Terms of service

The service

PortfolioPlane is portfolio and delivery governance software provided over the internet. It records what an organization has committed to deliver, what evidence exists for each claim, and who accepted what. It is a register, not an authority: it decides whether a requirement is done in the sense of showing the evidence and the acceptance, and the accountable human is a delivery lead at the customer. Nothing it produces is a compliance assurance, a certification, an audit opinion, or professional advice of any kind.

Accounts and organizations

An account belongs to one person and its credentials are not to be shared. The person who founds a workspace becomes its owner and is responsible for who else is admitted to it and what role each member holds. Roles are enforced in the database rather than in the interface, so a member cannot reach data their role does not carry — including through the product’s own interfaces.

Members may be admitted by invitation, and a workspace may verify a domain it controls so that anyone with an address at that domain can be admitted under the same rule. Verifying a domain requires publishing a record in that domain’s DNS; asserting ownership is not enough, and the product will not accept the assertion on its own.

Plans, the trial, and payment

These rules are what the code does today, stated rather than implied.

• Every new workspace starts with 30 days of the Team plan, with no card required. Nothing is charged during the trial and nothing begins automatically at the end of it.
• When the trial ends, an evaluation tier remains. The workspace keeps one seat and up to ten projects, and everything recorded during the trial stays readable. A trial that lapses does not lock a customer out of their own record.
• Prices are set in Stripe and quoted live from it. The figure on the pricing page and the figure in the workspace upgrade are read from the same place, so they cannot disagree. Enterprise pricing is arranged per estate rather than published.
• A failed payment does not immediately downgrade a workspace. A subscription in arrears retains its plan while the payment issue is resolved, deliberately, because locking a team out of its governance record on the day a corporate card expires punishes the wrong thing.
• Seat and project limits are enforced at the database, not by an interface check that can be worked around.

What you must not put into it

Do not send clinical, payment card, or sensitive personal data into this product. Protected health information as defined by HIPAA, cardholder data as defined by PCI DSS, government identifiers, and comparable sensitive categories are out of scope by agreement. The product asks for none of them, has no field that expects one, and no feature that works better with one. This prohibition binds the party who controls the input, which is the customer.

Where a customer requires a business associate agreement before using the product at all, one is executed on request rather than argued away.

Acceptable use

• Do not attempt to reach another organization’s data, probe the tenant boundary outside a coordinated disclosure, or interfere with the service’s availability for others. Reporting a way in is welcome and the contact page says how.
• Do not resell, sublicense, or provide the service to a third party as your own, and do not use it to build a competing product.
• Do not extract data in bulk by means other than the product’s own export and interfaces, and do not circumvent a rate limit or an access control.
• Do not upload malicious code, or content you do not have the right to put there.
• An environment probe may only be pointed at a system the customer is authorized to test.

Who owns what

The customer owns everything it records. Projects, requirements, findings, documents, figures, notes — all of it stays the customer’s. The license granted to us is the narrow one needed to operate the service for them: to store it, process it, transmit it, back it up, and show it to the people they have admitted to their workspace. We do not use customer content to train models, do not use it to improve the product for anyone else, and do not reference a customer publicly without their agreement in writing.

The software, its interfaces and its documentation remain ours. Feedback may be used freely and without obligation, which is the one thing here a customer gives up by using the product.

Acceptance, agents, and the trail

Two behaviors are terms as much as they are features, because a customer is relying on them.

• An agent cannot accept anything. Automated participants have no account and may propose only; acceptance requires a signed-in person, and the record names them. A customer using this product for governance is relying on that, so it is stated here and not only in the marketing.
• The decision trail refuses deletion to everybody — to a workspace owner, to us, and to the database superuser. It is retained for the life of the tenancy. By using the product a customer accepts that entries recording who accepted what, and when, cannot be selectively removed from a living workspace. Deleting a workspace deletes the workspace and its trail together.

What is deliberately not promised

A page like this usually promises more than the vendor can deliver, and the difference only becomes visible during an incident. So:

• No availability commitment. There is no uptime target today and no measurement that could support one. The security page states what would have to be true before there could be.
• No recovery objective. The managed platform takes daily backups with point-in-time recovery. Nobody here has performed a restore, so no recovery time or recovery point is committed.
• No certification, attestation, or compliance assurance. The product holds no SOC 2, no HITRUST and no FedRAMP authorization, and nothing it outputs is described as certified.
• No data residency commitment. Data is stored in a single United States region and we do not contract to keep it in any particular one.
• The service is provided as is, without warranties of merchantability, fitness for a particular purpose, or non-infringement, to the maximum extent the law allows.

Suspension, termination, and what happens to the data

A customer may stop using the service at any time and may cancel a paid plan from inside the workspace. We may suspend an account that is being used to attack the service or another tenant, or where the law requires it, and we will say why.

On termination, a workspace and its trail are deleted together. A certified deletion process and a full machine-readable tenant export are written and not yet built, which means a customer should not assume today that they can take a complete record with them at the end of a contract. The privacy notice says the same thing in the same words, because a customer who reads one and not the other should not end up with two different impressions.

The terms this page does not state

Limitation of liability, indemnity, the governing law and the venue for a dispute are commercial terms that belong in the agreement an organization signs, and they are set there — with the legal entity named. They are not restated here, and the reason is the same one that governs everything else on this site: a clause written on a marketing page that later disagrees with the clause in the signed agreement is worse than no clause at all, because somebody will act on the wrong one. If you need those terms before you sign, ask for the agreement.

Changes

These terms carry an effective date and a change will move it. A change that materially alters what a customer is agreeing to will be told to customers rather than left to be noticed, and continued use after that notice is acceptance of the change.