These terms cover every Cyber Essentials Workspace plan — In-house and the Consultant Starter, Growth and Practice plans — plus email sign-in, desktop activation, local Builder data, annual updates, and billing.
These terms apply to purchases made on or after 1 September 2026 and, from that date, replace the earlier terms that covered only the original Consultant pilot offer. Completing checkout requires accepting these terms; Stripe records that acceptance with the payment.
Any customer with separately agreed or grandfathered access remains governed by the terms applicable to that access. Those arrangements are not public offers.
The Cyber Essentials Workspace is sold as annual subscriptions through Stripe Managed Payments. In-house is free for the first year and £50/year thereafter, for one organisation preparing its own Cyber Essentials work: the subscription starts with a 365-day free period, a payment method is collected at checkout, nothing is charged during the free period, and the first £50 renewal is charged when it ends unless the subscription is cancelled in the billing portal before then. The Consultant plans are intended for an independent consultant, MSP, IT consultancy, or Cyber Advisor: Consultant Starter at £599/year with up to 3 active client engagements and 1 activated computer; Consultant Growth at £1,199/year with up to 10 active client engagements and 2 activated computers; Consultant Practice at £2,499/year with up to 30 active client engagements and 5 activated computers.
Displayed prices are tax-inclusive, and Stripe shows the final applicable tax treatment and total before payment. The official Cyber Essentials assessment is not included and must be bought separately from the chosen certification body.
A RightCyber account is required before checkout. Purchases belong to that account; changing a billing email does not transfer access. Sign in with an email address and password, a linked Google or Microsoft account where offered, or a one-time email link or code. Do not share sign-in links, codes, or account credentials. The signed-in account area provides the exact installer for the purchased plan, activation and device-replacement controls for Consultant plans, licence status, and the Stripe Billing Portal while access is active.
A Consultant licence requires the desktop Builder to be activated against the checkout account before client work. Activation codes are short-lived, account-specific, single-use, and must not be shared outside the licensed organisation. A new Consultant installation starts without a client workspace and must be activated before it will register and create the first named client workspace. The In-house build requires no activation.
Each Consultant plan includes the activated-computer allowance stated in the offer section above. The account area lists active computers and lets the signed-in customer deactivate one to release its slot before activating a replacement. Deactivation stops future licence refresh and new client registration on that installation; it does not remotely delete its local work or backups. Copying an activation code or device secret to avoid the limit is not permitted. No extra-device add-on is currently offered publicly; contact RightCyber if a plan's included computers are not enough.
Each Consultant plan permits the number of active client engagements at a time, as stated in the offer section above. An engagement remains active while you continue preparing that client with the Consultant Builder or RightCyber-derived workflow and outputs. Archive a finished engagement to release its slot; labelling an ongoing engagement as archived does not remove it from the licensed allowance.
Every new client workspace requires an online licence-registration check before its local folder is created. On first use, the activated Builder asks for the real client name and registers a random public workspace identifier. The hosted registry may store the checkout email, public workspace identifier, optional client display name, active or archived status, registering device, timestamps, and counts needed to enforce the allowance. It does not store Builder answers, evidence, screenshots, gaps, reports, exports, or backups.
The desktop can rename an active client and update its hosted display name without moving the local workspace. Archiving a client releases one active client slot once the change syncs with the hosted registry, while retaining that client's local workspace and evidence. Reopening requires an online licence check and a free active-client slot. Archiving is not deletion or a backup; protect or dispose of the retained local files under your own data-handling policy.
If a computer and its usable backup are unavailable, the signed-in account area can list active hosted client slots and release one or all of them. This changes licence metadata only. It cannot recover or delete local answers, evidence, exports, workspaces, or backups.
Workspace data is stored locally on your computer or in folders you control. You are responsible for device access, encryption where appropriate, local file permissions, safe sharing, and keeping restorable backups.
RightCyber cannot recover Builder data it never received. An Evidence Pack is an output for review or sharing; a Workspace Backup ZIP or full Consultant-workspace backup is the recovery copy. Protect both because they may contain sensitive information.
While a subscription is active, access includes the supported installer and Builder for the purchased plan, licence activation and refresh for Consultant plans, and product, compatibility, and encoded-question workspace updates RightCyber releases after source verification. The current release is built against the May 2026 (v16.3) Cyber Essentials question set and records its verification date in the release manifest. Scheme materials can change, so future annual updates may replace that verified set. The service does not create hosted storage or give RightCyber access to local workspaces.
Subscription renewal, payment method, invoices, and cancellation are managed through the Stripe Billing Portal. A cancellation scheduled for period end normally leaves access active until that date. When paid access ends, future downloads, activation, licence refresh, and new client registration may be blocked. Existing local files remain on your computer and should be backed up before access ends. You can still sign in to your RightCyber account.
RightCyber does not offer a discretionary refund window for subscription plans; statutory rights are unaffected, and the Refunds and access page describes how refund requests and access changes are handled.
Do not share sign-in links or device secrets, bypass paid access or licence limits, overload or scrape the hosted service, reverse engineer access controls, or use RightCyber material to misrepresent an organisation's controls, scope, evidence, certification status, or assessor decision.
You retain responsibility for and rights in your own data. The RightCyber software, authored guidance, workflow, interface, and reusable output formats belong to RightCyber or its licensors. Your licence permits their use within your own organisation or, on Consultant plans, within licensed client engagements — but not resale of the Builder or its reusable materials as a standalone or competing product.
Paid RightCyber document packs and any document pack explicitly included with a Cyber Essentials Workspace licence are licensed under the separate Documents Licence: a non-exclusive, perpetual, single-organisation licence with no resale or redistribution. Where these terms and the Documents Licence differ about the documents themselves, the Documents Licence applies.
RightCyber is independent preparation software. It is not a certification body, assessor, legal adviser, managed remediation service, or submission service. It does not replace current NCSC, IASME, or certification-body guidance and does not guarantee certification, assessor acceptance, contract award, or insurance acceptance.
For purchase, sign-in, download, activation, or licence problems, email info@rightcyber.co.uk with the checkout email, order reference, operating system, app version, and safe error text. Do not send evidence or secrets. Existing local work remains available during service or network interruption — for Consultant plans this includes the period after the 30-day licence-refresh grace state — but new activation and client registration require an online check.
To the fullest extent permitted by law, RightCyber is not liable for indirect, consequential, or business interruption losses arising from use of the service. RightCyber's aggregate liability for paid access is limited to the amounts paid to RightCyber for the product giving rise to the claim in the 12 months before the claim, except where liability cannot legally be excluded or limited.
RightCyber is operated by Right Cyber UK Limited, a company registered in England and Wales under company number 17307435. Registered office: 41 Northampton Road, Bromham, Bedford MK43 8PB, United Kingdom.
These terms are governed by the laws of England and Wales. The service is operated by Right Cyber UK Limited trading as RightCyber, and disputes are subject to the courts of England and Wales unless mandatory law gives you rights in another jurisdiction.
