Legal
The documents
Five documents, accepted together as one bundle when an organisation signs up. Every version is published at a permanent, dated URL and is never edited afterwards - so a record that says you accepted a particular version can always be checked against exactly the text you saw.
Current bundle: draft-2026-09-09
Draft
Every document in this bundle is a draft and none is in force. They are published so the acceptance machinery around them can be built and tested. No legal entity has been formed, so the contracting party, its address, the governing law and the venue are unresolved placeholders, and nothing here has been reviewed by counsel.
- Terms of Serviceagreed
The contract between your organisation and FortressFlag.
- Acceptable Use Policyagreed
What the service may and may not be used for.
How we process personal data on your instructions, as your processor under the GDPR.
- Privacy Policyacknowledged
What we collect about the people who sign in, and why.
- Sub-processorsacknowledged
Every third party that touches customer data, and what each one does.
Three of these are agreements; the Privacy Policy and the sub-processor list are notices you are asked to have read rather than to accept. A privacy notice is an Article 13 disclosure, not a contract, and treating it as one would muddy which lawful basis we rely on.