subscription moves to the appropriate tier, with the difference charged pro rata for the rest of the period.

4.3 Starter and Business subscriptions include the ISO 27001 core and GDPR essentials; framework Modules can be added at the published price per Module or as a three-Module pack. Scale and Enterprise include every Module. You can upgrade or add Modules at any time (charged pro rata); downgrades take effect at your next renewal.

4.4 Starter and Business can be billed monthly at the annual price plus ten per cent (10%), divided by twelve. Scale and Enterprise are billed annually.

4.5 Founding customer rate. The first twenty (20) paying customers on annual Starter, Business or Scale subscriptions — through any channel — receive twenty per cent (20%) off the tier price, locked for twenty-four (24) months from their subscription start date. The number of places remaining is shown on the pricing page. The offer closes when the places are taken or on 31 March 2027, whichever is earlier. It applies to the tier price only; Modules are charged at the published price. At the end of the twenty-four months the subscription moves to the published price for the tier then in force.

5.1 Annual subscriptions are invoiced in advance at the start of each subscription year; monthly subscriptions are invoiced monthly in advance. You can pay by automatic card payment through our payment provider (which handles and stores your card details — we do not) or by bank transfer within thirty (30) days of the invoice date. Bank details are on the invoice; please check any change of bank details with us by telephone before paying.

5.2 If an undisputed invoice is not paid when due we may charge interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998 and, after fourteen (14) days’ written notice, suspend access until it is paid. Fees for annual subscriptions are not refundable except where these terms say otherwise.

6.1 Annual subscriptions run for twelve (12) months and renew automatically for further twelve-month periods unless you or we give at least thirty (30) days’ written notice before the renewal date. Monthly subscriptions run month to month; you can cancel at any time from your account or by email, and cancellation takes effect at the end of the current monthly period. We may end a monthly subscription on thirty (30) days’ notice.

6.2 Either party may end a subscription immediately by written notice if the other commits a material breach that is not remedied within thirty (30) days of being asked to, or becomes insolvent. You may end your subscription, and receive a refund of prepaid fees for the unexpired period, if we materially breach clauses 9.3 or 10 and do not put it right within fourteen (14) days.

7.1 Your subscription price is fixed for twenty-four (24) months from your subscription start date. After that we may change the price from the start of a renewal period by giving you at least sixty (60) days’ notice; any increase will not exceed the change in the UK Consumer Prices Index over the previous twelve months plus two (2) percentage points. If you do not want to accept the change you can give notice of non-renewal.

8.1 You must not, and must ensure your Users do not: copy, modify, decompile or reverse-engineer the Platform except as the law allows; use it to build a competing product; resell it or make it available to anyone outside your organisation other than your auditors and advisers through the access features provided; share credentials; upload unlawful or infringing content, malware, payment card data, or special category personal data without our written agreement; or attempt to circumvent tenant isolation, security or usage controls. AI features are provided on a fair-use basis described in the documentation.

8.2 We may suspend access immediately, for no longer than necessary, where that is needed to protect the security of the Platform or other customers’ data, where you are in breach of this clause 8, or where the law requires it. We will tell you why as soon as practicable.

9.1 You own all the data, documents and records you and your Users put into or generate within the Platform, including outputs of AI features (“Customer Data”). You give us a licence to host, process, back up and display Customer Data only so far as needed to provide the Platform and support.

9.2 We do not access Customer Data except to provide support you have asked for, to maintain the security, integrity and availability of the Platform, to operate it as described in the documentation, or where the law requires.

9.3 The Platform is hosted on Amazon Web Services in the EU (Ireland, eu-west-1). Customer Data is stored and processed there and is not moved to another region without your agreement. We will never use Customer Data to train, fine-tune or improve any AI or machine-learning model, ours or anyone else’s.

9.4 For personal data within Customer Data you are the controller and we are your processor under the Data Processing Agreement, which lists our sub-processors (Amazon Web Services, Cloudflare, Microsoft 365 and our infrastructure engineering partner) and our security measures.

9.5 When your subscription ends you have thirty (30) days to export Customer Data in commonly used, machine-readable formats. We then delete your instance and all Customer Data from live systems within thirty (30) days, and from backups as they expire, unless the law requires us to keep something. We will confirm deletion in writing if you ask.

10.1 The Platform’s AI features use foundation models accessed through Amazon Bedrock inside our AWS environment in the EU (Ireland). Customer Data is not sent to an AI vendor outside that environment, prompts are not retained by the model provider after the request completes, and no model is trained on your data. The AI features in your instance cannot see any other customer’s data.

10.2 AI output is there to assist you. It can be wrong or incomplete and is not professional, legal or certification advice. Review it before you rely on it: decisions about your management system, and any certification or regulatory outcome, remain yours.

11.1 We protect the Platform with tenant isolation, encryption in transit and at rest, role-based access, multi-factor authentication for administration, logging and monitoring, vulnerability management and at least annual independent penetration testing. We operate our own information security management system aligned to ISO/IEC 27001:2022 and will maintain certification once achieved.

11.2 For paid subscriptions we commit to 99.5% monthly availability with service credits, response times of four hours for critical incidents through to five Business Days for queries, and support by email and in the Platform between 09:00 and 17:30 UK time on Business Days, all as set out in the Service Level Agreement.

11.3 If we become aware of a security incident affecting your Customer Data we will tell you within forty-eight (48) hours and follow the incident procedure in the Service Level Agreement.

12.1 We and our licensors own the Platform, its content libraries, templates, control mappings, documentation and all improvements to them. Apart from the right to use the Platform under these terms, nothing transfers any of those rights to you. You keep ownership of Customer Data, and you give us a licence to use any feedback you provide about the Platform without obligation.

13.1 Each of us will keep the other’s confidential information confidential, use it only for the purposes of these terms, and disclose it only to people who need to know and are bound to keep it confidential. Customer Data is your confidential information; the non-public technical details of the Platform are ours. These obligations last for five (5) years after your subscription ends, and indefinitely for Customer Data. The usual exceptions apply for information that is public, already known, independently developed or required to be disclosed by law.

14.1 We warrant that the Platform will perform materially as described in the documentation, that we will provide it with reasonable skill and care, and that the commitments in clauses 9.3, 10 and 11 are implemented and maintained. If the Platform does not conform, tell us and we will correct it as your primary remedy.

14.2 The Platform supports but does not guarantee certification, attestation or regulatory approval — those decisions belong to your certification body, auditor or regulator. Except as stated in these terms, all other warranties and conditions implied by law are excluded so far as the law allows.

15.1 Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, for your obligation to pay fees, or for anything else that cannot lawfully be limited.

15.2 Neither of us is liable to the other for loss of profits, revenue, business, contracts or anticipated savings, loss of goodwill or reputation, or any indirect or consequential loss.

15.3 Subject to the above, each party’s total liability in any subscription year is limited to one hundred per cent (100%) of the fees paid or payable by you in the twelve (12) months before the event giving rise to the claim, except that our liability for breach of clauses 9.3, 10, 11 or the Data Processing Agreement is limited to two hundred per cent (200%) of those fees. During a free trial our total liability is limited to £500.

16.1 If you were introduced to the Platform by one of our authorised partners and you contract with that partner for your subscription, the partner (not you) is responsible to us for the fees and clauses 5 and 7 apply between us and the partner; every other clause applies to your use of the Platform and your Customer Data. The partner may exercise your export rights under clause 9.5 on your written authority, and we will not approach you to sell the Platform directly while your arrangement with the partner continues.

17.1 We may update these terms. We will publish the new version at www.sentinel42.com/terms and give you at least thirty (30) days’ notice by email or in the Platform. Changes that reduce your rights or our commitments apply to you from the start of your next renewal period; other changes apply from the date stated in the notice. If you do not accept a change you may give notice of non-renewal.

18.1 These terms, the Service Level Agreement, the Data Processing Agreement and your order details are the whole agreement between us for the Platform, and replace anything said or written before. Neither of us may assign them without the other’s consent, except to an affiliate or a successor to its business. If any part is unenforceable the rest still applies. No one else has rights under the Contracts (Rights of Third Parties) Act 1999. Notices to us go to info@sentinel42.com; notices to you go to the email address on your account. Nothing in these terms creates a partnership or agency.

18.2 These terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes or claims) are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

19.1 Sentinel42 Ltd, 66 Paul Street, London EC2A 4NA · info@sentinel42.com · www.sentinel42.com. Our Managing Director, Simon Green, is the named contact for escalations, security incidents and data-protection matters.

Current version: S42-TOS-001 v1.0
Effective from: 6 September 2026

Archived versions of previous Terms are retained on request — contact info@sentinel42.com for a copy.