Terms of Service

These terms govern your use of VendorDeck. By creating an account you agree to them. If you are agreeing on behalf of a company, you confirm you have authority to bind that company.

The service

VendorDeck provides a hosted Trust Centre: an MVSP checklist, generated security policy documents, document hosting, access-request handling, and a public security profile API. We may change or discontinue features with reasonable notice.

What VendorDeck does not do

This is the most important section, so it is stated plainly. VendorDeck does not audit, verify or certify your security posture. MVSP answers are self-attested by you. A compliance score displayed on a Trust Centre or returned by our API reflects what you told us, not an independent assessment.

VendorDeck is not a certification body and a VendorDeck Trust Centre is not a substitute for SOC 2, ISO 27001, Cyber Essentials or any other audited standard. We make no representation that using VendorDeck will satisfy any particular customer, regulator or contractual requirement.

Your responsibilities

• Answer the checklist honestly. Publishing claims you know to be false is a breach of these terms and may expose you to liability towards your own customers.
• Keep your account credentials secure and tell us promptly if you suspect unauthorised access.
• Only upload content you have the right to publish, and do not upload anything unlawful, malicious, or containing other people's personal data without a lawful basis.
• Keep your Trust Centre current. Stale security claims are misleading to buyers.

Acceptable use

Do not use VendorDeck to impersonate another organisation, to probe or attack our infrastructure outside a process we have agreed in writing, to scrape at a volume that degrades the service for others, or to resell access without our agreement.

Subscriptions and payment

The Free plan is provided at no cost. Paid plans are billed monthly in advance through Stripe and renew automatically until cancelled. You can cancel at any time from your account; cancellation takes effect at the end of the current billing period and we do not refund part-months except where required by law.

We may change pricing with at least 30 days' notice before it applies to your next renewal.

Your content

You keep ownership of everything you upload. You grant us the licence we need to host, process and display it in order to run the service — including publishing it publicly where you have chosen to publish your Trust Centre.

Suspension and termination

You may close your account at any time. We may suspend or terminate an account that breaches these terms, that is being used unlawfully, or where required by law — with notice where it is reasonable to give it. On termination we will unpublish your Trust Centre and delete your data in line with our Privacy Policy.

Availability

We aim to keep VendorDeck available but do not guarantee uninterrupted service. The Free plan is provided without any availability commitment.

Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law. Subject to that, our total liability arising out of the service is limited to the fees you paid us in the twelve months before the claim, and we are not liable for lost profits, lost business, or loss of contracts.

In particular, we are not liable for a commercial outcome that depends on a third party's assessment of your security posture — including a customer declining to contract with you.

Governing law

These terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Contact

Questions about these terms: legal@vendordeck.org.