Terms Of Service
The agreement between you and Red Flagg Pty Ltd when you subscribe to our services or use this website. Written in plain English where possible, with lawyer-language where it matters.
No clauses match that search. Try different words, or contact us for help.
Welcome, and thanks for reading. We know terms of service aren't light reading. We've tried to write ours in a way that actually makes sense — with a short plain-English summary next to each major clause so you know what it means in practice.
If anything here is unclear, email hello@redflagg.com.au or call 1800 930 329. We'd rather answer your question than surprise you later.
Who we are and who you are
These Terms of Service (the "Terms") are a legal agreement between Red Flagg Pty Ltd (ABN 81 683 346 116), a company incorporated in Australia ("we", "us", "our", "Red Flagg"), and you — the person or organisation using our website or subscribing to our services ("you", "your", "Customer").
This is a contract between you (our customer) and Red Flagg Pty Ltd (us). Whenever we say "we" we mean Red Flagg; whenever we say "you" we mean you or your organisation.
If you are entering into these Terms on behalf of an organisation, you confirm that you have the authority to bind that organisation.
How these terms apply
These Terms apply:
- when you browse or use redflagg.com.au (our "Website");
- when you subscribe to any of our services, including Business Protect, Business Plus, Business Shield, Senior Protection (Protective, Wrap Around, Device Clean Up, Community Plan), and any Additional Services (together, the "Services"); and
- when we issue you a quote, service agreement, statement of work or order form that refers to these Terms.
A Service Agreement is any written quote, order form, or statement of work we send you and that you accept (by email, electronic signature, or payment). Where a Service Agreement and these Terms conflict, the Service Agreement prevails for the specific point of conflict.
These terms apply to everything we do — the website, your subscription, one-off services. If we send you a specific quote and it says something different from these terms, the quote wins on that point.
Our services
Red Flagg provides managed cyber security services to organisations and individuals. The specific Services you receive depend on the plan you choose. Details of each plan are published at redflagg.com.au/plans and redflagg.com.au/new-page (Senior Protection).
Our methodology is structured around three maturity levels. Where your Service Agreement places you on a particular level, the deliverables for that level are detailed in the Service Agreement.
- Level 0 — Culture and awareness. Ten foundational steps focused on people, training, reporting habits, and the everyday safety basics. Every customer starts here.
- Level 1 — Essential Eight. The full ACSC Essential Eight Maturity Level 1 baseline — 48 technical controls delivered progressively after Level 0 is established.
- Level 2-3 — Advanced. Higher-maturity controls scoped and quoted on a project-by-project basis for organisations with regulatory or operational drivers.
Service features are subject to change and improvement. We will not materially reduce the features included in your plan without reasonable prior notice (at least 30 days).
Our services align to ACSC Essential Eight, the NIST Cybersecurity Framework (CSF), and CIS Controls v8. These are industry reference frameworks. Alignment to a framework does not constitute certification to any specific standard unless we explicitly state so in writing for your organisation.
What you get depends on which plan you're on. We work in three levels. Level 0 is people-and-culture (ten steps, everyone starts here). Level 1 is the full Essential Eight (48 controls). Level 2-3 is advanced and quoted per project. We won't take features away without 30 days' notice. When we say "align to" a framework, we follow it — but we're not officially certified unless we say so in writing.
Service maturity and timelines
Cyber security maturity is delivered progressively. We provide indicative timelines for each level so you know what to expect, while recognising that every environment is different.
Indicative timelines per level
Minimum 6 to 12 months to embed properly. Foundational and ongoing.
Typically 12 to 24 months in most environments. Longer for complex ones.
Quoted project by project. Scoped against your specific environment.
The timelines above are estimates based on typical small-to-medium organisations. Your Service Agreement will specify the timeline for your organisation following the Cyber Maturity Assessment.
Timelines are not contractual delivery dates. They may shift because of:
- your specific environment, technology stack, or existing maturity;
- your team's availability for training, approvals, or change management;
- third-party dependencies (Microsoft licensing, hardware procurement, vendor responses);
- incidents requiring focus elsewhere; or
- any other factors outside our reasonable control.
We will keep you informed of progress and any change in timeline through your monthly reporting and your named analyst (or the Cyber Operations Desk on plans without a dedicated analyst).
Level 0 takes at least 6 to 12 months. Level 1 usually takes 12 to 24 months — longer if your environment is complex. Level 2-3 is project work and gets its own timeline. These are good-faith estimates, not promises. Things can shift — if they do, we'll tell you.
Your account and responsibilities
To use our Services, you will need to:
- provide accurate information about yourself and your organisation;
- grant us the access we need to deliver the Services (for example, Microsoft 365 Granular Delegated Admin Privileges (GDAP) if your plan requires it);
- keep your access credentials confidential;
- nominate a primary contact for your account; and
- notify us promptly if any information changes, or if you suspect your account has been compromised.
You are responsible for:
- the actions of your staff, volunteers, contractors, and users under your account;
- complying with applicable laws (including privacy, anti-spam, and employment laws) that apply to your own operations;
- ensuring your own data back-ups and business continuity arrangements beyond what the Services include; and
- any third-party licences (for example, Microsoft 365 licences) you procure through us.
Give us accurate info, give us the access we need, and keep an eye on your own account. If your staff do something silly with your systems, that's on you. If Microsoft has an outage affecting your licences, that's a Microsoft issue, not ours — though we'll help you through it.
Fees, billing and tax
Fees for your Services are set out in your Service Agreement. Unless stated otherwise:
- Business plans are billed monthly in advance, per seat;
- Senior Protection plans are billed monthly in advance;
- Additional Services are billed as quoted (one-off or by milestone);
- payment is due within 7 days of invoice unless otherwise agreed.
Accepted payment methods include direct debit, BPAY (Australia), ACH (USA), EFT (South Africa), and credit card. Credit card payments may incur a surcharge. We reserve the right to suspend Services if an invoice remains unpaid 14 days after the due date; we will notify you before doing so.
All prices are exclusive of applicable taxes unless stated otherwise. Taxes include GST (Australia), sales tax (USA), and VAT (South Africa) as applicable to your jurisdiction.
Currency & tax by jurisdiction
Quoted in AUD. GST added at current Australian rate.
Quoted in USD. Sales tax added where applicable by state.
Quoted in ZAR. VAT added at current South African rate.
We may adjust recurring fees with at least 30 days' written notice. If you don't accept a price change, you may cancel without penalty before it takes effect.
Monthly subscriptions billed in advance. Invoice due in 7 days. Late payments may get your service suspended (we'll warn you first). Tax is on top of the quoted price. If we put prices up, we'll give you 30 days to cancel without penalty.
Acceptable use
When using our Services, you agree that you will not:
- use the Services to engage in unlawful activity;
- attempt to reverse-engineer, decompile, or extract the source code of any Red Flagg-owned tool or system;
- use our Services to send spam, phishing, or malware to anyone;
- probe, scan, or attempt to bypass the security of our systems, or the systems of other customers;
- use our reports, documentation, or outputs to misrepresent your organisation's cyber maturity to third parties;
- resell, sublicense, or white-label our Services without written consent; or
- interfere with any other customer's use of the Services.
We reserve the right to immediately suspend or terminate the Services if we reasonably believe you have breached this clause, or if continued provision of Services would create a legal or security risk to us, you, or other customers.
Don't break the law, don't hack our stuff, don't pretend our report says something it doesn't, and don't resell our services without asking. If you do any of this, we can cut you off immediately.
Data, privacy and confidentiality
Our handling of personal information is governed by our Privacy Policy, which forms part of these Terms.
You own your data. Any data you provide to us, or that we process on your behalf (for example, log data, emails you forward to MailCheck™, scorecard results), remains your property. You grant us a limited licence to use this data only to deliver the Services, produce reports and statistics, and meet our legal obligations.
We do not sell customer data. We do not use customer data to train AI models. We do not share customer data with third parties except:
- with your permission;
- with providers strictly necessary to deliver the Services (for example, Microsoft, our data-hosting providers); or
- where required by law.
Data hosting. Customer data is hosted in the Microsoft Azure region aligned to your jurisdiction: Australia East/Southeast for Australian customers, East US / West US 2 for USA customers, South Africa North (Johannesburg) for South African customers. Data sovereignty is maintained at all times.
Confidentiality. Each party must keep the other's confidential information (such as your systems architecture, our methodology, pricing and reports) confidential, and use it only to perform obligations under these Terms. Confidentiality obligations survive termination for three (3) years.
Notifiable breaches. If we become aware of an eligible data breach affecting your information, we will notify you without undue delay and in any event within the timeframes required by applicable law. In Australia, this is the Notifiable Data Breaches scheme under the Privacy Act 1988. Similar obligations apply under HIPAA (USA, where relevant) and POPIA (South Africa).
Your data is yours. We only use it to do our job. We don't sell it, we don't use it to train AI, and we don't share it with other companies unless we absolutely have to or you've said it's okay. If something goes wrong, we'll tell you quickly.
Third parties (Microsoft, etc.)
Our Services depend on third-party platforms, most notably Microsoft 365 and the Microsoft Azure cloud. These platforms have their own terms of service and are provided by Microsoft Corporation, not by us.
By subscribing to our Services, you acknowledge that:
- Microsoft may update, change, or discontinue features of Microsoft 365;
- outages affecting Microsoft's systems can affect the Services we deliver;
- if you purchase Microsoft licences through us (as a Microsoft Partner), you also agree to the Microsoft Customer Agreement; and
- we are not responsible for Microsoft's actions or omissions, but we will use reasonable efforts to assist you when third-party issues affect your service.
We rely on Microsoft to do the work we do. When Microsoft has problems, we have problems. We'll help you through it, but we can't make Microsoft do things Microsoft doesn't want to do.
Intellectual property
The Red Flagg name, logo, product names (including MailCheck™, DarkWebCheck™, Safe Text™, Caller Check™, DeID™), our methodology, reports, and any materials we produce remain the property of Red Flagg Pty Ltd.
We grant you a non-exclusive, non-transferable, revocable licence to use the reports and deliverables we produce for you internally within your organisation for the purpose they were produced.
You may not:
- publish our reports externally without our written consent (a summary or extract with attribution is usually fine — ask us);
- use our trademarks or branding in your own marketing without written consent; or
- claim authorship of our methodology or derived works.
Any feedback or suggestions you provide are given freely; we may use them without obligation.
We own our stuff (the name, logos, reports). You can use our reports for your own team. If you want to share them externally or use our name in your marketing, just ask — we usually say yes.
Warranties and disclaimers
We warrant that:
- we will provide the Services with due care, skill, and diligence, using appropriately qualified personnel;
- we will use reasonable efforts to deliver the Services within the timeframes published on our Website or agreed in your Service Agreement; and
- our Services do not, to the best of our knowledge, infringe the intellectual property rights of any third party.
We do not warrant that:
- our Services will be uninterrupted or error-free;
- our Services will prevent every possible cyber incident;
- third-party platforms (like Microsoft) will always be available;
- any specific cyber maturity score, outcome, or measurable result will be achieved by a particular date; or
- indicative maturity timelines published on our Website (Level 0: 6 to 12 months minimum; Level 1: 12 to 24 months in most environments; Level 2-3: per project) will be met for your specific environment — refer to your Service Agreement for the timeline applicable to your organisation.
Nothing in this clause limits your rights under consumer protection laws that cannot be excluded by contract (see clause 12).
We'll do a professional job. We can't promise we'll stop every possible cyber attack — no one can, and anyone who does is lying. The maturity timelines on our website are good-faith estimates, not guarantees. But we'll work hard, document what we do, and be straight with you.
Consumer law rights
If you are a "consumer" under the Australian Consumer Law (Competition and Consumer Act 2010 (Cth), Schedule 2), our Services come with guarantees that cannot be excluded. These include guarantees that the Services will be provided with due care and skill, and will be reasonably fit for purpose.
You have a right to a refund or resupply if these guarantees are not met. Nothing in these Terms limits your rights under Australian Consumer Law.
Consumer protection by jurisdiction
Australian Consumer Law (Sch 2, CCA 2010). Non-excludable guarantees apply.
State consumer protection laws apply, including the California Consumer Privacy Act for California residents.
Consumer Protection Act, 2008. Non-excludable rights apply to "consumers" as defined.
Consumer law gives you rights we can't take away in a contract. Australian customers, Americans, and South Africans all have some level of baseline protection that these Terms can't override.
Liability
To the extent permitted by law:
- Our total aggregate liability to you under or in connection with these Terms (however arising, including in negligence) is limited to the total fees you have paid us in the 12 months preceding the event giving rise to the claim.
- Neither party is liable for indirect, consequential, special, or punitive damages, including loss of profit, loss of revenue, loss of data, loss of goodwill, or loss of opportunity.
- We are not liable for losses caused by: events beyond our reasonable control (force majeure); your own actions or omissions; third-party platforms (Microsoft, network providers); any failure to follow our security advice; or delays in maturity progression where caused by factors set out in clause 4.
Nothing in this clause limits:
- liability for fraud or wilful misconduct;
- liability for death or personal injury caused by negligence; or
- rights under consumer protection laws that cannot be excluded.
If we mess up, our liability is capped at what you've paid us in the last year. We're not liable for indirect losses like lost profit. If a Level 1 rollout takes longer than expected because of factors outside our control, that's not a liability we cover. Consumer law rights aren't affected by this cap.
Cancellation and termination
Cancellation by you. All Red Flagg subscription plans are monthly, with no lock-in. You may cancel at any time with notice before your next billing date. Cancellation takes effect at the end of the then-current billing month. No refunds are issued for the month in which you cancel, except where required by law.
Cancellation during a maturity rollout. If you cancel mid-way through a Level 1 rollout (or during any multi-month deliverable), the Services up to your cancellation date have already been delivered and remain payable. You retain all reports and deliverables produced up to that point. We are under no obligation to refund or pro-rate fees attributable to work completed.
Senior Protection 28-day trial. Senior Protection plans include a 28-day trial. You can cancel during the trial period for a full refund.
Termination by us. We may terminate these Terms immediately if:
- you breach a material term and don't remedy the breach within 14 days of our written notice;
- you fail to pay an invoice within 30 days of its due date;
- you become insolvent, enter administration, or cease trading; or
- we reasonably believe continuing to provide the Services would put us, you, or other customers at legal or security risk.
On termination. We will:
- offboard our access to your Microsoft environment within 5 business days;
- make your reports and deliverables available for export for 30 days after termination;
- delete operational data within 90 days, retaining only minimal billing records required by tax law; and
- issue a final invoice for any outstanding fees.
You can cancel any time — just tell us before your next bill. If you cancel mid-Level 1 (after, say, 8 of 24 months), you don't get a refund for work we've already done — but you keep everything we've produced. Senior Protection gives you 28 days to try it. If you stop paying or do something seriously wrong, we can end things too. When we part ways, we offboard cleanly and delete your data within 90 days.
Disputes and complaints
If something goes wrong, please tell us first. Email hello@redflagg.com.au with the subject line "Complaint" and we will:
- acknowledge your complaint within 2 business days;
- investigate and propose a resolution within 10 business days where reasonably possible;
- escalate to a Director if we can't resolve it at first instance.
If we can't reach a resolution together, you may refer the matter to an appropriate external body:
- 🇦🇺 Australia: the Office of the Australian Information Commissioner (OAIC) for privacy matters, or the relevant state/territory consumer affairs body.
- 🇺🇸 United States: your state's Attorney General's office or the Federal Trade Commission (FTC).
- 🇿🇦 South Africa: the Information Regulator for privacy matters, or the National Consumer Commission.
Before issuing any court proceedings, each party agrees to attempt good-faith negotiation for a period of at least 30 days.
If you have a problem, tell us and we'll try to fix it within 10 business days. If we can't agree, there are external bodies in each country you can escalate to. We all agree to actually try to work it out before rushing to court.
Changes to these terms
We may update these Terms from time to time. The "Last updated" date at the top of this page tells you when.
For material changes (changes that meaningfully affect your rights or obligations), we will:
- notify you by email at least 30 days before the change takes effect;
- post a summary of the change on this page; and
- allow you to cancel without penalty if you don't accept the new terms.
For minor changes (fixing typos, clarifying wording, adding plain-English summaries), we may update the page without individual notice.
Continuing to use the Services after a change takes effect means you accept the updated Terms.
If we change something important, we'll tell you at least 30 days in advance and you can walk away if you don't like it. Typo fixes we'll just do — no notification needed.
Governing law and jurisdiction
These Terms are governed by the laws of Victoria, Australia. Each party submits to the exclusive jurisdiction of the courts of Victoria, Australia, and courts competent to hear appeals from those courts.
For customers outside Australia, this choice of law does not remove consumer protection rights you may have under the laws of your home jurisdiction that cannot be excluded by contract.
These terms are interpreted under Australian law, and disputes go to Australian courts. If you're based in the USA or South Africa, you don't lose the consumer protections your own country gives you.
Contact us
For questions about these Terms, or anything else:
- Email: hello@redflagg.com.au
- Phone: 1800 930 329 (8am–8pm, 7 days, local time)
- Post: Red Flagg Pty Ltd — ABN 81 683 346 116 — Melbourne, Victoria, Australia
- Partnerships (banks / government): partnerships@redflagg.com.au
- Customer support: support@redflagg.com.au
Got a question about these terms? Email us or call us. A real person will answer.
Questions about these Terms?
We'd rather explain something now than argue about it later. Email us or call and a real person will walk you through anything unclear.