Testing and defence led by a published security researcher with six CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, CPCSC, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Last updated: July 31, 2026
The short version. These terms cover traztech.ca and the free compliance workspace at /portal. The platform costs nothing, there is no paid tier, and you can stop using it whenever you like.
Anything you put into your workspace stays yours. We host it and run the service, and we claim no other rights over it.
The most important clause on this page is the one about advice. The platform gives you information, structure, and tooling. It does not give you legal, audit, or accounting advice, and a self-assessment you complete in it is not an audit, an attestation, or a certification. TrazTech is not a CPA firm and cannot issue a SOC 2 report.
If you hire us for paid work, that work runs under a separate signed agreement, not this page.
These Terms of Service are an agreement between you and TrazTech Inc. ("TrazTech", "we", "us"), an Ontario corporation. They apply when you visit traztech.ca, when you create or use an account on the compliance platform at traztech.ca/portal, and when you use any other free tool we publish on the site. We refer to all of that together as the "Service".
If you are using the Service for an organisation, you confirm you are authorised to accept these terms for that organisation, and "you" means both you and that organisation.
You accept these terms by creating an account, by signing in, or by using the Service. If you do not accept them, do not use the Service.
Our Privacy Policy and Cookie Policy form part of these terms. Our AI Policy describes how we use AI and is incorporated here by reference.
The Service, which we call traztech Workspace (the "Workspace"), is a self-serve workspace for security and privacy compliance work. It provides guided self-assessments against published frameworks, plain-English guidance on each control, an evidence register, a policy template library, a risk register, vendor records and vendor questionnaires, a compliance calendar, and readiness scoring.
The Workspace is free. There is no paid tier, no trial period, no credit card, and no feature gated behind an upgrade. We are able to offer it free because TrazTech is a consultancy, and some teams who use the Workspace later hire us to help close the gaps it finds. You are never obliged to buy anything, and declining to buy anything does not change your access.
Because the Service is free, some of the clauses below are stricter than you would expect from a paid product. That is deliberate and it is the trade.
You must be at least 18 years old and able to enter a binding contract. The Service is built for organisations, not for consumers or children.
Sign-in is passwordless. We email a short-lived, single-use link to the address on your account. That link is the key to your workspace, so treat it like a password: do not forward it, and do not use a shared inbox you would not trust with your compliance records.
You are responsible for what happens under your account, for the accuracy of the information you enter, and for who you invite. Workspace owners can invite team members, read-only external auditors, and, where a white-label partner is involved, partner administrators. Inviting someone gives them access to your workspace data at the level of the role you grant, and that is your decision to make and to review.
Tell us at [email protected] as soon as you believe an account, a sign-in link, or a vendor questionnaire link has been misused.
Use the Service for legitimate compliance and security work. Do not:
We welcome good-faith security research. Report findings to [email protected] before disclosing them, do not access or exfiltrate other users' data, and do not degrade the Service. We will not pursue researchers who work that way.
Your content is everything you or your team put into the Service: assessment answers, notes, uploaded evidence files, policy documents you draft, risk entries, vendor records, questionnaire responses you collect, and anything else you enter.
You own it. We claim no ownership of it and no rights in it beyond what we need to run the Service for you: storing it, backing it up, transmitting it, displaying it to the people you have given access, and processing it to produce the assessment scores, gap lists, and reports you have asked the platform to generate. That licence is limited to operating and supporting the Service, and it ends when you delete the content or close your workspace.
We do not sell your content. We do not share it with other customers. We do not use it to train machine learning models. Our AI Policy sets that out in more detail.
You are responsible for having the right to upload what you upload, including any personal information about your staff, your customers, or your vendors. Where we process personal information on your behalf, for example the responses your vendors submit to a questionnaire you sent, you are the controller and we are the processor. Our Privacy Policy explains that split.
Please do not upload data you do not need to. A compliance workspace rarely needs production customer records, secrets, or credentials pasted into a notes field.
Read this clause even if you skip the rest.
The Service provides information, structure, templates, and tooling. It does not provide legal advice, audit services, attestation services, or accounting advice, and using it does not create a solicitor-client, auditor-client, or accountant-client relationship.
TrazTech is not a CPA firm, not a licensed public accounting firm, and not an accredited certification body. We do not perform SOC 2 examinations, we do not issue SOC 2 reports or any other attestation report, and we do not issue ISO certificates. Only an independent licensed CPA firm can issue a SOC 2 report, and only an accredited certification body can issue an ISO certificate.
Everything in a self-assessment is self-reported by you. We do not verify your answers, test your controls, or validate the evidence you upload. A readiness score, a gap list, a percentage, a dashboard, or an export from the platform is a record of what you told the platform. It is not an audit opinion, an attestation, a certification, a legal conclusion, or proof of compliance, and it must not be presented to a customer, an auditor, a regulator, an insurer, or an investor as though it were.
Policy templates and control guidance are general starting points written for a general audience. They are not tailored to your circumstances and they are not a substitute for advice from your own lawyer, auditor, or accountant on how a law or framework applies to you. Frameworks and laws change, and interpretations differ between auditors and regulators.
You remain solely responsible for your own compliance decisions and for the accuracy of anything you publish or submit based on your use of the Service.
Advisory, assessment, penetration testing, virtual CISO, remediation, and any other paid engagement are separate from the free Service. They are governed by a separate written agreement, statement of work, or proposal signed by both parties. If anything in that agreement conflicts with these terms, that agreement prevails for the paid work.
Estimates, indicative pricing, and quote requests generated inside the Workspace are exactly that: indicative. They are not offers, and nothing is binding until there is a signed agreement.
Where paid work involves payment, we use Stripe to process it. We do not receive or store your full card number.
The Service depends on third parties, including our hosting and CDN providers, Stripe for payments, and Google for email delivery. Where you connect an integration to your workspace, you authorise us to access that third-party system with the credentials you supply, on your behalf and for the purpose you connected it for. You are responsible for having the right to grant that access.
We are not responsible for third-party services themselves, and links to third-party sites are not endorsements. Their terms and privacy policies govern their own conduct. The processors we rely on are named in the Privacy Policy.
The free Service is provided on an as-available basis. There is no uptime commitment, no service level agreement, and no support commitment attached to it. We do maintenance, we sometimes have outages, and features change.
We may add, change, suspend, or remove any part of the platform, and we may discontinue the Workspace entirely, at any time and without prior notice. It is provided at no charge and we make no commitment to keep it running.
We would expect to tell you before shutting it down, and to leave you a window to export your data, but that is an intention rather than a promise you can rely on. If continued access to your compliance records matters to you, export them regularly. You can do that at any time from the workspace.
You can stop using the Service at any time. You can ask us to delete your workspace by emailing [email protected] from the address on your account.
We may suspend or terminate an account that breaches these terms, that is being used to harm other users or the Service, or where we are required to by law. Where the circumstances allow it, we will tell you first and give you a chance to fix the problem. For a serious breach, for example an attack on the Service or use of it for fraud, we may act immediately.
Except where the law requires otherwise, or where the account was terminated for illegal activity, you can request an export of your workspace data for 30 days after termination and we will provide it in a machine-readable format. After that period we may delete it. Keep your own copies of anything you rely on.
The Service is provided "as is" and "as available", without warranty of any kind. To the fullest extent permitted by law, we disclaim all warranties, express, implied, statutory, or otherwise, including merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from course of dealing or usage of trade.
We do not warrant that the Service will be uninterrupted, secure, or error free, that control guidance or policy templates are complete or current, that they satisfy any specific framework, law, auditor, or regulator, or that using the Service will result in a passed audit, a certification, or a closed deal.
To the fullest extent permitted by law, TrazTech and its directors, officers, employees, and contractors are not liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost business, lost goodwill, lost or corrupted data, a failed or qualified audit, a lost customer or contract, or regulatory fines or penalties, arising out of or relating to the Service, whether in contract, tort, or any other theory, even if we were told such damages were possible.
Our total aggregate liability arising out of or relating to the Service is limited to the greater of one hundred Canadian dollars (CAD $100) and the total amount you actually paid us under a paid engagement, if any, in the twelve months before the event giving rise to the claim. The platform is provided at no charge, and this limit reflects that.
Where a signed agreement for a paid engagement sets its own liability terms, that agreement governs the engagement and prevails over this clause to the extent of any conflict.
Nothing in these terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for fraud, fraudulent misrepresentation, or death or personal injury caused by negligence. Some jurisdictions do not allow certain exclusions, so parts of this clause may not apply to you.
You will defend, indemnify, and hold harmless TrazTech and its directors, officers, employees, and contractors from and against any third-party claim, and any resulting loss, liability, damage, cost, and reasonable legal fee, arising out of your content, your use of the Service, your breach of these terms or of applicable law, or your presentation of platform output as an audit, attestation, or certification. We will tell you promptly about any such claim and give you reasonable cooperation. You may not settle a claim in a way that imposes an obligation on us without our written consent.
These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, without regard to conflict of laws rules. The courts of Ontario have exclusive jurisdiction over any dispute arising out of or relating to these terms or the Service, and you and we each consent to venue there.
Before filing anything, please email [email protected] and describe the problem. Most disputes are faster to fix that way.
We update these terms as the Service changes. The date at the top of this page always shows the current version. For a change that materially affects your rights, we will give notice by email to account holders, or by a notice in the platform, at least 14 days before it takes effect. Continuing to use the Service after a change takes effect means you accept the updated terms. If you do not accept them, stop using the Service and ask us to delete your workspace.
We give you notice by email to the address on your account, or by posting in the platform or on this site.
You give us day-to-day notice by email to [email protected]. Formal legal notices must be sent in writing, by email to [email protected] and by courier or registered mail to:
TrazTech Inc.
145 1/2 Church Street, Unit 5, Office 876
Toronto, Ontario, M5B 1Y4
Canada
A notice is effective when delivered, or on the third business day after it is sent by courier or registered mail, whichever comes first.
These terms, together with the Privacy Policy, the Cookie Policy, the AI Policy, and any signed agreement for paid work, are the entire agreement between us about the Service. If a clause is found unenforceable, the rest stays in force and the clause is read down to the minimum change needed to make it enforceable. Our not enforcing a clause is not a waiver of it. You may not assign these terms without our consent. We may assign them to an affiliate or in connection with a merger, acquisition, or sale of assets. Clauses 6, 7, 12, 13, 14, 15, and 17 survive termination. There are no third-party beneficiaries.
General questions: [email protected] or the form at traztech.ca/contact.
Privacy requests: [email protected].
Security reports: [email protected].
Related reading: the Privacy Policy, the Cookie Policy, the AI Policy, and what the traztech Workspace actually does.