SecurityDraft — Terms of Business
1. Who we are and what these terms cover
"SecurityDraft" is a trading name of Zebtech Ltd, a company registered in England and Wales, company number 04948022, registered office 2 Longfield Cottages, Danworth Lane, Hurstpierpoint, BN6 9LW ("we", "us"). These terms apply to every security due-diligence pack and re-issue we prepare for you. By paying for a pack you accept these terms. This is a business-to-business service. If anything here is unclear, ask before you pay — we would rather explain than surprise you.
2. What we deliver
Our deliverable is a drafted, review-ready security due-diligence pack, assembled from documentation you supply. Depending on the tier you buy (as described on our website at the time of your purchase), the pack comprises some or all of:
- a completed draft of the CSA AI-CAIQ / AICM questionnaire (or the agreed questionnaire), with each answer drafted from your own material — architecture notes, sub-processor list, data-flow descriptions, model and provider details, existing certificates and reports, your DPA;
- a public AI trust page, supplied as a self-hostable page for your own domain, summarising the security and AI-governance posture described in your documentation;
- a cross-framework mapping appendix indexing your answers to the EU AI Act, ISO/IEC 42001 and the NIST AI RMF.
An annual re-issue is an update of a pack we previously prepared for you, refreshed against your updated documentation and current questionnaire versions.
3. The important bit: we draft — you verify, sign and own
We prepare drafted responses assembled from your real documentation. We do not attest that any statement is true, we do not audit or test your controls, and we issue no certification, assurance, accreditation or attestation of any kind. We are a drafting-and-mapping service: you review, verify, correct and sign off every answer, and the truth of each answer is, and remains at all times, your own representation to your buyer — never ours. This statement is printed on the cover of every pack.
We also do not:
- give advice — legal, regulatory, or otherwise. The mapping appendix indexes your answers to framework clauses; it is not advice on whether the EU AI Act, ISO/IEC 42001, NIST AI RMF or any law or standard applies to you or whether you comply with them. For that, take professional advice;
- guarantee, promise, or predict that any buyer, security team, or procurement process will accept the pack, pass you, or close a deal. The pack is built to make you fast and buyer-ready; the outcome of any review belongs to you and your buyer;
- test, scan, or access your systems, or verify that any control described in your documentation actually exists or operates — we work from what you send us;
- invent, embellish, or fill gaps with assumed facts. Where your documentation does not support an answer, we say so and flag the gap for you to resolve.
4. Your sign-off makes it final — mandatory
Every pack is delivered to you marked DRAFT. Before it can be marked final:
- you must review, verify and correct every answer in the pack; and
- an authorised person at your company must countersign the sign-off declaration supplied with the pack, confirming that every answer is true and accurate and is your company's own representation.
The pack is not "final" without your countersigned declaration, and no pack will be marked final until we have received it. You must not present an unsigned draft to a buyer or any other party as a finished or verified document. This step is not bureaucracy — it is the design of the product: the finished pack carries your representations, made by you, and the sign-off is the moment they become yours.
5. No reliance by third parties
The pack is prepared for you, under a contract with you, for your use. No third party — including any buyer, customer, investor, insurer, auditor, or regulator who receives or reads the pack — may rely on us or on our work, and we owe no duty of care and accept no liability to any third party in connection with the pack. Anyone reading the pack is relying on your representations (which you verified and signed under clause 4), not on anything from us. The cover of every pack says so.
6. Your responsibilities
- Real documentation, honestly supplied. The pack is only as true as what you send us. Your documentation must be genuine, accurate, current, and yours to share. We draft from it; we do not verify it (clause 3).
- No personal data about your customers. Do not send us documents containing your customers' or end-users' personal data — redact it first. It is never needed for the pack. If we spot such data in your materials we will tell you, will not use it, and will delete the affected file on request (clause 10).
- Review and sign-off. Completing the clause 4 review and sign-off is your responsibility; a pack you have not signed off stays a draft.
- Timely inputs. Our delivery clock (clause 8) starts when we have your payment and your complete materials. Delays in supplying materials, corrections, or the sign-off declaration move the delivery and finalisation dates, not our working window.
7. Price and payment
- Every pack has a fixed price, by tier, shown on our website and confirmed before you pay. Prices are stated exclusive of VAT; VAT at the prevailing rate (currently 20%) is added at payment, and your order and receipt show the VAT amount. Zebtech Ltd is VAT-registered.
- Payment is due in full before work starts. We do not begin work on unpaid packs — no exceptions. This is what keeps prices fixed and low, and it is covered by the refund policy in clause 9.
8. Delivery
We deliver the draft pack within the window stated for your tier at the time of purchase (currently around 5 working days for Starter, 7 for Standard, and 10 for Plus), running from the later of payment and your complete materials. We confirm the delivery date in writing once your materials are complete, and we will tell you promptly if anything is missing. If we miss the delivery date we have confirmed to you, and that matters to you, you may ask for a full refund under clause 9. Finalisation (clause 4) then depends on your review and sign-off, which is in your hands.
9. Revisions, cancellation and refunds
- One revision round is included: you send one consolidated set of corrections and comments on the delivered draft, and we return the revised pack promptly. Corrections you make as part of the clause 4 review are exactly what this round is for. Correcting our own drafting errors is always free, at any point. New scope — additional questionnaires, buyer-specific crosswalks beyond your tier — is quoted separately, and we will tell you it is new scope before doing it.
- Before we start: full refund on request. If we haven't started your pack, you get your money back, no quibble.
- If we cannot deliver (clause 8), or we decline the engagement, you get a full refund.
- What we can't refund against. We draft; we do not control your buyer. A buyer's decision — to accept or reject the pack, to pass or fail your review, to close or not close a deal — is not a basis for a refund, and neither is your own decision not to complete the clause 4 sign-off.
- This service is designed for businesses. If you nonetheless contract with us as a consumer, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 give you a 14-day cancellation right. Because our turnaround can be shorter than 14 days, by paying you expressly request that we begin within the cancellation period; if you then cancel before delivery you pay a proportionate amount for the work already done (in full if the draft pack has been delivered), and we refund the balance.
10. Confidentiality and data handling — disclosed plainly
You are sending us security documentation, so here is exactly how we treat it:
- Used for your pack only, never reused. Your materials and your answers are used solely to prepare your pack (and, if you buy one, your re-issue). We never reuse one client's material, answers, or facts in another client's pack, and we never share them with anyone else.
- Minimal retention. We keep your materials and our working copies only for delivery plus a 30-day support window after final delivery (so we can honour the revision round and fix errors), then delete them. If you ask us to delete sooner, we will, at any time.
- Re-issue retention is opt-in. If you want the annual re-issue service, you can ask us in writing to retain your answer set beyond the 30-day window for that purpose; otherwise it is deleted with everything else. You can withdraw that consent, and we delete, at any time.
- No customer personal data. We do not want, and will not ingest, personal data about your customers or end-users (clause 6). Where your materials contain personal data about your own staff (for example names on an org chart or policy), we process it only to prepare your pack, in line with UK GDPR. Zebtech Ltd is registered with the ICO.
- Our own tooling, disclosable. We use AI drafting tools and cloud services to prepare packs. We will disclose on request the sub-processors — including which AI model providers — that your materials pass through, before you send us anything if you wish.
11. Our liability
- Our total liability to you arising from a pack or re-issue, however arising, is capped at the fees you paid us for that pack or re-issue.
- We are not liable for loss of profit, loss of a deal, contract, sale or opportunity, loss of revenue, or any indirect or consequential loss — including anything that follows from a buyer's decision, a security review's outcome, or a regulator's or standard body's view of your business.
- We are not liable for the consequences of inaccurate, incomplete, or outdated documentation you supplied, or of any answer after you have verified and signed it off under clause 4 — from sign-off, each answer is your representation (clause 3).
- We accept no liability to third parties (clause 5).
- Nothing in these terms excludes liability that cannot lawfully be excluded (for example for fraud, or for death or personal injury caused by negligence).
12. Intellectual property
On delivery and full payment, the finished pack — the drafted questionnaire responses, the trust page, and the mapping appendix — is yours: you may use, edit, publish, and send it freely. Your own materials remain yours throughout. Our internal methods, templates, question banks, and prompt libraries remain ours. The CSA AI-CAIQ and AICM are the Cloud Security Alliance's freely published instruments; nothing in the pack transfers or restricts any CSA rights.
13. General
- These terms are the whole agreement for a pack, alongside the tier description and order you paid against. If the order and these terms conflict, the order wins.
- We may update these terms; the version in force when you pay is the one that applies to your pack.
- These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
14. Complaints
If something's wrong, email us at enquiries@securitydraft.com with your order reference. We respond within two working days and aim to resolve complaints within ten.