This FAQ is informational only and does not form part of the contract. The signed Engagement Letter and incorporated legal terms control.
How does a Customer accept the online terms?
The Customer signs an ACTServ GRC Subscription Engagement Letter and Order Form that expressly incorporates the online MSA, SLA, Support Policy, Data Processing Agreement, Subprocessor Schedule and applicable DORA Terms. The signed Engagement Letter is the acceptance document. An invoice confirms billing under that agreement but is not intended to be the only evidence of acceptance.
Is monthly billing a monthly subscription?
No. The committed Subscription Term is defined in the signed ACTServ GRC Subscription Engagement Letter and Order Form; where the Order Form does not state a term, the default is 36 months. Monthly billing is only the frequency of prepayment and does not create a right to cancel monthly.
Can Fees change at renewal?
Fees are fixed for the committed Subscription Term. ACTServ may adjust Fees with effect from a renewal period by giving at least 60 days’ written notice before the renewal date, so the Customer can decide before the non-renewal notice deadline.
Why is liability capped?
The liability cap allocates risk in proportion to the subscription Fees. The General Liability Cap is the affected Fees paid during the previous 12 months. A higher cap of twice that amount applies to breaches of the MSA’s Confidentiality and Security sections and the Data Processing Agreement. Indemnification obligations sit outside the caps for both Parties.
Are service credits automatic?
No. The 99.6% availability target is a service objective. Service credits apply only where an Order Form expressly includes them.
Can either Party terminate for material breach?
Yes. Either Party may terminate the MSA or an affected Order Form if the other Party materially breaches the Agreement and does not cure the breach within the applicable cure period. The general cure period is 30 days. A 10-day period applies to overdue undisputed Fees after written notice. Immediate termination may apply where a breach cannot be cured, continued performance would be unlawful, insolvency occurs or the Agreement expressly provides an immediate right.
Where Customer terminates because of ACTServ’s uncured material breach, Customer receives a pro-rata refund of prepaid Fees for the unused period. Where ACTServ terminates because of Customer’s uncured material breach, remaining committed Fees may become payable, subject to applicable law.
Who is responsible for exporting data?
The Customer uses the Platform’s standard export functionality during the subscription and for 30 days after termination. Additional migration, transformation or assisted export work is chargeable.
Does ACTServ guarantee compliance with any framework or regulation?
No. The Platform supports compliance workflows, evidence and oversight for the frameworks and regulations configured by the Customer — current or future, such as DORA, ISO/IEC 27001, NIS2 or any other standard. Use of the Platform does not constitute legal or regulatory advice and does not guarantee compliance, certification or regulatory approval under any framework. The Customer remains responsible for regulatory decisions, implementation, classifications and reliance on reports.
Where is Platform data hosted?
The production backend, database and evidence storage are hosted in the European Union (Ireland). Frontend delivery and application execution run from European Union regions (France and Germany). The providers, exact regions and data categories are maintained in the Subprocessor Schedule.
Does ACTServ read Customer mailboxes?
No. The Platform offers an optional Microsoft 365 integration that the Customer chooses whether to enable. When enabled, the Platform sends notifications through a designated mailbox controlled by the Customer — it can send, not read. When not enabled, notifications are not sent by email and remain available in the Platform as alerts.
What access does ACTServ have?
Authorised ACTServ personnel may access a Customer tenant on a need-to-know basis for support, administration, security or agreed advisory work. Advisor access is designed to be role-based, time-limited and auditable. Restricted super-administrator access is logged.
Is ACTServ ISO 27001 certified?
ACTServ maintains an Information Security Management System certified to ISO/IEC 27001:2022. The certification relates to ACTServ’s ISMS and certified scope; it is not a separate product certification.