Terms of service

1. Who we are

ConfigCheckup is provided by ConfigCheckup Ltd, a company registered in England and Wales (company number 17509228), registered office 20 Wenlock Road, London, England, N1 7GU (“we”, “us”). These terms form an agreement between us and the organisation that creates a ConfigCheckup workspace (“you”). The person accepting them confirms they are authorised to bind that organisation. ConfigCheckup is for business use only; it is not offered to consumers.

2. The service

ConfigCheckup assesses the configuration of Microsoft 365 tenants you connect, using read-only permissions granted by each tenant's administrator, and produces findings, scores, reports, baselines and Cyber Essentials readiness views. Optional automated changes are available only where a tenant administrator grants the separate write permissions and you switch automation on for that tenant.

We will provide the service with reasonable skill and care and may improve or change it over time. We will not make a change that materially reduces the core functionality of your plan during a paid period without telling you in advance. We aim for high availability but do not guarantee the service will be uninterrupted; current status is shown on the status page.

ConfigCheckup is independent and is not affiliated with, endorsed by or sponsored by Microsoft Corporation. It relies on Microsoft services that we do not control: what it can read or change depends on Microsoft's interfaces, permissions and licences, which Microsoft may change, limit or withdraw at any time.

3. Accounts and security

You are responsible for the people you invite to your workspace, the roles you give them and everything done under your accounts. Keep sign-in details confidential, use two-step verification or Sign in with Microsoft, and remove people who no longer need access. Tell us promptly at support@configcheckup.com if you suspect unauthorised access.

4. Authority to connect tenants

You must only connect a Microsoft 365 tenant that belongs to you or that you are authorised to assess by its owner, such as a tenant who has engaged you as their managed service provider or consultant. You confirm that, for every tenant you connect, you have that authority and any notices or agreements your tenant needs, and that the tenant administrator granting consent is entitled to do so. You will stop using a tenant's data and disconnect it when that authority ends.

5. Acceptable use

You must not, and must not allow anyone else to:

• use ConfigCheckup to access, test or collect information about a tenant without authority;
• attempt to breach the security of ConfigCheckup or other customers' data, or probe it except under our vulnerability disclosure policy;
• copy, resell or provide ConfigCheckup as a service to others except as your plan allows, or reverse engineer it except where the law permits;
• use it in breach of law, including data protection law, or to build a competing product;
• overload the service, or use automated means to access it other than the features and API we provide;
• use it if you, or anyone who controls you, is the subject of UK, EU, UN or US sanctions, or from a country or region subject to comprehensive sanctions.

You are responsible for everything done through your workspace, its API keys and its integrations, and for the accuracy of what you tell us.

6. Trial, plans and fees

• A new workspace starts with a free trial, unless you choose a plan to buy when you sign up. The trial runs for 14 days from the day your first tenant connects, or 30 days for a school, college or other public body we have verified, or for a workspace that signs up from a customer’s recommendation link and whose owner confirms their email address (at most 10 such workspaces in any 12 months from one link, and not the same person or company as the recommending workspace), and you have 30 days from sign-up to connect one; a trial that has connected none by then ends. The workspace's Owner can extend a running trial once, by 7 days. No payment details are needed for the trial, and nothing is charged unless you choose a plan. You do not have to use the trial first: a workspace made to buy a plan starts with no trial and no plan, and the plan starts once it is paid for or invoiced. Until then the workspace is read-only, and its Owner may start the trial instead, subject to the rule below that a trial is available once per email address and once per tenant in any 60 days. You can also choose a plan at any time during or after a trial.
• The trial includes what the pricing page says it does, on up to 3 tenants with 3 seats, and 5 assessments you start and 3 reports for each tenant a month, up to 3 leads at once and 3 lead health checks a month; scheduled assessments and fix checks do not count towards them. It does not include approved changes in a tenant, the API, webhooks, custom rules, white label or replies on the portal, and reports made during the trial carry a small “Made with ConfigCheckup · Trial” line. A trial already running when these terms changed keeps the terms it started on until it ends.
• A free trial is available once per email address, and once per Microsoft 365 tenant, in any 60 days. A trial counts against an address once its owner confirms it, and against a tenant once it is the first tenant a trial connects. A workspace signed up with an address that has had a trial in that time starts without a plan, or loses its trial when the address is confirmed; a trial that connects a tenant another trial connected in that time ends when it does. Either way you can choose a plan straight away.
• There is no free plan. When a trial ends, or a subscription ends, without a plan chosen, the workspace becomes read-only: you can still sign in and view and download what it holds, but new assessments, reports and changes wait until you choose a plan. Assessment history is kept for 12 months, always keeping the latest for each tenant.
• The plans are Monitor and Automate, the same for every customer, whether you look after tenants or your own organisation. Each is priced by the number of tenants you choose to pay for: a price for the first tenant, a price for each from the 2nd to the 50th, and a lower price for each from the 51st, as the pricing page shows. A plan's seats are its own, or one for each tenant you pay for when that is more. A school with its own Microsoft 365, including each such school in a trust, is a tenant like any other; schools that share one tenant count as that tenant, by its staff users.
• A tenant counts towards the tenants you pay for once for every 150 staff users it has, or part of 150, counted at each assessment. Staff users are enabled member users with a licence that is not a student one: students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count. A tenant with more than 500 staff users, or more than 300 tenants in one workspace, is covered only by Enterprise terms. A subscription that began before 6 November 2026 keeps the earlier figures: once for every 300 staff users, and Enterprise terms for a tenant with more than 2,500.
• Enterprise is priced by quote, at least Automate’s list price for the same tenants, a tenant over 500 staff users counting once, plus one staff band for each 150 staff users above 500 in a tenant, priced like tax bands: £50 a month each for the 1st to the 5th and £400 from the 6th, and a platform fee of £500 a month, billed yearly (£6,000 a year); in dollars, the staff bands are $65, $520 a month by the same brackets and the platform fee $650 a month, billed yearly ($7,800 a year). A year of staff bands costs ten months. Add-ons agreed in a quote are priced in it. A quote made before 6 November 2026 keeps its terms for as long as it runs.
• Automate also covers one test tenant free of charge: a tenant you mark Pilot or Lab, with up to 25 licensed users, whose only domains are Microsoft's own (onmicrosoft.com) or subdomains of another of your tenants' domains. It is for trying changes before they reach other tenants, not for production use. A tenant marked Pilot or Lab that does not meet these conditions counts like any other. Monitor makes no changes in a tenant, so it covers no test tenant.
• You cannot pay for fewer tenants than your tenants count as: remove some first. If your tenants come to count as more than you pay for, for any reason (more tenants, a larger tenant, or a tenant marked Pilot or Lab that is not a test tenant), we will tell your workspace's Owners, and you have 14 days to add tenants, change plan or disconnect a tenant; after that the workspace becomes read-only until your plan covers them again.
• Switch offer: if you tell us you are paying for a comparable tool under a contract, the first paid plan you choose may be free until that contract ends, for up to 2 months. Payment details are taken at checkout and the first payment is taken when the free period ends. A plan taken with the offer is billed monthly, and the offer does not combine with any other discount. The offer is once per workspace; we may ask for evidence of the contract and end the free period if the details given were not accurate.
• Promotion codes apply to monthly billing only. They do not combine with the switch offer, yearly billing or a founding price lock, and none takes more than 33% off.
• Paid plans are billed in advance, monthly or yearly, at the prices shown on our pricing page when you subscribe; a year costs ten months. We are not yet registered for VAT, so no VAT is charged. Once we are registered, VAT is added at the standard rate, and we will tell you before it is. Payments are processed by Stripe.
• Yearly plans may be paid by invoice quoting your purchase-order number, by bank transfer, Bacs Direct Debit or card, within 30 days of the invoice. The plan starts when the invoice is issued, and an invoice unpaid after its due date is treated as a failed payment.
• Subscriptions renew automatically at the end of each period until cancelled. You can cancel at any time in Settings; cancellation takes effect at the end of the period you have paid for, and fees already paid are not refunded except where the law requires.
• You can change plan or tenants at any time. A move up (to Automate, or to more tenants) takes effect at once, and the difference for the rest of the period is charged then. A move down (to Monitor, or to fewer tenants, on the same billing period) also takes effect at once, and the lower price is charged from your next renewal, with nothing back for the time already paid. Automate has a minimum of 3 months before a workspace can move to Monitor, counted from when it came on to Automate, whether by changing plan or by cancelling and then buying Monitor; until then it can choose Automate again. Cancelling is never refused. A subscription already on Automate on 11 October 2026 is not held to the minimum.
• We may change prices with at least 30 days' notice, taking effect from your next renewal. If a payment fails and is not resolved within 14 days of our reminder, we may suspend paid features.
• A subscription on a plan we no longer sell (such as Scale or a Direct plan) keeps its price and terms for as long as it continues, including when you change its tenants or billing period; choosing Monitor or Automate moves it to today's prices. A subscription on an earlier price of Monitor or Automate keeps that price when you change its tenants or billing period, and may choose fewer tenants than it was sold with: you pay whichever is lower for the tenants you choose, its earlier price or today's. A quoted plan (Enterprise, or a quote for a school or trust) keeps its price, and changes to it are made through us, by a revised quote.
• Founding partners: if your workspace subscribed while the founding offer was open, its plan's prices, for every tenant, will not rise above what they were when you subscribed until 31 October 2029, for as long as the subscription continues, including when you change tenants or billing period. Whenever today's prices come to less for your tenants, you pay today's, and if your tenants change so that the locked prices come to less again, you pay those. If you choose another plan, its prices on that day are locked in the same way until the same date. After that date, prices may change as described under “We may change prices” above.
• Credits. Credits pay for optional extras; everything else in your plan is included and never uses them. Your plan includes credits each calendar month, as the console shows; a trial includes 10 credits once. Unused monthly credits do not carry over. Credits you buy, and credits we give you (such as welcome credits or credits for a recommendation), last 12 months. Credits each month that you add to your plan arrive with each payment for them and last until the next. Credits that end soonest are used first. An extra turned on for a set time is paid for in full when you turn it on and does not renew; if you turn it off early, the months not yet started are given back as credits. If an extra cannot be made, its credits are given back, except credits from a pack whose payment was refunded. If you stop credits each month, those already paid for stay until they end. Credits have no cash value and cannot be transferred. Fees for credits are not refunded, except that a pack bought by mistake and not used is refunded if you ask within 14 days, and its credits are then removed. Credits for a recommendation are given once the recommended workspace has paid for two months and assessed a tenant, while the recommending workspace is still on a paid plan, and may be removed if the rules for recommendations were not met. Credits given in error may be removed. The founding price lock covers plan and tenant prices, not credits.

7. Changes to tenants

ConfigCheckup never changes a tenant unless automation has been enabled for it, a change has been proposed, a dry run has succeeded and the change has been approved in ConfigCheckup by an authorised person. You decide which changes to make and are responsible for them and their effect on your or your tenant's environment, including communicating with affected users. Review each proposed change before approving it, and use the rollback provided where appropriate.

An approval in ConfigCheckup is your instruction to make that change. A dry run and a rollback reduce risk but cannot remove it: a change can lock people out, stop mail flowing or affect other systems, and Microsoft does not allow every change to be undone. Before switching automation on, make sure you have another way in to each tenant (such as an emergency access account) and that the tenant's owner has agreed to changes being made this way.

8. What results mean

Findings, scores and reports reflect the configuration ConfigCheckup could read at the time, using the permissions and licences available. Checks that could not run are reported as not assessed. ConfigCheckup helps you identify and prioritise improvements; it does not guarantee that a tenant is secure or free from compromise, and it is not a substitute for professional judgement. Cyber Essentials readiness is an aid to preparing for assessment; it is not certification, which is awarded only by an IASME certification body.

The same goes for framework mappings, insurance answers, licence savings, evidence packs and anything else ConfigCheckup produces: they are information to help you decide, not legal, compliance, insurance, financial or audit advice, and no insurer, auditor, regulator or certification body is bound by them. Check them before you rely on them or give them to anyone else.

9. Ownership

You (or your tenants) own the data read from your tenants and the content you add. You give us the rights we need to process it to provide the service, as set out in the data processing agreement. You may share the reports ConfigCheckup produces with the tenants they relate to. We own ConfigCheckup, its software, rules, report templates and documentation; you receive a non-exclusive right to use them while your subscription lasts. If you send us suggestions, we may use them freely.

10. Confidentiality

Each of us will keep the other's confidential information confidential, use it only for this agreement, and disclose it only to people who need it and are bound by similar duties, or where the law requires.

11. Data protection

Where we process personal data from your tenants on your behalf, we do so as your processor (or sub-processor, where you act for a tenant) under the data processing agreement, which forms part of these terms. How we handle the personal data of the people who use ConfigCheckup is described in the privacy notice, and what we read, keep and protect is set out on the data protection page.

12. What we promise, and what we do not

We promise to provide the service with reasonable skill and care, substantially as described on our website. If it does not, tell us and we will put it right within a reasonable time; if we cannot, you may end the affected subscription and we will refund the fees paid for the time after it ends. That is your only remedy for the service not being as described.

Apart from what these terms say expressly, the service is provided as it is and as available. All other warranties, conditions and terms, whether implied by statute, common law or otherwise (including about satisfactory quality, fitness for a particular purpose and accuracy), are excluded as far as the law allows. In particular, we do not promise that the service will be uninterrupted or free of errors, that it will find every weakness, misconfiguration or threat, or that using it will make a tenant secure, compliant, insurable or certified.

You promise that you have the authority described in section 4, that what you give us is accurate, and that your use of the service and your instructions to us comply with the law.

13. Your own clients

If you use ConfigCheckup to provide services to others, such as the organisations whose tenants you look after, those services and your contract with them are yours alone. We have no contract with them and owe them no duty. You must not make any promise to them on our behalf or about what ConfigCheckup will achieve, and you are responsible for any report, score or advice you pass on to them. We recommend your own terms with them limit your liability at least as far as these terms limit ours.

14. Claims against us

You will indemnify us, and keep us indemnified, against all losses, damages, fines, costs (including reasonable legal fees) and liabilities arising from any claim, investigation or demand by a third party (including your clients, the owners and users of a tenant you connect, Microsoft or a regulator) to the extent it arises from:

• connecting, assessing or changing a tenant without the authority section 4 requires;
• a change made in a tenant on your approval or instruction, or your failure to act on a finding;
• your breach of section 5 or of data protection law, or an instruction from you that breaches the law;
• the services you provide to your own clients, or anything you tell them about ConfigCheckup or its results.

We will tell you promptly about any such claim, let you conduct its defence at your cost, give you reasonable help, and not settle it without your agreement (which you will not unreasonably withhold).

15. Suspension and ending

• You may cancel your subscription at any time in Settings, and ask us to close your workspace at any time by emailing support@configcheckup.com.
• We may suspend access immediately if needed to protect the service or others, or if you seriously breach these terms; we will tell you why and restore access once the issue is resolved.
• Either of us may end this agreement by notice if the other seriously breaches it and does not put it right within 30 days of being asked to, or immediately if the other becomes insolvent or stops trading.
• We may also end this agreement for any reason with 90 days' notice, and will refund any fees you have paid in advance for the time after it ends.
• When the agreement ends, access stops. You can export reports before then. We delete your workspace data within 30 days of closure, except records we must keep by law (such as billing records).

16. Liability

Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law. Nor do they limit your duty to pay our fees or your obligations under section 14.

Subject to that, we are not liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for:

• loss of profit, revenue, business, contracts, goodwill or anticipated savings;
• loss or corruption of data, beyond restoring it from our most recent backup;
• any indirect or consequential loss;
• any loss arising from a change made in a tenant on your approval or instruction, a decision you make (or do not make) on a finding, report or score, an attack on or compromise of a tenant, or the acts or omissions of Microsoft or any other third party, including changes to or outages of their services.

Subject to the first paragraph of this section, our total liability arising from or in connection with these terms and the data processing agreement together, in any 12-month period, is limited to the fees you paid or must pay us for that period, or £100 if you have paid none. Any claim must be brought within one year of the day the person making it knew, or ought reasonably to have known, of it.

Each of us agrees these limits are reasonable, taking account of the fees, that you decide which changes are made in your tenants, and that you are better placed than us to know the value of your own business and to insure against its risks.

17. Events beyond our control

Neither of us is responsible for a delay or failure caused by events beyond our reasonable control, including the failure, change or withdrawal of a Microsoft service, outages of hosting, internet or power, cyber attacks we could not reasonably have prevented, and acts of government, war, pandemic or natural disaster. This does not excuse a duty to pay. If such an event stops the service for more than 30 days, either of us may end the affected subscription by notice.

18. Trials, free tools and the website

Free trials, the free tools on our website (such as the email security check and MFA readiness check), our guides, checklists and other website content are provided free, as they are, for general information. They are not professional advice, and we give no promise about their accuracy or completeness. Use a free tool only on a domain or organisation you belong to or are allowed to check. As far as the law allows, we are not liable for any loss arising from using them or relying on them; where we cannot exclude liability, section 16 applies.

19. Changes to these terms

We may update these terms. We will give at least 30 days' notice by email of changes that materially affect you; if you do not agree, you may cancel before they take effect. The date at the top shows when they last changed.

20. General

• These terms, the data processing agreement and any order or quote we sign with you are the whole agreement between us about ConfigCheckup. Neither of us has relied on any statement not set out in them, though nothing here excludes liability for fraud. A signed order or quote prevails over these terms where they conflict.
• Only you and we have rights under these terms. No one else, including your clients and the owners or users of a tenant you connect, may enforce them under the Contracts (Rights of Third Parties) Act 1999 or otherwise.
• You may not transfer your rights or obligations under these terms without our written agreement. We may transfer ours to a company that takes over ConfigCheckup or our business, and will tell you if we do. We may use subcontractors and sub-processors, and remain responsible for them.
• If a court finds part of these terms unenforceable, the rest still applies, and that part applies with the smallest change needed to make it enforceable. A delay in enforcing a right does not waive it.
• Nothing in these terms makes either of us the other's partner, agent or employee.
• We send notices to the email address of your workspace's Owners; send yours to support@configcheckup.com. An email notice is received when sent, unless the sender is told it failed.
• Sections 8, 9, 10, 13, 14, 16, 18, 20 and 21, and anything else that by its nature should, continue after this agreement ends.

21. Law and disputes

These terms, and any dispute or claim arising from them or their subject matter (including non-contractual ones), are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Before starting proceedings, please contact us at support@configcheckup.com so we can try to resolve the matter; if it is not resolved within 30 days, either of us may go to court. Nothing stops either of us from asking a court for urgent relief at any time.