Acceptable Use Policy for Support Services

Issues with billing, purchasing, subscriptions or licenses

Plan	Support Level (First Response Time)	How to get in touch
All plans and purchases	First reply within 24 hours, Mon through Fri, 8AM to 5PM PST	Open a Support Ticket and the Support team will connect you with your account team. Alternatively, you can reach out directly to your Customer Success Manager.

First Time Reaching Support

If you just purchased a subscription to the Service, it is Customer’s responsibility to ensure that the Users maintaining your accounts in the Service do a few things to make sure all Users get the smoothest support experience possible:

1. Your organization will be set up in our Salesforce along with the list of contacts that you expect to contact the ZenGRC Support team in case of an issue. Just in case someone is left out, circulate instructions on proving your support entitlement within your organization.
2. Your organization will be provided with access to the ZenGRC platform with restricted functionalities depending on whether this is free access or paid. Within the setup of your organization in the ZenGRC platform, admin users will be set up for your organization. Please make sure your admin users have proper access to the platform.
3. Your organization will also be provided with access for your users to ZenGRC University, as well as the ZenGRC Community. Please make sure you validate this access.
4. Take a look at what’s included in your Support entitlement and the effect which choosing a support region has on tickets to understand the time frame in which you can expect a first response.

Accepted Language in Support Tickets

Tickets to the Support team are only accepted in English. Any other languages are discarded from the Support inbox and will not be worked on. Any attached media used for ticket evidence must be sent in English.

We do not currently provide translated interfaces for our Service.

Any calls or follow up interactions will be provided in English only.

Differences Between Support Tickets and ZenGRC Issues

It’s useful to know the difference between a support ticket opened through our Support Portal vs. an issue on ZenGRC.com.

For customers with a subscription that includes support, always feel free to contact support with your issue in the first instance via email to [email protected]; it will automatically create a ticket with your case. This is the primary channel the support team uses to interact with customers and it is the only channel that is based on an SLA. Here, the ZenGRC support team will gather the necessary information and help debug the issue. In many cases, we can find a resolution without requiring input from the development team. However, sometimes debugging will uncover a bug in ZenGRC itself or that some new feature or enhancement is necessary for your use-case. In that situation the Support team will escalate the reported issue as a Feature request, or a bug/task to our engineers, depending on the nature of the issue.

Once an issue is handed off to the development team through an issue in a ZenGRC tracker, the support team will escalate and triage the issue for proper prioritization and commitment for resolution with product and engineering. The ticket will be kept open until there is a fix in place or the product and engineering team decide this won’t be fixed, closing out the issue. The support team will provide feedback on the status of the development and resolution of the issues accordingly in the original ticket. This ensures that issues remain the single channel for communication: customers, developers and support staff can communicate through only one medium.

Issue Creation

Building on the above section, when bugs, regressions, or any application behaviors/actions not working as intended are reported or discovered during support interactions, the ZenGRC Support Team will create issues in ZenGRC project repositories on behalf of our customers.

Working Effectively in Support Tickets

Customer (also referred to as “you” or your herein) agrees to assist ZenGRC’s (also referred to as “we” or “us” herein) support team by communicating the issue Customer is facing, or question you’re asking, with as much detail as available to you. Whenever possible, include:

• log files relevant to the situation
• steps that have already been taken towards resolution
• relevant environmental details, such as the architecture

A ticket without the above information will reduce the efficacy of support. Please note that non-emergency support tickets typically take 20-30 minutes to formulate with relevant information.

In support ticket replies after the first reply, the support team may ask follow-up questions: please read through the entirety of any such replies from the support team and answer any questions in a timely manner. If there are any additional troubleshooting steps, or requests for additional information, please provide such information.

If our support team has the information it needs, and gets such information quickly, it may result in faster resolution times.

Encrypted Messages

Some organizations use third party services to encrypt or automatically expire messages, however encrypted support tickets make it impossible for our support team to respond. All interactions with ZenGRC’s support team should be in plain-text. As a matter of security, please do not include any sensitive information in the body or attachments in tickets.

ZenGRC’s support team will not click on URLs contained within tickets or interact with third-party services to provide support. If you do send such a reply, an engineer will ask you to submit your support ticket in plain text.

If you must send an encrypted file or communication, please discuss it with the support team member that answers your ticket.

Tickets with Executable Code

Many common file formats, such as Microsoft Office files and PDF, can contain executable code which can be run automatically when the file is opened. As a result, these types of files are often used as a computer attack vector.

ZenGRC’s support team members will not download files or interact with these type of files. If you send a file in a format of concern, a team member will ask you to submit your attachments in an accepted format.

Examples of acceptable formats include:

• Plain Text files (.txt, .rtf, .csv, .json, yaml)
• Images (.jpg, .gif, .png)

Sharing Login Credentials

Do not share login credentials for your ZenGRC instance with anyone, including the ZenGRC support team. If the ZenGRC support team needs more information about a problem that involves your login information, we will offer to schedule a call with you.

Do not Contact Support Team Members Directly

ZenGRC’s support team engages with all customers via email to [email protected]; this method of communication allows for efficiency and collaboration and ensures both parties’ safety while addressing problems that may arise. No attempts should be made to receive support via direct individual email, social media, or other communication methods used by any ZenGRC team members. Use of these unofficial methods may result in suspension of your account or violation of your relevant contract.

Sanitizing Data attached to Support Tickets

If relevant to the problem and helpful in troubleshooting, a support team member will request information regarding configuration files or logs.

We encourage customers to sanitize all secret, confidential, and/or private information before sharing them in a support ticket.

Sensitive items that should never be shared include:

• credentials
• passwords
• tokens
• keys
• secrets

Support for ZenGRC on Restricted or Offline Networks

ZenGRC’s support team may request logs in support tickets or ask you to screen share in customer calls if it would be the most efficient and effective way to troubleshoot and solve the issue you are experiencing with the Service.

Under certain circumstances, sharing logs or screen sharing may be difficult or impossible due to our customers’ internal network security policies.

ZenGRC will never knowingly ask a customer to violate their internal security policies, however, please be aware that support team members do not typically know the details of customers’ internal network security policies.

In situations where internal or network security policies prevent you from sharing logs or screen sharing with ZenGRC’s support team, please communicate this as early as possible in the ticket so we can adjust the workflows and methods we use to troubleshoot.

Customer policies that prevent the sharing of log or configuration information with ZenGRC may lengthen the time to resolution for tickets. In some cases, the lack of specific information may lead to the support team or escalated engineering teams to be unable to reproduce the exact conditions of an issue, with the consequent inability to provide a proper fix.

Customer policies preventing screen sharing during ZenGRC’s customer calls may impact ZenGRC’s ability to resolve issues during a scheduled call.

Solving Tickets

If a customer explains that they are satisfied that their concern is being addressed properly in an issue created on their behalf, then the conversation should continue within the issue itself, and ZenGRC support will close the support ticket. Should a customer wish to reopen a support ticket, they can reply to such ticket and it will automatically be reopened.

ZenGRC Instance Migration

If a customer requests assistance in migrating their ZenGRC platform instance to a new instance, you can direct them to submit a Support ticket. Support will assist with any issues that arise from the ZenGRC migration. However, the setup and configuration of the new instance outside of ZenGRC specific configuration, like SSO setup, is considered out of scope and Support will not be able to assist with any resulting issues.

Handling Unresponsive Tickets

To prevent an accumulation of tickets for which we have not received a response within a reasonable period, we have established the following process: if the ticket owner (Customer) fails to respond within two (2) business days after the first response or after evidence or feedback is required but not provided, ZenGRC will contact the ticket owner a second time to allow them for two (2) more business days. After such time, the ticket will be resolved for lack of feedback and closed by ZenGRC.

Restoration of Deleted Data

Any type of data restoration is currently a manual and time-consuming process led by ZenGRC’s infrastructure team. Data can only be restored in full and not in part from snapshots.

ZenGRC will consider restoration requests only when the request is part of a paid plan with an active subscription applied, and:

• the data was deleted due to a bug or error in the Service.

**Please note that user accounts and individual contributions cannot be restored.**

Ownership Disputes

ZenGRC will not act as an arbitrator of group or account ownership disputes. Each user and group owner is responsible for ensuring that they are following best practices for data security.

Name Squatting Policy

Account name squatting is prohibited by ZenGRC. Account names on the Service are administered to users on a first-come, first-serve basis. Accordingly, account names cannot be held or remain inactive for future use.

ZenGRC will consider a namespace (instance or organization) to fall under the provisions of this policy when the client has not logged in or otherwise used the namespace for an extended time.

Namespaces will be released, if eligible under the criteria below, upon request by a member of a paid namespace or sales approved prospect.

Specifically:
Specifically:

• An instance or organization hasn’t logged in the platform for more than 90 days.
• The Customer has decided not to renew their contract and is terminated.
• In the case of termination, the instance can be kept active for up to 30 calendar days beyond the termination date for the sole purpose of data extraction or similar. All access by the Customer to the namespace will be removed.

If the namespace contains data, ZenGRC Support will attempt to contact the owner over a two week period before releasing the namespaces. If the namespace contains no data (empty or no projects) and the owner is inactive, the namespace will be released immediately.

Namespaces associated with unconfirmed accounts over 90 days old are eligible for immediate release.

Namespace in the Service

Namespaces are available on a first come, first served basis, and cannot be reserved. No brand, company, entity, or persons own the rights to any namespace in the Service and may not claim them based on a trademark. Any dispute regarding namespaces and trademarks must be resolved by the parties involved. ZenGRC will never act as arbitrators or intermediaries in such disputes and will not take any action without the appropriate legal orders.

Naming conventions have been defined to model after the company’s own URL and name. Suffixes may be added to indicate the type of namespace that has been provisioned (production/test/demo/etc). Names cannot start with numbers and the minimum of characters is three (3).

Log Requests

ZenGRC cannot provide raw copies of logs. However, if Customer has concerns, ZenGRC can answer specific questions and provide summarized information related to the content of log files.

For users of the Service that pay for access, many actions are logged in the “Audit Events” section of your Service project or group.

Video Calls

Calls scheduled by ZenGRC may be on the Zoom platform or another platform utilized by ZenGRC. If you cannot use Zoom (or ZenGRC’s other, chosen video conference service), you can request a Google Meet link. Attempts to reuse a previously-provided scheduling link to arrange an on-demand call will be considered a violation of this policy, and will result in such calls being canceled.