Terms of Business

Last updated: October 2026

NodeForce GRC Ltd, trading as NodeForce. These terms apply to every engagement unless the proposal says otherwise. If they conflict, the signed proposal wins on scope and fees.

1. Who we are and what these terms cover

NodeForce GRC Ltd, trading as NodeForce. These terms apply to every engagement unless the proposal says otherwise. If they conflict, the signed proposal wins on scope and fees.

2. Services

Fixed-scope services as described in each proposal: ISO 27001 readiness, SOC 2 readiness (Type I, and Type II support as a follow-on), ISO 42001 readiness, penetration testing and VAPT, and the UK-to-US Trust Programme. We provide readiness work and advice.

3. What we don't do

We are a consultancy. We do not certify, audit or issue certificates or reports. A UKAS-accredited certification body issues ISO certificates. An independent CPA firm issues SOC 2 reports. Auditor, certification body and re-audit fees are separate and paid by you directly. We give no legal advice. We do not promise an audit result or a closed deal.

4. Our team

Work is done by suitably qualified and experienced people. We use reasonable skill and care.

5. Your responsibilities

Give us timely access, information, evidence and decisions; name an owner; review and approve documents; run the controls we implement (access reviews, restore tests and so on); tell us about changes to your systems.

6. Fees and payment

Fees are fixed as stated in the proposal. No hourly billing.
Engagements under the threshold stated in the proposal: paid in full upfront.
Engagements at or above the threshold stated in the proposal: paid in as stated in the proposal.
Invoices payable within the period stated on the invoice. Late payment: statutory interest and costs under the Late Payment of Commercial Debts (Interest) Act 1998. We may pause work while an invoice is overdue.
Prices exclude VAT unless stated.

7. Changes to scope

Anything outside the agreed scope is quoted and agreed in writing before we start.

8. Fix-for-free

If your certification body, auditor or CPA firm raises a gap or nonconformity that falls within the scope of work we agreed, we will fix it at no extra charge. This applies if: (a) it is raised in the audit for the framework covered by your engagement; (b) you have given us timely access, information and decisions; (c) you have kept operating the controls we implemented; and (d) it is not caused by changes made after handover, by systems or frameworks outside the agreed scope, or by your failure to act. This applies until the earlier of your certificate or report being issued, or for the period stated in your proposal after handover. It does not cover new scope, new frameworks, auditor or re-audit fees. It is not a promise of any audit result, certificate or report, which independent bodies decide.

9. Intellectual property

You own the documents we create for you once paid in full. We keep our templates, methods and know-how and give you a licence to use them within your organisation. You own your data.

10. Confidentiality and data protection

Both parties keep each other's confidential information confidential. For personal data we handle for you, we act as a processor and will sign a data processing agreement if you ask. Our privacy practices are in the Privacy Policy.

11. Liability

We hold professional indemnity insurance.

Nothing in these terms excludes liability for death or personal injury caused by negligence, fraud, or anything that cannot be limited by law.

12. Penetration testing terms (applies to VAPT services)

You confirm you own or are authorised to test the systems in scope, and you will get any third-party permission (cloud providers, hosts). The scope, test windows and environments are agreed in writing. Testing carries some risk of disruption, so you should take backups and tell us your sensitive periods. You tell us a named emergency contact. Critical findings may be reported to you immediately.

13. Cancellation and rescheduling

At least 48 hours' notice to reschedule workshops or sessions. If you cancel a project, we keep fees for work done and any payments already due. Upfront payments for work not yet started are refunded, less a reasonable administration charge only if stated in the proposal.

14. Term and termination

Either party may end the engagement for material breach not fixed within 14 days of notice. You pay for work delivered up to the date of termination.

15. Non-solicitation

Neither party will solicit staff directly involved in the engagement during the engagement and for 6 months after.

16. Complaints

Contact advisory@nodeforce.co.uk. We acknowledge within 5 working days.

17. General

Entire agreement, changes in writing, no assignment without consent, notices by email, force majeure.

18. Governing law

England and Wales. The courts of England and Wales have exclusive jurisdiction.

NodeForce GRC Ltd
Registered in England and Wales