Legal

Readiness, not independent assurance

Clear boundaries forreadiness engagements.

Canonical Plus provides audit-readiness and pre-audit preparation. We are not a CPA firm, law firm, certification body, or assessor. We do not issue audit opinions, attestations, certifications, or authorizations, and nothing we provide is legal advice.

Engagement scope

Included readiness work

Scoping, readiness diagnostics, gap registers, remediation roadmaps, control and policy implementation support, evidence organization, management preparation, training, and coordination with an evaluator you engage directly.

Never included

Audit or attestation engagements, SOC reports, ISO certificates, PCI compliance reports, FedRAMP or CMMC authorizations, HIPAA determinations, legal opinions, or any guarantee that you will pass, be certified, or avoid findings.

Readiness signals stay internal

Readiness scores, dashboard status, training completion, and signed readiness observations are preparation signals. They are not audit opinions and should not be presented to third parties as independent assurance.

Contract stack

Every engagement is governed by a signed agreement. The signed agreement controls over website copy, pricing summaries, and training content.

Master Services Agreement and Statement of Work

Scope, deliverables, fees, acceptance, and change control for each readiness tier. Publicpricing shows planning ranges, not an offer.

Terms of Service, Privacy Policy, and Acceptable Use

Online terms for self-service use of the readiness workspace, how we handle personal data, and prohibited uses of the platform.

Data Processing Agreement and security testing authorization

Processor terms for customer evidence, plus separate written authorization and rules of engagement before any active security assessment.

Email [email protected] or use thecontact page to request current agreement drafts. Compliancetraining is educational and is not legal advice.