Terms and Conditions

By accessing or using the FormaOS platform, website, or related services (the Services), you agree to be bound by these terms. If you do not agree, you may not access or use the Services. If you accept these terms on behalf of an organisation, you confirm you are authorised to bind that organisation.

FormaOS is a compliance operating system. It is used to model governance frameworks, manage controls, assign and track operational work, and produce audit-ready evidence. Features available to you depend on your plan and any executed order form.

We may change, add, or withdraw features. Where a change materially reduces functionality you rely on, we will give reasonable notice.

You must:

• be authorised to act on behalf of your organisation
• provide accurate and current account information
• keep credentials and multi-factor devices secure

You are responsible for all activity under your account, including the actions of users you invite. Tell us promptly if you suspect unauthorised access.

You agree not to:

• use the platform for unlawful, fraudulent, or unauthorised purposes
• interfere with system integrity, security, or performance
• reverse engineer, scrape, or resell the platform
• upload malicious code or knowingly harmful data

We may suspend access where use creates a security, legal, or operational risk. Where practical, we will contact you before suspending.

You retain ownership of all data you upload (Customer Data). You grant us a limited licence to process, store, and display that data for the sole purpose of providing the Services, and to maintain backups and operational continuity.

We do not sell Customer Data and we do not claim ownership of it. Processing terms, including the roles of controller and processor, are set out in the Data Processing Agreement. The third parties that process data on our behalf are listed on the sub-processors page.

Each party will protect confidential information disclosed by the other, including business data, technical architecture, and proprietary workflows, and will use it only to perform its obligations. This obligation survives termination.

FormaOS is built for regulated environments. We implement:

• AES-256 encryption at rest and TLS 1.3 in transit
• tenant isolation enforced by database row-level security
• role-based access control and multi-factor authentication
• append-only, tamper-evident audit logging

Our security posture is documented at formaos.com.au/security, and incident handling, including notification, is described in the incident response document. No system can guarantee absolute security, and nothing here is a warranty that a security incident will not occur.

We aim for high availability but do not guarantee uninterrupted access. Maintenance, updates, and upstream provider events may affect the Services. Availability expectations that apply to your plan are described on the service level page, and contractual commitments, where they exist, sit in your executed agreement.

Where fees apply:

• subscription fees are billed in advance
• payments are non-refundable unless required by law
• pricing and plan inclusions may change with notice

Nothing in these terms limits your rights under the Australian Consumer Law.

All FormaOS software, designs, branding, framework mappings, and proprietary processes remain owned by FormaOS Pty Ltd. You may not copy, modify, distribute, or create derivative works without written permission. Feedback you send us may be used to improve the product without obligation to you.

We may suspend or terminate access if:

• these terms are breached
• required payments are not made
• continued use creates legal or operational risk

On termination, access ceases. You can export compliance data, evidence, and audit records before your export window closes; deletion timing and written confirmation follow your executed agreement and the retention terms in the Data Processing Agreement.

To the maximum extent permitted by law, FormaOS is not liable for indirect, incidental, or consequential loss, including business interruption, loss of data, or regulatory penalties arising from use of the Services. FormaOS does not provide legal or regulatory advice, and use of the platform does not guarantee a compliance or audit outcome.

Some rights and remedies under the Australian Consumer Law cannot be excluded. Where they apply, this clause is read subject to them.

You agree to indemnify FormaOS against claims arising from your use of the Services, your breach of law or third-party rights, and the data or operational decisions you record in the platform.

These terms are governed by the laws of Australia. Disputes are subject to the exclusive jurisdiction of Australian courts.

For legal enquiries, contact support@formaos.com.au or call +61 469 715 062.

Related documents: Privacy Policy, Data Processing Agreement, and the Trust Center.