Frequently Asked Questions

Each toolkit is an interactive online app plus a set of printable PDF documents — runbooks, templates, checklists, worksheets — and an editable Excel workbook where the toolkit involves tracking (registers, schedules, scoring). All documents are downloadable from inside your toolkit, individually or as one zip, organised by use case.

Page counts vary by toolkit and tier — most Solo editions are 30–50 pages, Team / mid-tier editions are 80–150 pages, Pro / Enterprise editions are 150+ pages. Each product page lists the headline deliverables per tier; if you'd like the full document manifest for a toolkit before you buy, email us and we'll send it.

Most deliverables are PDFs designed to be printed or pinned to a wall during an actual incident. Where editable templates are useful (proof-pack documents in TrustReady, the GDPR Records of Processing Activities register, multi-client tracking workbooks), you get editable files alongside the PDF.

If a specific deliverable would be more useful as editable Word for you, email us — we may be able to provide it.

Lemon Squeezy (our payment processor) emails you a licence key as soon as your payment confirms. Enter the key on our access page to unlock your toolkit — every document for your tier is downloadable from inside it, individually or as one zip, whenever you need them.

If you lose the email — reply to the order-confirmation email or contact support@sylvanassurance.com with your order reference and we re-send.

Yes. Every product has a free assessment that returns a tailored free guide (5–10 pages each). The free guide uses the same writing style, structure, and quality bar as the paid editions. If you like the way it reads, you'll like the paid edition.

The free guide is yours to keep regardless of whether you buy the paid edition.

Each product page has a "When the X tier is enough" guide. The general pattern across the line:

• Solo — you are the only operational responder and you face the underlying problem fewer than four times a year.
• Team / Commander — your team is 5–50 people and faces the problem regularly enough to need team workflow, named roles, and stakeholder communication templates.
• Pro / Enterprise / Data Protection Officer (DPO) — you run the workflow across multiple clients (consultants, managed security service providers (MSSPs), fractional Chief Information Security Officers (CISOs)) or you operate at a scale where formal audit-ready evidence matters.

If you're unsure, start with Solo and email if you want to upgrade — we'll credit the Solo price toward a Team or Pro purchase.

Yes. Email support@sylvanassurance.com with your Solo order reference and we'll send a discount code that credits the Solo price toward a Team or Pro purchase. No time limit on the upgrade.

No formal multi-seat licence. The toolkits are designed for internal team use — you can share the files within your organisation. The Terms of Use prohibit redistribution outside your organisation (selling, posting publicly) but explicitly permit reasonable internal use including putting the runbooks in your team wiki, printing for any number of team members, or referencing the templates in your own internal documentation.

The one per-device limit: the online assessment app activates on 3 devices (Solo), 7 (mid tier), or 13 (top tier). The documents themselves carry no device limit — and if your team legitimately needs more app activations, email us.

If your organisation requires a formal licence document for legal or procurement reasons, email us — we can provide a short side-letter at no charge.

Every top-tier (Pro / Consultant / Enterprise) purchase carries the same licence. Your purchase covers your practice — you and the people who work for you. Use the toolkit with as many clients as you serve: no client counts, no per-client fees, no reporting. Deliver the assessments, reports, and findings you produce to any client under your own name — adapted and rebranded templates included, and documents marked client-facing may be handed over as-is. The one thing you may not do is pass on the toolkit itself: don't give or sell the blank files, the app, or your licence key, and don't offer our content as a product of its own — that's our Partner track; email us. Your files never expire, and updates are free while the toolkit is in our catalogue. Want it in writing? We'll send a free one-page side-letter.

The full wording lives in the Terms of Use — it's the same paragraph.

Every toolkit starts at the same Solo price ($49) and shares the same $99 middle tier (GDPR Checklist's larger programme is $129). Almost every toolkit tops out at $299 — that top tier is where consultant / DPO scope, multi-client use, and audit-ready depth live. Two exceptions top out at $199 — TrustReady Pro and Cyber Insurance Pro Advisor: lighter, single-book kits, priced below the rest.

It means: once you've bought a tier, the files in that tier are yours. You can use them indefinitely. We do not deactivate, expire, or remotely revoke files. There is no subscription, no annual renewal, no per-seat fee.

While the toolkit is in our catalogue, any updates we ship within that edition are free — corrections, clarifications, small regulatory tweaks, added templates. We notify you by email when an update ships.

If we ever publish a major new edition (substantially rewritten or expanded), the prior edition you bought is still yours; the new edition is sold separately. If we ever retire a toolkit, you keep the latest version you had.

When the underlying regulation changes (for example, new European Data Protection Board guidance, a Cyber Resilience Act enforcement update) we aim to ship an update within 30–60 days. For routine improvements — better worked examples, clearer wording, additional templates — every 3–6 months. Updates within an edition are free while the toolkit is in our catalogue; a major new edition is sold separately.

We announce updates by email to everyone who bought the toolkit, and the Security & trust page lists recent site-wide changes.

Email. We keep the email you provided at purchase and use it only for: (a) the order-confirmation flow, (b) lifecycle onboarding (typically 5 emails over 60 days), (c) update notifications when a new version ships. We never sell, share, or use the email for anything else.

Every paid edition has a 30-day money-back guarantee. If you are not satisfied for any reason within 30 days of purchase, email support@sylvanassurance.com with your order reference and we refund in full. No questions asked. No "tell us why" form to fill in.

Full terms in our Refund Policy.

At purchase. The 30 days run from the timestamp on your Lemon Squeezy order. We don't track whether you actually downloaded or opened the files.

Outside the 30-day window, refunds are at our discretion. We grant them more often than not in genuine-error cases (you bought the wrong product, you didn't realise we sold a similar product at a lower tier). Email us; we'll discuss.

No. Every free assessment runs entirely in your browser. We never receive your assessment answers. They are never transmitted to us or to any third party.

This is enforced architecturally — a strict Content-Security-Policy blocks the script sources that would make telemetry possible. You can verify it yourself in your browser's developer tools: watch the network panel while you take an assessment, or inspect the response headers the page arrives with.

The minimum: an email address if you opt in to receive a free guide, and purchase information (name, email, billing country, order reference) if you buy. We use Cloudflare's server-side traffic analytics (page views, country) which involves no JavaScript injection and no cookies.

Full detail in our Privacy Policy.

No. None of those, and none of their substitutes. The brand promise is privacy-first by architecture, and behavioural analytics would break it.

Email support@sylvanassurance.com. Include your order reference if your question is about a specific purchase, and the toolkit name if your question is about a specific product (for example "TrustReady — Solo Edition").

On average, about one business day. Every message is read and answered by a person. We are based in Vermont, in the United States (Eastern time), so emails received outside business hours are usually answered the next business morning.

No — support is email-only. Keeping support to email is part of what lets us offer one-time pricing with free updates instead of a subscription, and it gives you a written record of every answer you can save or forward to a colleague.

No. Sylvan Assurance is self-service by design — the toolkits are built so you can do the work yourself, without paying for consulting hours. We don't take on custom work, consulting, or one-on-one advisory engagements.

Lemon Squeezy acts as Merchant of Record. They calculate, collect, and remit US sales tax, European Union and United Kingdom VAT (Value-Added Tax), and Australian and Canadian GST (Goods and Services Tax) automatically based on your billing address. No action needed from you on the tax side.

Your purchase invoice is issued by Lemon Squeezy and shows the tax breakdown for your jurisdiction.

The Lemon Squeezy invoice contains the standard fields most procurement systems require (legal entity, address, tax breakdown, order reference). If you need a custom field (purchase-order reference, cost-centre code, custom legal entity name), email us with the order reference and the required addition.