Legal
The documents
Five documents, accepted together as one bundle when an organisation signs up. Every version is published at a permanent, dated URL and is never edited afterwards - so a record that says you accepted a particular version can always be checked against exactly the text you saw.
Current bundle: 2026-10-29
- Terms of Serviceagreed
The contract between your organisation and FortressFlag.
- Acceptable Use Policyagreed
What the service may and may not be used for.
How we process personal data on your instructions, as your processor under the GDPR.
- Privacy Policyacknowledged
What we collect about the people who sign in, and why.
- Sub-processorsacknowledged
Every third party that touches customer data, and what each one does.
Three of these are agreements; the Privacy Policy and the sub-processor list are notices you are asked to have read rather than to accept. A privacy notice is an Article 13 disclosure, not a contract, and treating it as one would muddy which lawful basis we rely on.