Terms and conditions
Last updated: 29 June 2026
These terms govern access to and use of the CyberPassport platform as well as paid subscriptions.
Purpose and scope
These general terms and conditions (the “Terms”) govern access to and use of the CyberPassport platform, as well as paid subscriptions. They form a contract between CreativMinds (the “Provider”) and any organisation or person who creates an account or uses the service (the “Customer” or “User”). Creating an account or using the service constitutes unreserved acceptance of these Terms. The processing of personal data is described in the Privacy Policy, which forms an integral part of these Terms. The Provider may amend the Terms at any time; the applicable version is the one in force at the time the service is used. Customers are notified in advance of any material change by appropriate means.
Service description
CyberPassport is a cybersecurity maturity self-assessment tool for SMEs and their principals. The service lets users complete a structured questionnaire, calculate a maturity score per framework (NIST CSF 2.0, ISO/IEC 27001:2022 and other frameworks added over time), store evidence, and share a self-assessment with partners or auditors. CyberPassport is a self-assessment tool: it is not a certification, an audit, or an attestation of regulatory compliance. Results reflect the answers declared by the User and do not bind the Provider as to their accuracy or to the organisation's actual compliance. The scope of features depends on the plan subscribed to. The Provider may evolve the service and add, modify or remove features.
Account and registration
Using the service requires creating an account. The User undertakes to provide accurate, complete and up-to-date information, in particular their organisation's Swiss business identification number (UID/IDE), which may be verified automatically. Each account is strictly personal. The User is responsible for keeping their credentials confidential and for all activity carried out from their account. Any unauthorised use must be reported to the Provider without delay. The administrator of an organisation is responsible for managing the access of the collaborators, customers and auditors they invite.
Subscriptions, pricing and payment
The service is offered under several plans (free and paid) whose scope and prices are set out on the Pricing page. Prices are expressed in Swiss francs (CHF) and are exclusive of any applicable taxes. Payments are processed by our provider Stripe. Billing is recurring according to the chosen period (monthly or annual) and is payable in advance. In the event of non-payment, the Provider may suspend or terminate access. The Provider may change its prices; any change applies from the next subscription period and is communicated to the Customer beforehand.
Term, renewal and termination
The subscription is entered into for the chosen period and renews automatically for an identical period, unless terminated before the end of the current period. The Customer may terminate their subscription at any time from their account; termination takes effect at the end of the paid period, with no refund of amounts already paid, except where mandatory law provides otherwise. The Provider may suspend or terminate an account in the event of a breach of these Terms, misuse or non-payment. After the contract ends, data is deleted or retained in accordance with the Privacy Policy.
User obligations
The User undertakes to use the service lawfully and in accordance with these Terms. The User is solely responsible for the accuracy of the answers, evidence and content they upload, and warrants that they hold the necessary rights to such content. It is prohibited, in particular, to compromise the security or integrity of the platform, attempt to access other organisations' data, upload unlawful content or malware, or use the service for unauthorised resale. The User is responsible for retaining their own source documents.
Service availability
The Provider strives to ensure high availability of the service but does not guarantee uninterrupted or error-free operation. Interruptions may occur, in particular for maintenance, updates or for reasons beyond the Provider's control. Where possible, the Provider gives advance notice of scheduled maintenance likely to materially affect the service.
Limitation of liability
The service is provided “as is”. CyberPassport produces a self-assessment and does not guarantee any audit outcome, level of security or regulatory compliance. The User remains solely responsible for the decisions and measures they take on the basis of the results. To the extent permitted by applicable law, the Provider's liability is limited to direct damages and capped at the amount paid by the Customer during the twelve months preceding the triggering event. The Provider is not liable for indirect damages (loss of data, loss of revenue or business, damage to reputation). These limitations do not apply in the event of intent or gross negligence, nor in cases where the law excludes such a limitation.
Data protection
The processing of personal data is governed by the Privacy Policy, which complies with the Swiss Federal Act on Data Protection (nFADP). Business data is hosted in Switzerland (Infomaniak) and isolated per organisation; sensitive data is encrypted. One organisation's data is never shared with another without an explicit sharing action by the Customer. Where the Provider acts as a processor of the Customer's data, a data processing agreement may be concluded on request.
Governing law and jurisdiction
These Terms are governed by Swiss law, excluding its conflict-of-law rules and the Vienna Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for any dispute relating to these Terms is the Provider's registered office, in the Canton of Vaud (Switzerland), subject to any mandatory jurisdiction provided by law. If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions remain fully applicable.