Terms of Service

Acceptance of Terms

By accessing or using Do GRC, you agree to be bound by these Terms of Service and all applicable laws and regulations. If you do not agree with any part of these terms, you should not use the platform.

Eligibility

You must be at least 16 years of age to use Do GRC. By using the platform, you represent that you meet this age requirement and have the legal capacity to enter into these terms.

Accounts and Access

You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account. You agree to:

• Provide accurate and complete registration information.
• Notify us immediately of any unauthorised use of your account.
• Not share your account credentials with third parties.
• Not create multiple accounts for the purpose of abusing the platform.

Plans and Subscriptions

Do GRC offers three membership tiers, and team plans that buy Plus and Pro seats for a group (see Team Plans below): Free, Plus, and Pro. The Free tier provides access to a limited set of starter learning paths, limited AI checks, limited text-to-speech characters, and unlimited answer reveals. The Plus tier unlocks full site access including intermediate and advanced learning paths, scenario submissions, case studies, the GRC Coach, GRC Tools, Interview Prep, Exam Prep, the Resume Point Generator, Role Play, and additional AI checks with essential daily quotas. The Pro tier provides the same feature access as Plus with higher daily quotas for AI checks, text-to-speech characters, scenario submissions, and AI Populate — intended for heavy daily use. The Pro tier additionally includes the answer key: the accepted answers for every room question, the answers for every lab, and a model answer for every scenario task, shown under each question once you switch the answer key on from your profile or inside a room, lab or scenario path. While the answer key is on, no XP or points are awarded for anything you answer anywhere on the platform.

All AI-powered features — including AI answer checks, interview and exam prep grading, role play conversations, resume point generation, Play Arcade AI features, and GRC Toolkit AI Populate — share a single daily pool of AI checks. The size of this pool depends on your membership tier and resets at midnight UTC each day.

Paid subscriptions are billed monthly through our payment processors, Paddle and Stripe. Paddle is the seller of record (Merchant of Record) for every subscription bought through Paddle: it collects payment, calculates and remits applicable taxes (including VAT, GST and sales tax), handles chargebacks, and issues receipts and invoices. Paddle's checkout also supports PayPal as a payment method. When an individual subscription bought through Stripe is sold under Stripe Managed Payments, Stripe is its seller of record in the same way and its terms are shown at checkout; otherwise Do GRC is the seller of record for that subscription, Stripe processes the payment for us, and Do GRC is responsible for any applicable tax, receipts and chargeback resolution. Team plans are covered under Team Plans below. By subscribing, you authorise recurring charges to your selected payment method. You may cancel an individual subscription at any time from your profile; a team plan is cancelled by its owner from the team's page. Access to paid features continues until the end of the current billing period, or of the free trial if you cancel during it; if you cancel while a renewal payment is overdue, the membership ends straight away instead. If a renewal payment fails, your paid features keep working for 3 days so you can update your payment details; if it is still unpaid after that, the subscription is cancelled and nothing more is charged for it.

Renewal and free trial. Paid memberships renew automatically each month at the price shown at checkout when you subscribe, until you cancel. Plans are listed in US dollars, with any sales tax, VAT or GST included, and checkout always shows the final amount before you pay. Before checkout you tick a box agreeing to the renewal terms. We keep a record of that agreement (when you agreed, the plan, the price, the payment provider and the version of the wording you saw) as proof of your consent, including after you delete your account. Plus and Pro start with a 3-day free trial for first-time members, one per person: an account or email address that has had a free trial before does not get another. You are not charged during the trial; unless you cancel before it ends, the monthly price is charged when it ends. You can change plan from your profile page, or, for a subscription bought through Stripe, in Stripe's billing portal opened from there. For a subscription bought through Paddle, an upgrade starts straight away and the prorated difference is charged that day.

Refunds and discounts. Do GRC subscriptions are sold at the listed price only, and we do not issue discount codes, promo codes or coupons. We do not give refunds if you change your mind, including for unused time or a subscription you cancel part-way through a billing period. This does not limit your rights under the Australian Consumer Law or any other consumer law that cannot be excluded, including a refund where we fail a consumer guarantee and any right to cancel within a cooling-off period. If you were charged after you tried to cancel, or in error, contact us and we will put it right. See the Refund Policy for details.

Changes to plans and prices. We may change membership tiers, features, usage quotas, the AI models that power features, and prices. We will give you at least 30 days' notice by email before a price increase, or a change that significantly reduces what your plan includes, takes effect for you, and you can cancel before it does. Such a change takes effect from a later billing period, never part-way through one you have already paid for. This promise covers every change these Terms let us make to a paid plan, including to its usage limits, quotas and AI-powered features. The only exception is a change, other than a price increase, that we must make sooner to keep Do GRC or its members secure, to stop abuse, or to comply with the law. We will make that change only as far as needed and tell you about it as soon as we can. If you do not accept it, you can cancel. Changes that don't significantly reduce what your plan includes, such as adding features or changing which AI model powers a feature, may be made at any time. None of this limits your rights under the Australian Consumer Law or any other consumer law that cannot be excluded; those rights may include a refund.

Team Plans

A team plan is one subscription that pays for a group's seats. The person who buys it owns the team. The owner chooses how many Plus and Pro seats to buy and can make other members admins. The owner and admins can add and remove seats, which is billed to the team's plan, invite people by email, and give seats out and take them back. A member's access is the higher of their own plan and the seat they hold. A seat gives nothing else: each member keeps their own account, progress and any plan of their own, and you can be in one team at a time.

Billing. Team plans are billed monthly, per seat, in US dollars (USD), through Stripe, at the prices shown before checkout, with no free trial. When a team is sold under Stripe Managed Payments, Stripe is the seller of record for that purchase, its terms are shown at checkout, and it is responsible for tax, receipts and disputes; otherwise Do GRC is the seller of record and Stripe processes the payment for us. Seats added during a billing period are charged pro rata for the rest of it, either at once or on the next invoice; seats removed are credited pro rata against the team's next invoices. That credit is the only exception to the change-of-mind rule above: if the team's plan ends before the credit has been used, we refund what is left of it on request. A pool of seats cannot be reduced below the number of seats given out from it.

Cancelling and failed payments. The owner can cancel the plan at any time, and its seats keep working until the end of the period already paid for. If a payment fails, the seats keep working for 7 days while Stripe retries the card; if it is still unpaid then, the plan is cancelled. If a pool ever has fewer seats than have been given out from it, the seats given out most recently lapse at the end of the same 7 days unless seats are added or taken back first.

The owner's responsibilities. The owner is responsible for the team: for who holds its seats, for the admins they appoint and what those admins do, including seats they add, and for paying for the plan. By inviting someone, an owner or admin confirms that they are entitled to, and that they will use what the team shows them about its members lawfully and only to support their training, including, where members are their staff or students, telling them what the team can see under their own policies. What the team's managers can see is set out in our Privacy Policy. Once the team's plan has ended, the owner can pass the team to another member, who then takes on these responsibilities and pays for any new plan with their own card. A team cannot change owner while its plan is running, because the plan is charged to the card it was bought with: to hand it over, the owner cancels the plan and, when the period already paid for ends, passes the team on, and the new owner buys a plan. The owner cannot leave the team; to leave, they pass ownership to another member first. The owner of a team whose plan is still running cannot delete their account until the plan ends. Once a team's plan has ended, or if it was never paid for, its owner can delete the team.

Team data. The owner and admins can see members' progress on Do GRC, and export it, only while the team's plan is paid up, including the 7 days its seats keep working after a payment fails. They see each member's progress only from the day that member joined the team, unless the member chooses to share their earlier progress with that team, which the member can turn on or off at any time. When the plan ends, the owner and admins lose that access, and 90 days after it ends we delete the team and its records: its membership, seats, invites and assignments. Members' own accounts and progress stay theirs and are not deleted with the team. The owner and admins may use what they see only to run the team's training, and we handle members' data as our Privacy Policy describes.

Usage Limits

All plans — Free, Plus, and Pro — include usage limits for certain features. These include the shared daily AI checks pool (which covers AI answer checks, interview and exam prep grading, role play, resume generation, Play Arcade AI features, and GRC Toolkit AI Populate), text-to-speech characters, scenario submissions, GRC Coach messages and journey generations, and GRC tool record counts per module. Daily limits reset at midnight UTC; other limits reset at the start of each billing cycle or on a rolling window as applicable.

We may change usage limits, quotas, and the features included in each tier only as set out under Changes to plans and prices above: a change that significantly reduces what a paid plan includes comes with at least 30 days' notice by email, unless we must make it sooner for security, to stop abuse or to comply with the law. Attempting to circumvent usage limits through multiple accounts, automated tools, or any other means is a violation of these terms.

The Answer Key and XP

The Pro tier includes an answer key that you switch on and off yourself from your profile or from inside a room, lab or scenario path. It is off by default. While it is on, the accepted answers for room questions, the answers for lab fields and a model answer for each scenario task are shown to you, and no XP or points are awarded for any answer you give anywhere on the platform — rooms, case studies, labs and scenarios included. Rooms still complete, labs are still scored and scenarios are still graded; only the points are withheld. Switching the key off restores XP for answers given after that point. XP withheld while the key was on is not awarded retrospectively.

The answer key is licensed to you for your own learning for the duration of your Pro subscription. You may not copy, publish, share or redistribute answer-key material, use it to train any machine-learning or generative-AI model, or use it to build a competing product or service. The marking rubrics, tolerances and assessor material behind lab marking are not part of the answer key and are not disclosed. A scenario model answer is one strong answer, not the only one: scenario submissions are still graded by AI on their own merits.

CPE Records

A CPE record states that you completed a learning path or submitted a lab on Do GRC, on the dates shown, and the time credited for it. Time is credited only for work you did yourself: a question you answer within a week of its answer being shown to you, by the reveal or the answer key, earns none, and after a lab's answers are shown only an attempt started at least a week later can earn any, as the CPE page explains. Do GRC is not an approved or pre-approved provider of ISACA, ISC2, the IAPP, CompTIA or any other certifying body. Whether a record counts toward a certification is decided by that body under its own policy, and you are responsible for the claims you make with it, including that the activity fits your certification. A record may only carry the name of the person who did the work, and we may withdraw a record that was issued in error or obtained by misuse. A withdrawn record says so when its code is checked. You can reissue your records in your current name once every 30 days, after which their old codes report only that they were reissued. Records stay available after your subscription ends and are deleted with your account.

Acceptable Use

You agree not to:

• Use the platform for any unlawful purpose or in violation of any applicable laws.
• Attempt to gain unauthorised access to any part of the platform or its systems.
• Interfere with or disrupt the platform's infrastructure or other users' access.
• Scrape, copy, or redistribute platform content without written permission.
• Use automated tools to access the platform in a manner that exceeds reasonable use.
• Share, resell, or transfer your subscription or account access to others.
• Use Do GRC, or its results or certificates, to grade students or award academic credit at a school, college or university.

AI-Powered Features

Do GRC uses AI services to power a broad set of features, including:

• GRC Coach chat and AI-generated learning journeys.
• AI Check and AI Assist on case-study and scenario questions.
• Role Play conversational practice scenarios.
• Lab environment written-answer marking and its feedback.
• Exam Prep and Interview Prep question generation and grading.
• Resume Point Generator.
• Play Arcade AI-generated rounds and AI deep-dive explanations.
• Text-to-speech audio synthesis.
• GRC Toolkit AI-fill helpers (including AI Populate) across the risk, audit, compliance, vendor, threat, policy, business-continuity, and board-reporting modules.
• The generation of core site content such as learning paths, rooms, case studies, and question banks.
• The generation of lab environments in their entirety — the fictional organisation, every artefact of evidence, the questions, the answer keys and the marking rubrics.

AI-generated output — including site content, coaching advice, feedback, scores, model answers, populated data, and synthesised audio — is provided for educational and practice purposes only.

The readings, and the questions and answers, for our learning paths and case studies — together with the readings for our scenarios — have been AI-audited for accuracy, and so has every lab environment. This is an AI audit, not a human or independent professional review, and does not guarantee the accuracy or currency of any content; see the Disclaimer (AI Audit of Content) for details.

Lab environments are AI-generated and, though AI-audited, have not been reviewed by a human. This applies to the whole of a lab, including the answer keys your structured answers are marked against and the rubrics behind written feedback, so a lab may mark a correct answer wrong or an incorrect answer right. See the Disclaimer (Lab Environments Are AI-Generated and Not Human-Reviewed).

AI output may be inaccurate, incomplete, hallucinated, or out of date. It does not constitute professional advice and should not be relied on as a substitute for qualified legal, compliance, audit, or risk management guidance. You are solely responsible for how you use AI-generated content from the platform. See the Disclaimer for the full position on AI-generated content and AI-powered evaluation.

Usage of AI features is subject to the daily and monthly quotas described in the Usage Limits section. We may change, suspend or withdraw an AI-powered feature only as set out under Changes to plans and prices above, so a change that significantly reduces what a paid plan includes comes with at least 30 days' notice by email, unless we must make it sooner for security, to stop abuse or to comply with the law. A feature can still be briefly unavailable, for example during maintenance or an outage at an AI provider we rely on; that is not a change to your plan.

For how AI output is labelled to you, what provenance we record against AI-generated records, and how this maps to the EU AI Act transparency obligations, see AI Transparency.

GRC Tools Data

The GRC Tools allow you to create, store, and manage governance, risk, and compliance records within the platform. This data is stored in your account and is subject to per-module record limits. GRC tool data you create is treated as User Submissions and is governed by the User Submissions section below.

GRC tool data is intended for learning and practice purposes. It is not a substitute for a production GRC system. We do not guarantee data availability, backup, or recovery beyond our standard platform operations. You may export or delete your GRC data at any time through the platform.

Intellectual Property

All content on Do GRC — including learning paths, rooms, scenarios, case studies, GRC tool templates, interview prep questions, exam prep materials, AI Coach prompts, graphics, and trademarks — is owned by or licensed to Do GRC. You may not reproduce, distribute, or create derivative works from platform content without prior written consent.

Free vs Paid Content Licence

Do GRC grants you a limited, personal, non-exclusive, non-transferable licence to access and use platform content strictly for your own individual learning. The licence ends when your membership ends, or if your account is ended under these Terms. The scope of that licence depends on your plan:

• Free tier. You may access the free learning paths, tasks, and any material explicitly marked as free. Free material may be viewed and worked through for personal, non-commercial learning only. You may not copy, republish, redistribute, or use free material to train any machine-learning or generative-AI model, and you may not use it to build a competing product or service.
• Paid tiers (Plus and Pro). A paid subscription additionally unlocks intermediate and advanced learning paths, scenario submissions, case studies, AI marking, the GRC Coach, GRC Tools, Interview Prep, Exam Prep, Role Play, the Resume Point Generator, and other premium features. The difference between Plus and Pro is the size of daily usage quotas and the answer key, which is included with Pro. Paid content is licensed to you only while you have a paid membership or a team seat. The licence to it ends when that membership or seat ends, or if your account is ended under these Terms, and you must stop accessing and using paid material at that point. Any certificates you have already earned remain valid as a record of completion.
• Nothing on the platform — free or paid — may be scraped, mirrored, bulk-downloaded, resold, sublicensed, or shared with third parties. Screenshots and short quotations for legitimate personal study, review, or commentary are permitted provided Do GRC is credited and the material is not republished in a way that substitutes for a licence.

This section sets the outer boundary of what you are entitled to do with our content. Any use that falls outside the scope of the licence granted here is an infringement of our intellectual property rights and a breach of these terms.

User Submissions

Parts of Do GRC let you submit your own content — including scenario responses, case study answers, written tasks, GRC tool records (risks, incidents, policies, vendors, and other data you create in the GRC Tools), GRC Coach conversations, interview prep answers, feedback, and any other material you voluntarily upload, type, or otherwise provide through the platform (collectively, “User Submissions”). This section governs everything you submit.

Your ownership

You retain all ownership and intellectual property rights in your User Submissions. Submitting content to Do GRC does not transfer ownership of that content to us.

Licence you grant to Do GRC

By submitting content to the platform, you grant Do GRC a worldwide, non-exclusive, royalty-free, sublicensable (to our hosting, AI, and infrastructure providers only) licence to host, store, reproduce, transmit, display, and process your User Submissions for the following purposes:

• Operating the platform and delivering the features you use (e.g. saving your progress and showing your submissions back to you).
• Running automated and AI-assisted marking, feedback, and grading on your submissions.
• Generating certificates, progress records, and analytics tied to your account.
• Monitoring for abuse, enforcing these Terms, and complying with legal obligations.
• Improving our services — including debugging, quality assurance, training internal classifiers, and evaluating the performance of our AI marking. Where your submissions are used for service improvement beyond your own account, we will either aggregate or de-identify them so that they are not linked to you.

This licence lasts for as long as we need it to provide and improve the services, and survives termination of your account only to the extent necessary to maintain backups, comply with law, and keep de-identified or aggregated learning signals. You can delete your account at any time; when you do, we will remove your identifiable User Submissions from active systems in accordance with our Privacy Policy.

Your warranties

By submitting content, you represent and warrant that:

• You own your User Submissions or otherwise have all rights, licences, consents, and permissions necessary to grant the licence above.
• Your submissions do not infringe any third party's copyright, trade mark, trade secret, privacy, publicity, or other intellectual property or proprietary right.
• Your submissions do not contain confidential information belonging to your employer, client, or any other party that you are not authorised to share.
• Your submissions do not contain personal data of other individuals unless you have a lawful basis to share it.
• Your submissions do not contain malware, exploit code targeted at real systems, unlawful content, harassment, or material that is defamatory, obscene, or otherwise objectionable.

Prohibited submissions

You must not upload, paste, or otherwise submit any material that you do not have the right to share. In particular, you must not submit:

• Copyrighted text, code, images, or media belonging to someone else, except for short quotations used for legitimate commentary with attribution.
• Policies, control frameworks, audit working papers, or other documents belonging to an employer, client, or third party without their written permission.
• Content from other training platforms, textbooks, or certification materials that is protected by copyright or by the terms of a separate licence.
• Output from another service where that service's terms prohibit reuse of the output on platforms like ours.
• Real personal data, credentials, secrets, or sensitive security findings about live systems.

You are solely responsible for your User Submissions. Do GRC does not pre-screen submissions and does not endorse them. If you believe content on the platform infringes your rights, please contact hello@dogrc.com with a description of the work, the location of the allegedly infringing material, and a statement of your good-faith belief that the use is unauthorised.

Takedown, Suspension, and Termination

We take intellectual property, privacy, and platform integrity seriously. We may:

• Remove, redact, or disable access to any User Submission we reasonably believe infringes a third party's rights, violates these Terms, or is otherwise harmful.
• Suspend or restrict access to your account while we investigate a suspected breach, under the rules below.
• Terminate your account and end your subscription where you have materially or repeatedly breached these Terms, including by submitting infringing or prohibited content.
• Preserve relevant records — including submission content, timestamps, IP addresses, and account metadata — for evidential purposes in connection with a suspected breach or a legal claim.
• Cooperate with rights holders, regulators, and law enforcement where we are legally required to do so or where cooperation is reasonably necessary to protect our users or the platform.

Notice first. Before we suspend, restrict or end your account, we will tell you why and give you a fair chance to respond. We will act first only where we must act at once to protect the security of Do GRC or its members, to comply with the law, or to prevent serious harm; we will then tell you why as soon as we can, unless the law prevents us, and you can still respond. A suspension lasts only as long as we need to investigate, and never more than 30 days. By the end of it, we will either restore your account or end it under these Terms.

Termination of your account ends your licence to access paid content with immediate effect. If we end your account because you breached these Terms, we do not refund fees already paid, except where the law requires it (see the Refund Policy), and ending it does not waive any claim Do GRC may have against you for the underlying breach. If we end your account, or your paid membership, when you have not breached these Terms, we will give you a pro-rata refund of the fees you have paid for the rest of the billing period. Sections of these Terms that by their nature should survive termination — including the licences you grant us, your warranties, the prohibited submissions clause, indemnities, and the limitation of liability — will continue to apply after your account ends.

Nothing in this section limits any other right or remedy available to Do GRC at law or in equity, including the right to seek injunctive relief and damages against any person who infringes our content licence or uploads infringing material to the platform.

Limitation of Liability

Nothing in these Terms excludes, restricts, or modifies any consumer guarantee, right, or remedy you may have under the Australian Consumer Law, the UK Consumer Rights Act 2015, European Union consumer law, the consumer law of the country you live in, or any other law that cannot lawfully be excluded or limited. Nor does anything in these Terms limit or exclude our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow us to limit or exclude.

This paragraph applies only where the services are not of a kind ordinarily acquired for personal, domestic or household use or consumption: in practice, a team plan bought by a business. There, our liability for failing to meet a consumer guarantee under the Australian Consumer Law is limited, at our option, to supplying the services again or paying the cost of having them supplied again, unless it is not fair or reasonable for us to rely on this limit. We do not limit our liability in this way for any other services, including an individual membership.

Subject to the first paragraph of this section, Do GRC is provided on an "as is" and "as available" basis without warranties of any kind, whether express or implied. All content and AI-generated output on the platform is provided for general educational and informational purposes only and does not constitute professional legal, audit, compliance, or regulatory advice. You are responsible for any decisions you make based on the platform and should obtain your own professional advice before acting.

To the fullest extent permitted by law, Do GRC will not be liable for any indirect, incidental, special, or consequential loss or damage, or for any loss of profits, revenue, data, goodwill, or business opportunity, arising out of or in connection with your use of (or inability to use) the platform, however caused.

To the fullest extent permitted by law, and subject to the first paragraph of this section, our total aggregate liability arising out of or in connection with the platform and these Terms is limited to the greater of (a) the total fees you paid to us or to our reseller (Paddle or Stripe) for Do GRC in the twelve (12) months immediately before the event giving rise to the liability, or (b) AUD 100.

Indemnity

You agree to indemnify Do GRC and its operators against any claim someone else makes against us, and the losses, damages, costs and expenses (including reasonable legal costs) that result from it, to the extent the claim arises from: (a) your breach of the Acceptable Use rules; (b) your unlawful use of Do GRC; or (c) content you upload or submit that infringes someone else's rights. You never have to indemnify us for your ordinary use of Do GRC. This indemnity does not apply to the extent the claim or loss was caused by Do GRC's own negligence or breach of these Terms, and is reduced proportionately to the extent of our contribution to the loss. Nothing in this section requires you to indemnify us for any liability that cannot lawfully be shifted to you under the Australian Consumer Law or any other consumer law.

Changes to Terms

We may update these Terms of Service. For a change that materially affects your rights or what you pay, we will email you at least 30 days before it takes effect, and if you do not agree you can cancel your subscription or delete your account before then. Other changes take effect when we publish them here. Continuing to use Do GRC after a change takes effect means you accept the revised terms.

Transferring These Terms

We may transfer our rights and obligations under these Terms to a company we control, or to someone who buys the Do GRC business. If we do, we will tell you, and the transfer will not reduce your rights under these Terms. Apart from passing a team to another member, as described under Team Plans, you may not transfer your account, or your rights or obligations under these Terms, to anyone else without our agreement.

Governing Law and Jurisdiction

These Terms are governed by and construed in accordance with the laws in force in the Australian Capital Territory, Australia. You and Do GRC submit to the non-exclusive jurisdiction of the courts of the Australian Capital Territory and any courts competent to hear appeals from them. If you live outside Australia, you also keep any protection the consumer law of your country gives you that cannot be excluded by agreement.

Non-Affiliation Notice

Do GRC is an independent project. It is not affiliated with, endorsed by, sponsored by or accredited by any certification body, standards body, accreditation body or regulator, including ISACA, ISC2, the IAPP, CompTIA, ISO, the PCI Security Standards Council and the AICPA, or by TryHackMe or Hack The Box. Names of certifications, standards and frameworks are trade marks of their owners and are used only to describe what our material covers.

Contact

Do GRC is a registered business name of Hamish Dean, sole trader, Canberra, Australia. ABN 22 433 952 558.

If you have questions about these terms, please contact us at hello@dogrc.com.