Terms of Service

Last Updated: April 15, 2026 Effective Date: April 15, 2026

These Terms of Service (“Terms”) govern your access to and use of the websites, APIs, documentation, dashboards, and related services (collectively, the “Services”) provided by AuthPI Limited (“AuthPI,” “we,” “us,” or “our”).

By accessing or using the Services, you agree to be bound by these Terms. If you do not agree, do not use the Services. If you are using the Services on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

1. About AuthPI

AuthPI Limited 71-75 Shelton Street London, United Kingdom

Contact: support@authpi.com

AuthPI provides identity, authentication, and authorization infrastructure for developers and businesses (“Auth Services”). This includes APIs and tools for managing users, organizations, sessions, credentials, webhooks, and related functionality.

2. Account Registration

2.1 Creating an Account

To use certain features, you must create an account. You agree to:

• Provide accurate and complete information
• Keep your credentials confidential
• Notify us immediately of any unauthorized access
• Accept responsibility for all activity under your account

2.2 Account Security

You are responsible for maintaining the security of your account credentials. AuthPI is not liable for any loss or damage arising from your failure to protect your account.

2.3 Age Requirements

You must be at least 13 years old (or 16 in the EEA, or the age of majority in your jurisdiction) to use the Services. If using on behalf of an organization, you represent that you have authority to bind that organization.

3. Service Description

3.1 Auth Services

AuthPI provides:

• User authentication and session management
• Organization and multi-tenancy management
• API key and personal access token management
• Webhook and event delivery
• Identity provider integrations (social login, OIDC)
• Passkey and WebAuthn support

3.2 Beta Status

The Services are currently in beta. During beta:

• Features may change, be modified, or removed without notice
• The Services may contain bugs or errors
• No specific uptime or performance guarantees are provided
• We may reset data or accounts with reasonable notice

3.3 Documentation

Service documentation is available at authpi.com/docs. While we strive for accuracy, documentation may not always reflect the current state of the Services.

4. Acceptable Use

4.1 Permitted Uses

You may use the Services to:

• Authenticate and authorize users for your applications
• Manage identity for your products and services
• Integrate with your systems via our APIs
• Build applications that comply with these Terms

4.2 Prohibited Uses

You must not:

Illegal Activities

• Use the Services for any unlawful purpose
• Violate any applicable laws or regulations
• Facilitate fraud, money laundering, or other financial crimes

Harmful Content and Behavior

• Distribute malware, viruses, or harmful code
• Engage in phishing or impersonation
• Harass, abuse, or harm others
• Promote violence or discrimination

Technical Abuse

• Attempt to gain unauthorized access to our systems
• Reverse engineer, decompile, or extract source code
• Interfere with or disrupt the Services
• Circumvent rate limits or security measures
• Use the Services to attack third-party systems

Data Misuse

• Collect personal data without proper consent
• Use end-user data for purposes beyond authentication
• Sell or share data processed through the Services

4.3 Rate Limits

We implement rate limits to ensure fair usage. Current limits are documented at authpi.com/docs/reference/rate-limits/. Exceeding limits may result in throttling or suspension.

5. Pricing and Payment

5.1 Current Pricing

During beta, the Services are free to use. A free tier will remain available after beta ends.

5.2 Future Paid Plans

We may introduce paid plans with:

• Usage-based pricing
• Feature tiers
• Support levels

We will provide at least 30 days’ notice before requiring payment for features you currently use for free. Early adopters will receive favorable pricing terms (“grandfathering”).

5.3 Payment Terms

When paid plans are introduced:

• Fees are due in advance
• All fees are non-refundable unless required by law
• We may suspend Services for non-payment
• Prices may change with 30 days’ notice

6. Data and Privacy

6.1 Your Data

You retain ownership of all data you submit to the Services (“Customer Data”). You grant us a limited license to use Customer Data solely to provide the Services.

6.2 End-User Data

When you use AuthPI to authenticate your users:

• You are the data controller for your end-users’ data
• We act as a data processor on your behalf
• Processing is governed by our Data Processing Agreement
• You are responsible for obtaining necessary consents

6.3 Data Processing Agreement

Our Data Processing Agreement (available on this page) governs how we process personal data on your behalf and is incorporated into these Terms.

6.4 Privacy Policy

Our Privacy Policy explains how we collect and use data. By using the Services, you acknowledge that you have read and understood our Privacy Policy.

6.5 Data Location

Customer Data may be processed in:

• United Kingdom
• European Economic Area
• United States (via infrastructure providers)

You can configure data residency settings where available.

7. Intellectual Property

7.1 AuthPI’s Rights

AuthPI and its licensors own all rights to:

• The Services and underlying technology
• Our trademarks, logos, and branding
• Documentation and other materials

7.2 Your Rights

You retain all rights to:

• Your Customer Data
• Your applications and code
• Your trademarks and branding

7.3 Feedback

If you provide feedback or suggestions, we may use them without obligation to you.

8. Third-Party Services

8.1 Integrations

The Services integrate with third-party identity providers (Google, GitHub, Microsoft, etc.). Your use of these integrations is subject to the third party’s terms.

8.2 Your Integrations

You may integrate third-party services with AuthPI. We are not responsible for third-party services you choose to use.

9. Security

9.1 Our Commitments

We implement industry-standard security measures including:

• Encryption in transit and at rest
• Access controls and audit logging
• Regular security assessments
• Incident response procedures

9.2 Security Incidents

We will notify you promptly of any security incident affecting your data, as required by applicable law and our Data Processing Agreement.

9.3 Your Responsibilities

You are responsible for:

• Securing your account credentials
• Implementing appropriate security in your applications
• Promptly rotating compromised credentials
• Reporting security vulnerabilities to security@authpi.com

10. Disclaimers

10.1 “As Is” Basis

THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO:

• MERCHANTABILITY
• FITNESS FOR A PARTICULAR PURPOSE
• NON-INFRINGEMENT
• ACCURACY OR RELIABILITY

10.2 Beta Disclaimer

During beta, the Services may contain bugs, errors, or limitations. Performance and availability are not guaranteed.

10.3 No Guarantee

We do not guarantee that the Services will:

• Meet your specific requirements
• Be uninterrupted or error-free
• Be compatible with all systems
• Prevent all security threats

11. Limitation of Liability

11.1 Exclusion of Damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW, AUTHPI SHALL NOT BE LIABLE FOR:

• Indirect, incidental, special, or consequential damages
• Lost profits, revenue, or data
• Business interruption
• Cost of substitute services

11.2 Liability Cap

AuthPI’s total liability shall not exceed the greater of:

• Amounts you paid to AuthPI in the 12 months before the claim
• One hundred pounds sterling (£100)

11.3 Exceptions

These limitations do not apply to:

• Death or personal injury caused by negligence
• Fraud or fraudulent misrepresentation
• Any liability that cannot be excluded by law

12. Indemnification

You agree to indemnify and hold harmless AuthPI and its officers, directors, employees, and agents from any claims, damages, or expenses (including legal fees) arising from:

• Your use of the Services
• Your violation of these Terms
• Your violation of any third-party rights
• Your Customer Data or end-user data

13. Term and Termination

13.1 Term

These Terms remain in effect while you use the Services.

13.2 Termination by You

You may terminate your account at any time through the dashboard or by contacting support. Upon termination:

• Your access to the Services will end
• We will delete your Customer Data within 30 days (unless legally required to retain it)
• You remain responsible for any outstanding fees

13.3 Termination by AuthPI

We may suspend or terminate your access if:

• You violate these Terms
• Your use poses a security risk
• Required by law
• The Services are discontinued

Except for violations requiring immediate action, we will provide 14 days’ notice before termination.

13.4 Survival

Sections relating to intellectual property, disclaimers, limitation of liability, indemnification, and governing law survive termination.

14. Changes to Terms

We may modify these Terms at any time. For material changes:

• We will provide at least 30 days’ notice
• Notice will be sent to your registered email
• Continued use after the effective date constitutes acceptance

If you disagree with changes, you may terminate your account before they take effect.

15. Governing Law and Disputes

15.1 Governing Law

These Terms are governed by the laws of England and Wales, without regard to conflict of law principles.

15.2 Jurisdiction

You agree to the exclusive jurisdiction of the courts of England and Wales for any disputes arising from these Terms.

15.3 Informal Resolution

Before filing a formal dispute, you agree to contact us at legal@authpi.com to attempt informal resolution.

16. Export Compliance

You represent that:

• You are not located in a country subject to UK, EU, or US sanctions
• You are not on any prohibited parties list
• You will not use the Services in violation of export laws

17. General Provisions

17.1 Entire Agreement

These Terms, together with the Privacy Policy and Data Processing Agreement, constitute the entire agreement between you and AuthPI.

17.2 Severability

If any provision is held invalid, the remaining provisions remain in effect.

17.3 Waiver

Failure to enforce any right does not constitute a waiver of that right.

17.4 Assignment

You may not assign these Terms without our consent. We may assign these Terms in connection with a merger or acquisition.

17.5 Notices

Notices to AuthPI should be sent to legal@authpi.com. Notices to you will be sent to your registered email address.

18. Contact

For questions about these Terms:

Email: legal@authpi.com

Mail: AuthPI Limited 71-75 Shelton Street London, United Kingdom

Thank you for using AuthPI. We’re excited to support your identity and authentication needs.

Data Processing Agreement

Last Updated: April 15, 2026 Effective Date: April 15, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between AuthPI Limited (“AuthPI,” “Processor,” “we,” “us,” or “our”) and the customer (“Customer,” “Controller,” “you,” or “your”) who has agreed to the Terms of Service (collectively, the “Agreement”).

This DPA applies when AuthPI processes Personal Data on behalf of the Customer in connection with the Services.

1. Definitions

“Data Protection Laws” means all applicable laws relating to the processing of Personal Data, including:

• The UK General Data Protection Regulation (UK GDPR)
• The EU General Data Protection Regulation (EU GDPR)
• The Data Protection Act 2018
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• Brazil’s Lei Geral de Proteção de Dados (LGPD)
• Any other applicable data protection or privacy laws

“Personal Data” means any information relating to an identified or identifiable natural person that AuthPI processes on behalf of Customer through the Services.

“Processing” means any operation performed on Personal Data, including collection, storage, modification, retrieval, use, disclosure, or deletion.

“Sub-processor” means any third party engaged by AuthPI to process Personal Data on behalf of Customer.

“Data Subject” means an identified or identifiable natural person whose Personal Data is processed.

“Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

2. Scope and Roles

2.1 Relationship of the Parties

For Personal Data processed through the Services:

• Customer is the Data Controller (or “Business” under CCPA)
• AuthPI is the Data Processor (or “Service Provider” under CCPA)

AuthPI processes Personal Data only on documented instructions from Customer, unless required by law.

2.2 Customer Responsibilities

Customer is responsible for:

• Determining the lawful basis for processing
• Providing required notices to Data Subjects
• Obtaining necessary consents
• Ensuring data accuracy
• Responding to Data Subject requests (with AuthPI’s assistance)
• Complying with all applicable Data Protection Laws

2.3 AuthPI Responsibilities

AuthPI shall:

• Process Personal Data only on Customer’s documented instructions
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate security measures
• Assist Customer in meeting Data Protection Law obligations
• Delete or return Personal Data upon termination
• Make available information necessary to demonstrate compliance

3. Processing Details

3.1 Subject Matter and Purpose

AuthPI processes Personal Data to provide identity and authentication services as described in the Agreement, including:

• User authentication and session management
• Organization and membership management
• Credential storage and verification
• Webhook delivery and event logging

3.2 Categories of Data Subjects

• End-users of Customer’s applications
• Administrators and team members of Customer’s organization
• Members of Customer’s customer organizations (B2B scenarios)

3.3 Types of Personal Data

3.4 Duration

Processing continues for the duration of the Agreement plus any retention period specified in the Agreement or required by law.

4. Security Measures

4.1 Technical Measures

AuthPI implements the following technical security measures:

Encryption

• Data in transit: TLS 1.3
• Data at rest: AES-256 encryption

Access Controls

• Role-based access controls
• Multi-factor authentication for AuthPI personnel
• Principle of least privilege

Infrastructure

• Services run on Cloudflare Workers, a globally distributed edge computing platform
• Cloudflare’s infrastructure includes DDoS protection, WAF, and SOC 2 Type II certification
• Automatic failover and redundancy

Application Security

• Password hashing with Argon2id
• CSRF protection
• Rate limiting and abuse prevention
• Regular security assessments

4.2 Organizational Measures

• Security awareness training for personnel
• Background checks for employees with data access
• Documented incident response procedures
• Regular security reviews and audits

4.3 Certifications

AuthPI’s infrastructure provider (Cloudflare) maintains:

• SOC 2 Type II
• ISO 27001
• PCI DSS Level 1

5. Sub-processors

5.1 Authorization

Customer authorizes AuthPI to engage Sub-processors to process Personal Data, subject to this Section 5.

5.2 Current Sub-processors

5.3 Sub-processor Obligations

AuthPI ensures that Sub-processors:

• Are bound by written agreements with data protection obligations no less protective than this DPA
• Only process Personal Data to the extent necessary
• Implement appropriate security measures

5.4 Changes to Sub-processors

AuthPI will notify Customer of any intended changes to Sub-processors at least 14 days before the change takes effect. Customer may object to a new Sub-processor by notifying AuthPI within 14 days. If Customer objects and the parties cannot resolve the concern, Customer may terminate the affected Services.

6. Data Subject Rights

6.1 Assistance

AuthPI will assist Customer in responding to Data Subject requests, including requests to:

• Access Personal Data
• Rectify inaccurate data
• Erase data (“right to be forgotten”)
• Restrict processing
• Port data to another controller
• Object to processing

6.2 Customer Dashboard

Customer can fulfill many Data Subject requests directly through the AuthPI dashboard and APIs, including:

• Viewing and exporting user data
• Deleting users and associated data
• Updating user information

6.3 Additional Assistance

For requests that cannot be fulfilled through self-service tools, AuthPI will provide reasonable assistance within 10 business days of Customer’s request.

7. Security Incidents

7.1 Notification

AuthPI will notify Customer of any Security Incident without undue delay, and in any event within 72 hours of becoming aware of the incident.

7.2 Incident Details

Notification will include, to the extent known:

• Description of the nature of the incident
• Categories and approximate number of Data Subjects affected
• Categories and approximate number of records affected
• Name and contact details of AuthPI’s point of contact
• Likely consequences of the incident
• Measures taken or proposed to address the incident

7.3 Cooperation

AuthPI will:

• Investigate the incident and take steps to mitigate harm
• Cooperate with Customer’s investigation
• Assist Customer in meeting notification obligations to regulators and Data Subjects
• Not notify regulators or Data Subjects on Customer’s behalf without Customer’s prior consent, unless required by law

8. International Transfers

8.1 Transfer Mechanisms

For transfers of Personal Data outside the UK or EEA, AuthPI relies on:

Standard Contractual Clauses (SCCs) The EU Commission’s Standard Contractual Clauses for controller-to-processor transfers (Module Two), incorporated by reference.

UK International Data Transfer Agreement (IDTA) The UK Addendum to the EU SCCs, as approved by the UK Information Commissioner.

Adequacy Decisions Where the destination country has received an adequacy decision from the European Commission or UK government.

8.2 Additional Safeguards

Where required, AuthPI implements supplementary measures including:

• Encryption of data in transit and at rest
• Access controls limiting who can access Personal Data
• Contractual commitments from Sub-processors

9. Data Residency

9.1 Cloudflare Workers Architecture

AuthPI Services run on Cloudflare Workers, which operates on a global edge network. This means:

• Application code executes at the edge location nearest to the end-user
• Persistent data is stored in Cloudflare’s distributed database services

9.2 Data Location Options

Where available, Customer can configure data residency settings to restrict where Personal Data is stored. Check our documentation for current data residency options.

9.3 Jurisdictional Compliance

AuthPI’s architecture is designed to help Customers comply with data localization requirements including GDPR, LGPD, and PIPL. Contact us at privacy@authpi.com for specific jurisdictional requirements.

10. Audits and Compliance

10.1 Information Requests

Upon Customer’s written request (no more than once per year), AuthPI will provide:

• Documentation of security measures
• Summary of recent security assessments
• Relevant certifications and attestations
• Responses to reasonable compliance questionnaires

10.2 Audits

Customer may audit AuthPI’s compliance with this DPA, subject to:

• 30 days’ prior written notice
• Reasonable scope and timing
• Confidentiality obligations
• Customer bearing the cost of the audit

AuthPI may satisfy audit requests by providing relevant third-party audit reports or certifications.

11. Data Deletion and Return

11.1 During the Agreement

Customer can delete Personal Data at any time through the dashboard or API.

11.2 Upon Termination

Upon termination of the Agreement:

• Customer may export Personal Data within 30 days
• AuthPI will delete Personal Data within 30 days after the export period
• AuthPI may retain data as required by law, with continued DPA protections

11.3 Deletion Certification

Upon request, AuthPI will certify in writing that Personal Data has been deleted.

12. CCPA/CPRA Provisions

For Personal Data subject to the California Consumer Privacy Act (CCPA) or California Privacy Rights Act (CPRA):

12.1 Service Provider Status

AuthPI is a “Service Provider” as defined under the CCPA. AuthPI:

• Processes Personal Data only for the business purposes specified in the Agreement
• Does not sell Personal Data
• Does not share Personal Data for cross-context behavioral advertising
• Does not retain, use, or disclose Personal Data except as permitted under the CCPA

12.2 Prohibited Actions

AuthPI will not:

• Sell or share Customer’s Personal Data
• Retain, use, or disclose Personal Data for purposes other than providing the Services
• Combine Personal Data with data from other sources, except as permitted by the CCPA

12.3 Certification

AuthPI certifies that it understands and will comply with the restrictions in this Section 12.

13. Liability

13.1 Liability Cap

Each party’s liability under this DPA is subject to the limitations of liability in the Agreement.

13.2 Indemnification

The indemnification provisions in the Agreement apply to claims arising from this DPA.

14. Conflicts

In the event of a conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data.

15. Contact

For questions about this DPA or to exercise rights under this DPA:

Email: privacy@authpi.com

Mail: AuthPI Limited Attn: Data Protection 71-75 Shelton Street London, United Kingdom

Appendix A: Standard Contractual Clauses

The EU Standard Contractual Clauses (Module Two: Controller to Processor) are incorporated by reference and available at eur-lex.europa.eu.

For transfers from the UK, the UK International Data Transfer Addendum is also incorporated by reference.

Parties:

• Data Exporter: Customer (as identified in the Agreement)
• Data Importer: AuthPI Limited

Contact Points:

• Data Exporter: As specified in Customer’s account
• Data Importer: privacy@authpi.com

Processing Details: As set forth in Section 3 of this DPA.

Technical and Organizational Measures: As set forth in Section 4 of this DPA.