Terms of Service

Who we are and how to contact us

We are Highguard Limited, a company registered in England and Wales with number 16780383. Our registered office is Unit 501 Omega Works, 4 Roach Road, London, E3 2NY. References to “Highguard”, “we”, “us” and “our” are to Highguard Limited.

To contact us, email hello@highguard.ai.

References to “you” and “your” are to the organisation that has engaged us and to each person who accesses the service on that organisation’s behalf. If you use the service on behalf of an organisation, you confirm that you have authority to bind it to these terms.

Accepting these terms

By signing in to, accessing or using the service, you confirm that you accept these terms and that you agree to comply with them. If you do not agree to these terms, you must not use the service.

These terms apply together with our Privacy notice and any order form, proposal or service agreement we have agreed with your organisation. If there is a conflict, the service agreement takes priority, then these terms, then the Privacy notice.

Changes to these terms

We may amend these terms from time to time. We will revise the date at the top of this page and, where a change is significant, we will tell your organisation’s primary contact before it takes effect. Every time you use the service, please check these terms to ensure you understand the terms that apply at that time.

The service

Highguard is a managed compliance service. It combines a software platform with work carried out by our staff and by AI agents. The service is designed to help your organisation prepare for, achieve and maintain compliance with frameworks such as the Data Security and Protection Toolkit (DSPT), Cyber Essentials, ISO 27001, UK GDPR and the DCB0129 and DCB0160 clinical safety standards.

The scope of work we perform for your organisation, the frameworks in scope and any add-on services are set out in your service agreement. Where these terms refer to “the service”, they include the platform, the work we do for you and any output we produce.

We may change the platform from time to time, including to reflect changes to compliance frameworks, to improve the service or for business and operational reasons. We will try not to remove functionality that your organisation relies on without reasonable notice.

Accounts and access

Access to the platform is through a single sign-on provider we support. If you are provided with, or choose, login details, access credentials or any other piece of information as part of our security procedures, you must treat that information as confidential. You must not disclose it to any third party.

You must notify us promptly at hello@highguard.ai if you know or suspect that anyone other than you knows your credentials or has accessed your account.

Your organisation is responsible for the people it invites to the service and for the permissions it grants to connected systems. We may disable any credential or account at any time if, in our reasonable opinion, you have failed to comply with these terms.

Your content

“Your content” means the policies, evidence, registers, records, messages and other material that your organisation uploads to the platform, makes available through a connected system or provides to our staff. Your organisation retains ownership of your content.

You grant us a non-exclusive, royalty-free licence to store, process, analyse and reproduce your content for the purpose of providing the service to your organisation, including sending relevant content to the AI and document-processing providers we use to deliver the service. We will not use your content to train general-purpose AI models.

We may use data about how the service is used, and information derived from your content that has been aggregated or anonymised so that it does not identify your organisation or any individual, to operate, improve and develop our services and to produce benchmarks and insights.

You warrant that you have the right to provide your content to us, that it does not infringe the rights of any third party and that you have any permissions required to connect the systems you connect.

You are responsible for the accuracy and completeness of your content. We rely on it when assessing your compliance position. We do not independently verify your content unless the service agreement says we will.

Where you use the service to share your content or our output with a third party, such as an assessor, a customer of yours or a supplier, your organisation decides what is shared and with whom, and is responsible for that decision. We are not responsible for what a third party does with content you have chosen to share.

Output we produce for you

Policies, questionnaire answers, registers and other documents we prepare for your organisation are yours to use for your organisation’s compliance purposes once approved. We retain ownership of the templates, methods, prompts and know-how used to produce them and may reuse those for other customers.

Our intellectual property

We are the owner or the licensee of all intellectual property rights in the platform and in the templates, methodologies, agent prompts and other materials we use to deliver the service. Those works are protected by copyright laws and treaties around the world. All such rights are reserved.

We grant your organisation a non-exclusive, non-transferable right to access and use the platform for its internal compliance purposes for the duration of your service agreement.

No text or data mining

You must not conduct, facilitate, authorise or permit any text or data mining or web scraping in relation to the platform or the service, including using automated tools to extract content or to train AI systems. This prohibition applies whether or not the mining is for a commercial purpose, except to the extent that section 29A of the Copyright, Designs and Patents Act 1988 cannot be excluded by contract.

AI output and compliance outcomes

The service helps your organisation prepare evidence, documents and responses. A compliance status shown in the platform reflects our assessment of the work done at that time. It is not a prediction of what an assessor, auditor, certification body or regulator will decide. Those decisions rest with them.

Draft documents, proposed answers, risk ratings and other output may be produced with AI. AI can be wrong. Anything submitted to a regulator, certification body, customer or other third party in your organisation’s name always requires your organisation’s approval first. Internal actions, such as updating a register or filing evidence, are carried out in accordance with the approval settings your organisation has agreed with us and are recorded so that you can review them. Your organisation remains responsible for reviewing output before approving it, for the accuracy of anything submitted in its name and for its own compliance obligations.

Nothing in the service constitutes legal, regulatory or clinical advice on which you should rely. Where a framework requires a named professional, for example a Clinical Safety Officer or Data Protection Officer, that role is provided only where your service agreement says so.

Acceptable use

You may use the service only for lawful purposes. You must not use the service:

• in any way that breaches any applicable local, national or international law or regulation;
• to upload content that you are not entitled to share with us or that infringes any third party’s rights;
• to upload patient records or other special category data outside the scope agreed in your service agreement;
• to knowingly transmit any data, or send or upload any material, that contains viruses, trojan horses, worms, or any other harmful programs or code;
• to gain unauthorised access to the platform, the server on which it is stored or any server, computer or database connected to it;
• to attack the platform via a denial-of-service attack or a distributed denial-of-service attack;
• to copy, reverse engineer or build a competing service from the platform or our output;
• to share your access with any person outside your organisation without our written agreement.

Breaching this section may be a criminal offence under the Computer Misuse Act 1990. We will report any such breach to the relevant law enforcement authorities and will cooperate with them by disclosing your identity to them. In the event of such a breach, your right to use the service will cease immediately.

Fees and payment

Fees are as set out in your service agreement or, where no separate agreement exists, as published on our website at the time you sign up. Fees are exclusive of VAT, which is payable in addition.

Fees for third-party auditors, certification bodies and testing providers are passed on at cost. We will not commit your organisation to any such fee without your approval.

Invoices are payable within the period stated on the invoice. If an invoice is not paid when due, we may suspend the service on 7 days’ written notice until payment is received.

Data protection and confidentiality

Where we process personal data contained in your content on your organisation’s behalf, your organisation is the controller and we are the processor. We will process that personal data only on your documented instructions and in accordance with our service agreement, which incorporates the data processing terms required by Article 28 of the UK GDPR.

Where we process personal data for our own purposes, such as managing your account and our relationship with your organisation, our Privacy notice explains how we do so.

Each of us will keep the other’s confidential information confidential and use it only for the purposes of the service. This does not apply to information that is public, already known to the recipient, independently developed or required to be disclosed by law. Your content and the output we produce for you are your confidential information.

Connected systems and third parties

The platform can connect to systems your organisation uses, such as Microsoft SharePoint, Microsoft Entra ID, Microsoft Intune, Confluence and GitHub. We access connected systems with your organisation’s permission and only to the extent of the permissions you grant. You are responsible for the accounts, permissions and content in those systems, and for any charges imposed by their providers.

We use third-party providers for hosting, authentication, communications, analytics, AI and document processing. We remain responsible to you for their performance of our obligations.

Where the platform contains links to other sites and resources provided by third parties, those links are provided for your information only. We have no control over the contents of those sites or resources.

Availability, suspension and termination

We do not guarantee that the platform, or any content on it, will always be available or be uninterrupted. We may suspend or withdraw or restrict the availability of all or any part of the platform for business and operational reasons. We will try to give you reasonable notice of any suspension or withdrawal.

We do not guarantee that the platform will be secure or free from bugs or viruses. You are responsible for configuring your information technology, computer programmes and platform to access the service and should use your own virus protection software.

Ending the service

Either of us may end the service in accordance with the notice period in your service agreement. Either of us may end it immediately by written notice if the other commits a material breach that is not remedied within 30 days of being asked to, or becomes insolvent.

When the service ends, your access to the platform will stop. On request within 30 days of the end date, we will provide a copy of your content and approved output in a reasonable format and then delete your content from our systems, subject to our legal retention obligations and the backup arrangements described in our Privacy notice. Disconnecting a connected system does not by itself delete records already imported.

Our liability

We do not exclude or limit in any way our liability to you where it would be unlawful to do so. This includes liability for death or personal injury caused by our negligence, and for fraud or fraudulent misrepresentation.

Subject to the paragraph above, we will not be liable to you for any loss of profit, loss of business, business interruption, loss of business opportunity, or any indirect or consequential loss, whether arising in contract, tort (including negligence), breach of statutory duty or otherwise.

We are not liable for any failure to obtain or retain a certification, accreditation, contract or regulatory approval, or for the consequences of any decision made by an assessor, auditor, certification body, regulator or customer of yours.

Subject to the paragraphs above, our total aggregate liability to your organisation in respect of all claims arising in any rolling 12 month period ending on the date a claim is made shall not exceed the fees paid by your organisation to us in that period.

Your organisation will indemnify us against any losses, liabilities and costs we incur as a result of your breach of these terms, including any claim that your content infringes a third party’s rights.

Governing law

These terms, their subject matter and their formation (and any non-contractual disputes or claims) are governed by English law. The courts of England and Wales have exclusive jurisdiction.