Terms of service

What Assurely provides

Assurely is compliance-management software. It records your Statement of Applicability, collects evidence, reads security posture from a Microsoft tenant you connect, and produces readiness, gap and remediation reports for RFFR, ISO 27001 and the ACSC Essential Eight.

What it does not do

Assurely does not certify, accredit or audit your organisation. Readiness scores and maturity levels are indicative. Accreditation decisions rest with the relevant department, an accredited certification body, or your assessor. Assurely is not a government system and is not a substitute for professional security or legal advice.

Accounts and access

• Accounts are for named individuals; do not share credentials.
• Administrators must have multi-factor authentication enabled.
• Workspace owners control who is invited, what role they hold, and when access is removed.
• We may suspend an account that is being used to compromise the service or another organisation's data.

Your responsibilities

• Keep account credentials secure and enable multi-factor authentication.
• Only upload evidence you are permitted to share, and avoid including participant personal information where it is not needed.
• Remove members who leave your organisation.
• Make sure the information you record is accurate and current.
• Confirm control scope with your assessor before relying on a readiness figure.

Acceptable use

Do not attempt to access another organisation's data, probe or attack the service, upload malicious files, resell access, or use Assurely to break the law. Security testing requires our written agreement first.

Your data

You keep ownership of everything you put into Assurely. We use it only to run the service for you, as described in the privacy policy. You can export your Statement of Applicability, gap report and remediation plan at any time.

Shared reports

Share links you create can be opened by anyone holding the link, subject to any email restriction and expiry you set. You are responsible for who you send them to. Links can be revoked at any time from inside the product.

Fees

Where a subscription fee applies it is set out in your order or agreement with EPIC Assist, is payable in advance, and is exclusive of GST unless stated. Fee changes are notified at least 30 days before a renewal.

Availability and support

We aim for continuous availability but do not guarantee uninterrupted service. Scheduled maintenance is notified in advance where practical. Support is provided by email during Australian business hours.

Liability

Nothing in these terms excludes rights under the Australian Consumer Law. Otherwise, to the extent permitted by law, EPIC Assist is not liable for indirect or consequential loss, lost profits, or the outcome of any accreditation or audit decision, and our total liability is limited to the fees paid for the service in the 12 months before the claim.

Ending your subscription

You can export your Statement of Applicability and reports at any time. On cancellation you keep read access for 30 days to complete exports, after which the workspace and its evidence are deleted as described in the privacy policy.

Changes to these terms

We may update these terms; the date at the top shows when. Material changes are notified to workspace owners by email at least 30 days in advance, and continued use after that date means acceptance.

Who operates Assurely

Assurely is owned and operated by EPIC Assist, ABN 63 946 234 656, an Australian not-for-profit provider of employment and disability services. Enquiries: Isaac Nicol, Isaac.nicol@epicshield.com.au, 0419 725 786.

Independence and disclaimer

Assurely is an independent compliance assurance platform developed and operated by EPIC Assist. Assurely does not constitute a government system, regulatory authority, certification body or government endorsement. Use of the platform does not itself constitute certification, approval or a determination of compliance by any government agency. EPIC Assist does not hold a contract with, and is not appointed by, any government department to assess IEA providers.