Terms of use

What these terms cover

These terms govern your use of grcdepartment.com and the client portal on it. They are not the agreement under which we do paid work: that is the engagement agreement you sign for a specific piece of work, and where the two differ on an engagement, the engagement agreement wins.

By opening an account you accept these terms on behalf of the organisation you name.

Your account

Keep your sign-in details to yourself and tell us promptly if you think somebody else has them. Anyone you invite into your organisation can see its requests and engagements, accept deliverables and approve timesheets, so invite deliberately.

Approving hours or accepting a deliverable in the portal is a decision with commercial effect under your engagement agreement. Approved hours become payable.

You are responsible for what is submitted from your account.

Briefs, proposals and prices

A brief or a scoping request is a request, not an order, and carries no obligation on either side. Nothing is chargeable until you accept a written proposal.

Prices are agreed in that proposal before work starts. Anything shown elsewhere on this site is indicative.

What we do not do

We prepare organisations for assessment and support audits. We do not issue audit opinions or certifications: that remains with your licensed audit or certification body.

Material on this site is general information about our services, not legal or regulatory advice on your circumstances.

Connecting Slack

Connecting your Slack workspace is optional. By connecting one you confirm you are permitted to install applications in it.

We create a channel and post engagement updates to it. Removing the application, and with it our access, is done in Slack by whoever administers the workspace.

Confidentiality

What you send us about your organisation is treated as confidential and used only to scope and deliver your work. The engagement agreement sets out the full terms, including any non-disclosure obligations.

Availability

We aim to keep the site and portal available but do not guarantee uninterrupted service. We may change or withdraw features, and we will not remove something an active engagement depends on without telling the clients who rely on it.

Acceptable use

Do not attempt to access data that is not yours, disrupt the service, or use it to break the law. We may suspend an account that does.

Security researchers are welcome: tell us what you have found through the contact form before disclosing it anywhere else, and we will work with you.