Terms of Use and Disclaimers

1. About these terms

Checkmate is an ISO compliance management platform for organisations operating across Australia (all States and Territories) and New Zealand. These Terms of Use and Disclaimers (Terms) govern access to and use of Checkmate, a software platform provided by CNETS PTY LTD (ABN 78 670 429 464) (CNETS, we, us). By accepting an invitation, signing in or using Checkmate, you agree to these Terms on behalf of yourself and the organisation that invited you (Customer).

Where a signed order form, master services agreement or statement of work exists between CNETS and the Customer, that document prevails over these Terms to the extent of any inconsistency. Enterprise and Custom subscriptions may be governed by a negotiated Master Services Agreement (MSA), custom Data Processing Agreement (DPA) and dedicated Service Level Agreement (SLA); absent such a signed agreement, these Terms (including the limitation of liability) apply to all plans.

2. Generated content is general in nature

All policies, procedures, registers, Statements of Applicability, risk assessments, templates, training material, quizzes, reports, correlation findings and AI Assistant responses (Generated Content) are general in nature. They are produced from templates, automated rules and artificial intelligence using information supplied by the Customer.

Generated Content is not legal, regulatory, financial, cyber security, workplace health and safety, environmental or audit advice, and does not take into account every circumstance of the Customer. It may be incomplete, inaccurate, out of date or unsuitable for the Customer's context.

Software only: where the Customer subscribes to Checkmate without the CNETS vCISO add-on, Checkmate is a self-serve software tool. No human professional reviews the Customer's Generated Content, and CNETS provides no advisory service beyond the platform support described in the Customer's plan.

Software + CNETS vCISO: where the Customer engages CNETS under the vCISO or Compliance Manager add-on, CNETS personnel provide human guidance on gap assessment, document tailoring, implementation and audit readiness, within the scope set out in the Customer's order form or statement of work. That guidance is advisory only. The Customer's management remains responsible for decisions, approval of every document, implementation of controls and the operation of its management system. Generated Content remains general in nature until the Customer has reviewed, adapted and approved it.

3. Draft only — human review and approval required

All Generated Content is a draft only. Before any Generated Content is relied upon, published, issued to staff, provided to third parties or presented to an internal or external auditor or certification body, the Customer must have suitably qualified and authorised people review it, modify it to reflect the Customer's actual operations, risks, legal obligations and controls, and formally approve it.

The Customer is solely responsible for the content, accuracy, implementation and effectiveness of its management system and all approved documents. Approval of a document in Checkmate is the Customer's act and confirms the Customer has completed that review.

4. No guarantee of certification or compliance

CNETS is not a certification body. Certification decisions are made independently by accredited certification bodies. Neither the use of Checkmate nor any CNETS vCISO or advisory service guarantees that the Customer will pass any audit, obtain or keep any certification under ISO/IEC 27001, ISO/IEC 42001, ISO 9001, ISO 14001 or any other standard, or comply with any law, regulation or contract.

Fees charged by certification bodies, auditors and other third parties are separate and payable by the Customer directly.

5. Artificial intelligence

Checkmate uses artificial intelligence features. AI output can contain errors, omissions, out-of-date references or content that appears plausible but is wrong. The Customer must verify AI output before acting on it and must not enter information it is not permitted to process.

6. Automated monitoring and evidence

Automated checks of connected systems (such as Microsoft 365) depend on permissions, configuration and third-party services. A passing check does not mean a system is secure or compliant, and a check may fail to detect issues. Monitoring does not replace the Customer's own security operations, incident response or professional assessment.

7. Customer responsibilities

The Customer is responsible for: the accuracy of information it enters; the conduct of its users; keeping credentials secure and enabling multi-factor authentication; obtaining any consents required to upload personal or third-party information; maintaining its own copies of records; and compliance with laws that apply to it, including the Privacy Act 1988 (Cth) and, where relevant, the Privacy Act 2020 (NZ).

The Customer must not use Checkmate unlawfully, attempt to access another organisation's data, reverse engineer, copy or resell the platform, or use it to build a competing product.

8. Intellectual property

CNETS owns all rights in Checkmate, its software, templates, content libraries, question banks and branding. The Customer owns its own data. Subject to payment of fees, the Customer receives a non-exclusive, non-transferable licence to use Generated Content internally for its own management system during and after the subscription. Export formats may be limited by plan.

9. Limitation of liability

Nothing in these Terms excludes, restricts or modifies any guarantee, right or remedy under the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)), the Consumer Guarantees Act 1993 (NZ), the Fair Trading Act 1986 (NZ), or any other Commonwealth, State, Territory or New Zealand law that cannot lawfully be excluded. Where liability for a breach of a non-excludable guarantee can be limited, CNETS's liability is limited, at CNETS's option, to resupplying the services or paying the cost of having them resupplied.

To the maximum extent permitted by law, CNETS and its directors, officers, shareholders, owners, employees, contractors and related bodies corporate (CNETS Parties) exclude all warranties not expressly stated, and are not liable for any indirect, special or consequential loss, or for any loss of profit, revenue, data, goodwill, certification, contract or opportunity, failed or delayed audits, non-conformities, regulatory penalties, security incidents or business interruption, however caused, including by negligence.

To the maximum extent permitted by law, the total aggregate liability of the CNETS Parties arising out of or in connection with Checkmate and any related services is limited to the fees actually paid by the Customer to CNETS in the three (3) months before the event giving rise to the claim.

No director, officer, shareholder, owner or employee of CNETS has any personal liability to the Customer or its users. The Customer agrees to bring any claim only against CNETS PTY LTD.

10. Indemnity

The Customer indemnifies the CNETS Parties against any claim, loss, liability, penalty, cost or expense (including reasonable legal costs) arising from: use of Generated Content without the review and approval described above; information supplied by the Customer; breach of these Terms or of law by the Customer or its users; or any third-party claim relating to the Customer's management system, products or services.

11. Availability, data and security

Checkmate is provided on an as-is and as-available basis on enterprise cloud infrastructure with logical tenant isolation, access controls, and encryption at rest and in transit. CNETS does not warrant uninterrupted or error-free operation or that the platform is free of vulnerabilities. Customer data may be stored and processed by CNETS's hosting providers outside the Customer's jurisdiction. The Customer should retain its own copies of important records.

Customers subject to specific government, defence or regulated compliance frameworks (including IRAP or ISM alignment) must subscribe under a Custom agreement providing tailored hosting and dedicated operational parameters before uploading any sensitive or classified information. CNETS accepts no liability for non-compliance with such frameworks where a Customer uses a standard subscription.

12. Fees, term and suspension

Checkmate is provisioned by CNETS only; Customers cannot sign up on their own. Every subscription requires an order form signed or accepted by the Customer before access is provisioned. Enterprise and Custom subscriptions also require a signed Master Services Agreement or equivalent agreement before provisioning.

Unless the order form states otherwise, every subscription has a minimum term of twelve (12) months from the provisioning date (Minimum Term). Fees may be invoiced monthly, but monthly invoicing is a payment arrangement only and does not make the subscription month-to-month. The Customer is liable for the fees for the full Minimum Term.

If the Customer terminates for convenience, stops using Checkmate, or CNETS terminates for the Customer's breach or non-payment before the end of the Minimum Term, all unpaid fees for the remainder of the Minimum Term become immediately due and payable. Unless either party gives at least 30 days' written notice before the end of the Minimum Term or any renewal term, the subscription renews for a further 12 months at CNETS's then-current pricing.

CNETS may suspend access for non-payment or breach of these Terms. Suspension does not reduce fees payable for the Minimum Term. On termination, the Customer may request an export of its data within 30 days, after which data may be deleted.

13. General

These Terms are governed by the laws in force in the Commonwealth of Australia and its States and Territories or, for Customers incorporated or operating in New Zealand, the laws of New Zealand. The parties submit to the non-exclusive jurisdiction of the courts of Australia and New Zealand. CNETS may update these Terms by publishing a new version in Checkmate; continued use after notice constitutes acceptance. If any provision is unenforceable it is read down or severed and the remainder continues in effect.

Questions about these Terms: legal@cnets.com.au.