Terms and conditions.

01Who these terms are between

These terms govern your use of the REQOPS governance platform (“the product”) and this website, provided by The Digital BA (“we”, “us”). By using the product or creating an account you agree to them. If you are accepting on behalf of an organisation, you confirm you have authority to bind that organisation, and “you” means the organisation.

02What the product is

REQOPS is a governance observatory: it watches how work happens against the policies that govern it, applies your rules, and keeps a tamper-evident record of every decision. It is designed around three commitments that also bind us contractually:

• Observe before enforce. New policies start in report-only mode. Nothing is blocked until a rule is deliberately moved to enforcing.
• Notice before enforcement. A rule cannot be enforced against people until they have been shown it and acknowledged it. The notice ledger is part of the product record.
• Every decision explained. Who acted, which rule applied, why it happened — kept in an append-only, hash-chained audit log that detects edits.

03Demonstration environment

The public demo runs entirely on simulated sample data. No live ingestion is connected, no real employee records are processed, and nothing you do in the demo leaves your browser. Statements on this site about production behaviour (server-side enforcement, audit logging, retention) describe the product as deployed for customers — connecting it to your own systems is scoped and agreed per engagement.

04Accounts and access

• Sign-in is handled by Auth0. We never see or store your password; accounts are invite-only and roles are checked on the server on every request, deny-by-default.
• You are responsible for keeping your account access secure and for what is done under your account. Invite links grant access and must not be shared.
• We may suspend an account that presents a security risk; suspension is reversible and logged.

05Acceptable use

You agree not to:

• attempt to access records, tenants, or roles you are not authorised for;
• probe, scan, or test the platform for vulnerabilities except through the disclosure route below;
• use the product to monitor people without the notice the product itself requires;
• resell, sublicense, or misrepresent the product or its outputs.

Security researchers acting in good faith are welcome: report what you find — one reporting line, no judgment for false alarms.

06Your data stays yours

• Ownership. Customer records — monitoring data, policies, audit trails — belong to you. We claim no rights over them beyond what is needed to run the product for you.
• Where it runs. The product installs in your environment — your cloud account or your own hardware. Customer records stay on infrastructure you control, and nothing is sent home to us.
• Leaving. Offboarding is export first, in standard formats, then deletion on the written schedule, then a deletion confirmation you can file. The schedule is public: data retention policy.
• Sub-processors. The vendors that touch customer data are listed publicly and you are notified before the list changes: sub-processor list.

07Security commitments

The security program is described on the security pages and backed by named artifacts available on request. In summary: encryption in transit (TLS 1.2+) and at rest, least-privilege role-based access, a tamper-evident audit trail, tested kill switches, a written incident response plan with notification clocks — customers without undue delay, regulators within 72 hours where GDPR applies — and physical deletion to NIST 800-88 when data leaves.

08Intellectual property

The product, this website, the REQOPS marks, and the design system remain our intellectual property. Your configurations, policies, and records remain yours. Feedback you give us may be used to improve the product without obligation.

09Liability

To the extent permitted by law: the product is provided as described, our total liability under these terms is capped at the fees paid in the twelve months before the claim, and neither party is liable for indirect or consequential loss. Nothing in these terms excludes liability that cannot be excluded under the Australian Consumer Law or other applicable law. The demo is provided as-is for evaluation.

10Changes and termination

We may update these terms; material changes are notified before they take effect, and the dated version history is available on request. You may stop using the product at any time — the offboarding path in section 06 applies. We may terminate for material breach that is not remedied within 30 days of written notice.

11Governing law and contact

These terms are governed by the laws of New South Wales, Australia, and the parties submit to the non-exclusive jurisdiction of its courts. Questions about these terms: hello@reqops.io.