Terms of Service

The Service is provided by Sentinel42 Ltd, registered in England & Wales, company number 17286468, ICO registration number C1974552, registered office 66 Paul Street, London EC2A 4NA (“Sentinel42”, “we”, “us”). The Customer is the legal entity identified on the Order Form.

The Service is a multi-tenant SaaS platform supporting information-security management aligned to ISO/IEC 27001 control patterns. Features include asset and risk registers, controls, audits, incident and non-conformity management, supplier due diligence, management review, and related governance workflows.

We may add, change or remove features on reasonable notice, provided we do not materially reduce the overall functionality of the tier purchased during a paid term.

Standard tiers under the MSA:

Actual pricing for a Customer is the price stated on that Customer’s signed Order Form.

• Initial term: 12 months from the Order Form start date.
• Renewal: auto-renews for successive 12-month terms unless either party gives at least 30 days’ written notice before the current term ends.
• Billing cycle: annually in advance under the MSA.
• Monthly billing: not offered under the MSA. May be made available at our discretion under a separate short-form order, without a 12-month commitment.
• Payment terms: 30 days from invoice date, by BACS to the account stated on the invoice. Card payments are not offered.
• VAT: all fees are exclusive of VAT, which is added where applicable.
• Late payment: we may suspend the Service and charge statutory interest under the Late Payment of Commercial Debts (Interest) Act 1998 on overdue amounts.

We may offer a 14-day free trial of the Service prior to contract execution. Trials are provided on an “as-is” basis, may be modified or withdrawn at any time, and are subject to separate trial terms displayed at sign-up. No MSA is required until the trial is converted to a paid subscription.

Onboarding and other professional services are optional and chargeable at £399 per day (ex VAT). Where engaged, they are documented in a separate statement of work issued by our sales team; they are not billed through the platform.

Customer and its Users shall not:

• use the Service in breach of applicable law or in a way that infringes third-party rights;
• upload malware or attempt to disrupt, probe or reverse-engineer the Service;
• share user credentials or exceed the seats purchased;
• use the Service to store or process data outside the ordinary scope of information-security management (e.g. medical records, payment card data as a merchant of record) without our prior written agreement.

The Customer retains all rights in the data it uploads to the Service (“Customer Data”). We process Customer Data only to provide and support the Service, and, where it includes personal data, in accordance with the DPA.

On termination or expiry, the Customer may export its data for 30 days, after which we securely delete it in line with clause 12 of the DPA.

We target 99.5% monthly availability, measured excluding planned maintenance and events outside our reasonable control. Support is provided by email in UK business hours; enterprise support terms, if any, are set out on the Order Form.

Sentinel42 owns all rights in the Service, including its software, templates, libraries and documentation. The Customer receives a non-exclusive, non-transferable right to use the Service during the paid term for its own internal business purposes.

Each party shall keep the other’s confidential information confidential and use it only to perform the MSA. This obligation survives termination for three years, or indefinitely for information that is a trade secret or personal data.

Neither party excludes or limits liability for death or personal injury caused by negligence, fraud, or any liability that cannot be excluded by law. Subject to that, each party’s total aggregate liability under or in connection with the MSA is capped at the fees paid by the Customer in the 12 months preceding the event giving rise to the claim.

Neither party is liable for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, loss of goodwill, or loss or corruption of data (save where such data loss results from our breach of the DPA).

Either party may terminate the MSA with immediate effect on written notice if the other:

• commits a material breach that is not remedied within 30 days of notice;
• becomes insolvent or enters an equivalent process.

Termination does not affect fees already accrued and does not entitle the Customer to a refund of pre-paid fees except where termination is for our uncured material breach.

The MSA is governed by the law of England & Wales. The parties submit to the exclusive jurisdiction of the courts of England & Wales.

Commercial and contractual queries: info@sentinel42.com.