Terms

Who these terms are with

These terms are between Anamorphic Creations Pty Ltd (ACN 087 351 102), trading as Calliper, ABN 40 087 351 102, of Suite 1, 293 Bay Street, Brighton, Victoria 3186, Australia, and the managed service provider who subscribes to Calliper. Where these terms say we, they mean that company; where they say you, they mean the provider.

A provider's own clients are not party to these terms. A client who uses the portal a provider invited them into has a relationship with that provider, and the provider's own terms govern it.

Using Calliper means accepting these terms. If you are accepting them for a company, you are saying you can bind it.

What Calliper is

Calliper connects to the Microsoft 365 and Google Workspace tenants you manage, reads them under consent your clients' own administrators grant, tests them against a published catalogue of controls, and reports what it found. It also carries the monitoring, packaging, billing reconciliation and reporting tools described on this site.

It reads. Except where a feature says otherwise on its own screen and asks you to confirm, Calliper does not change anything in a client's tenant, and the permissions it asks for are read-only.

What Calliper is not

This is a readiness view that helps you work towards the framework it names. It is not a certification, an audit or an assessment by an accredited assessor, and BaseHost holds no accreditations against it.

That sentence is the platform's own, it is printed on every report and every posture screen Calliper produces, and it is here because it is the single most important thing to get right about what you are buying. You do not become an assessor by using Calliper, and neither do we.

Results reflect a point in time and the sources available at that time, and may not identify every weakness, vulnerability or misconfiguration affecting an environment. Scores, grades and findings are for awareness. They are not a security audit, a penetration test, a certification, or a substitute for professional advice, and no result should be read as confirmation that an environment is secure or compliant.

References to frameworks including the Essential Eight, ISO 27001, SOC 2 and the Privacy Act 1988 (Cth) describe what Calliper measures against. They do not constitute legal or compliance advice.

Your account, and who you let into it

You decide who at your company may sign in, what each of them may do, and which of your clients you invite into the portal. Calliper gives you roles to do that with and re-checks membership on every request rather than at sign-in, so removing somebody takes effect within minutes.

You are responsible for what the people you admit do in the console, and for telling us promptly if you think an account has been compromised.

Connecting a client, and the authority to do it

Connecting a client's Microsoft 365 or Google Workspace tenant requires that client's own administrator to grant consent at Microsoft or at Google. We rely on you having the authority to ask them, and on the relationship between you and that client permitting what Calliper then does.

You must not point Calliper at a domain, tenant or system you do not own or are not authorised to test. That applies to every tool here and it applies hardest to the ones that reach a third party's systems: an invasive test requires written authorisation recorded in the platform before it will run, and that record is kept permanently.

A client can end a connection at any time without going through you. A Microsoft consent is removable from their own directory and a Google grant is removable from myaccount.google.com/permissions. When that happens every reading stops, which is the correct behaviour and not a fault.

Your data and your clients' data

What Calliper stores is set out store by store in the privacy policy, and that page is rendered from the platform's own data register rather than written beside it. Read it: it is the substantive half of this agreement about data, and restating it here in summary would create two answers to one question.

You keep ownership of your data and your clients' data. We hold it to run the service you bought, and for nothing else. We do not sell it, and we do not use a client's tenant data to train any model.

A separate data processing addendum is referenced elsewhere on this site and has not been published yet. Until it is, this section and the privacy policy are the whole of what we say about processing.

Availability and support

We work to keep Calliper available and we do not offer a service level commitment. Saying so plainly is better than publishing a number nobody measures: a platform that reports on other people's uptime should not claim its own without the measurement behind it.

Calliper depends on systems we do not run. Microsoft, Google, and the tools you connect can be unavailable, can rate-limit us, or can change an interface without notice, and a reading that cannot be taken is reported as unreadable rather than as a result.

Support is by the channels published on this site, during Australian business hours.

Fees, trials and changes

Plans and prices are on the pricing page and are in Australian dollars. Every plan starts with a seven-day free trial, and nothing is charged during it.

Subscriptions are billed monthly in advance through Stripe. Card details are entered into Stripe's own fields and never reach Calliper.

We may change these terms or a price on 30 days’ notice. If a change is one you do not accept, you may cancel before it takes effect. We will not change what you are charged for a period you have already paid for.

Suspension and ending it

You can cancel at any time and the subscription runs to the end of the period you have paid for.

We may suspend access where an account is being used against the authority section above, where a payment has failed and has not been fixed, or where continuing would put another customer or a third party's systems at risk. Where the situation allows it we will tell you first.

When a subscription ends, your data is dealt with as the privacy policy's register describes for each store. Some records are deliberately kept: an authorisation to run an invasive test, and the record of what that test did, are not deleted when an account closes, and the register says why.

Acceptable use

The short version, and it is the part with teeth: run lookups and tests only against domains and services you own or are authorised to test, do not use Calliper to gain unauthorised access to anything, and do not use it to hold data you have no lawful basis to hold.

A fuller acceptable use policy is linked from this site and has not been published yet. Until it is, this section is what applies.

Who owns what

We own Calliper, the control catalogue, and everything we publish through it. You get the right to use it while you are subscribed, and nothing more than that.

You own your data and your clients' data, and your own branding, which Calliper renders on the portal and in emails on your behalf. Reports Calliper generates for your clients are yours to give them.

Australian Consumer Law

Nothing in these terms excludes, restricts or modifies any guarantee, right or remedy under the Australian Consumer Law that cannot lawfully be excluded. Where a guarantee applies and the supply is not of a kind ordinarily acquired for personal use, our liability for failing to comply with it is limited, at our option, to supplying the service again or paying the cost of having it supplied again.

Calliper reports what it could observe. It is not a guarantee that an environment is secure, and a finding it did not make is not a statement that there was nothing to find.

Governing law

These terms are governed by the law of Victoria, and both of us submit to the courts of that place.

What is still to be confirmed

These terms were drafted from what the Calliper codebase can prove about the product. That is a good input and it is not the same thing as legal advice. Nobody with legal qualifications has reviewed them, and they should be reviewed before they are relied on.