Terms of Service

011. Definitions

• "Account" means the organization record through which you access the Service, including its members.
• "Console" means the web application through which the Service is configured.
• "Customer Content" means configuration, templates, function code, claims templates and any data you or your End Users submit to the Service.
• "End User" means an individual who authenticates through, or is registered in, a product you build on the Service.
• "Environment" means an isolated instance of a Project’s configuration and data, such as development, staging or production.
• "Personal Data" has the meaning given in applicable data protection law.
• "Project" means an application within your Account, with its own issuer, users and configuration.
• "Secret Key" means a credential of the private type, which grants privileged server-side access to the API.
• "Usage Limits" means the quotas published for your plan, including network transfer, communications and function invocations.

022. The Service

nulvless is identity infrastructure for software products. It provides authentication, authorization, session management, transactional communications, an edge function runtime, observability and an audit trail, configured per Project and per Environment.

Each Project is a standards-compliant OpenID Connect issuer with its own discovery document and JSON Web Key Set. Access tokens are signed JSON Web Tokens that any conforming client can verify.

We grant you a non-exclusive, non-transferable, revocable right to access and use the Service during the term, solely to build and operate your own products.

We may change, add or remove features. If a change materially reduces functionality you rely on, we will give at least thirty days’ notice through the Console or by email to your Account address, unless the change is required for security or by law.

033. Accounts and eligibility

You must be able to form a binding contract in your jurisdiction, and must not be barred from receiving the Service under any applicable law.

You are responsible for the accuracy of the information you give us, for the security of your credentials and API keys, and for all activity under your Account, whether or not authorised by you.

Secret Keys grant privileged access. Keep them out of client-side code, public repositories, logs and support tickets. Rotate them when a person with access leaves. Notify us promptly if you believe a key or Account has been compromised.

You may invite members to your organization and assign them roles. You remain responsible for what they do with the Service, and for removing access when it is no longer needed.

044. Your responsibilities as Customer

The Service processes Personal Data about your End Users. In that processing you are the controller and we are the processor. That allocation carries obligations you cannot pass to us:

• Having a lawful basis to collect and process your End Users’ Personal Data.
• Publishing your own privacy notice to your End Users, describing your use of the Service.
• Obtaining any consent your jurisdiction requires, including for the communications we send on your behalf and for any non-essential cookies your product sets.
• Responding to your End Users’ requests to access, correct, export or delete their data. The Console and the API provide a mechanism for each.
• Configuring the Service appropriately. Token lifetimes, refresh token behaviour, rate limits, bot protection, sudo mode, password policy and claims templates are yours to set, and the defaults are not a recommendation for every product.
• Keeping your integration current when we publish a breaking change with notice.

You are responsible for the content of the messages sent through the Service, for the templates you configure, for the recipients you send them to, and for holding any consent those messages require.

055. Acceptable use

You may not, and may not permit anyone else to, use the Service to:

• Break the law, infringe intellectual property, or violate anyone’s privacy or publicity rights.
• Send unsolicited bulk messages, phishing, or anything that misrepresents its sender or origin.
• Store or process payment card numbers, government identification numbers, biometric identifiers or health records in user metadata, profile fields or token claims.
• Process special categories of Personal Data as defined by the GDPR, or sensitive data as defined by the LGPD, without first agreeing additional terms with us in writing.
• Attempt to gain unauthorized access to the Service, to other tenants, or to the underlying infrastructure.
• Probe, scan, penetration-test or load-test the Service without our prior written consent.
• Circumvent Usage Limits, rate limits or metering.
• Resell, sublicense or expose the Service as a competing identity product.
• Deploy edge functions that mine cryptocurrency, proxy unrelated traffic, run denial-of-service tooling, or otherwise consume compute disproportionately to your product.
• Introduce malware, or use the Service to distribute it.

We may investigate suspected violations and take proportionate action, including removing content, disabling a function, throttling, or suspending the Account. Where the situation allows, we will contact you before acting.

066. Plans, fees, renewal and taxes

Paid plans are billed in advance for the subscription period selected. Usage above the plan’s Usage Limits is measured on network transfer, communications and function invocations, and billed in arrears at the published overage rates.

Subscriptions renew automatically for successive periods of the same length unless cancelled from the Console before the current period ends. Cancelling stops the next renewal; it does not shorten the period already paid for.

We may change prices with at least thirty days’ notice before the change applies to your next renewal. If you do not accept a price change, cancel before that renewal.

Fees exclude taxes. You are responsible for any sales, use, VAT, GST, ISS or withholding taxes, except taxes on our net income. Where withholding is required by law, you will gross up so that we receive the amount we would have received without it.

Invoices are due on receipt unless stated otherwise. We may suspend the Service for amounts more than fifteen days overdue, after notice.

Except where required by law, fees already paid are non-refundable, including for partial periods.

077. Free plans, trials and beta features

A free plan or trial is provided for evaluation. We may change its limits, or withdraw it, at any time.

We may label a feature as beta, preview or experimental. Those features are provided as is, may be changed or removed without notice, are excluded from any availability commitment, and should not carry a production workload you cannot afford to lose.

Data created in a free plan or in a beta feature may be deleted when that plan or feature ends. Export what you need first.

088. Third-party services

The Service integrates with third parties you choose: identity providers for social sign-in, email and SMS providers for delivery, and bot-protection providers. Enabling one is your instruction to send data to it.

The list above is what the Service integrates today. We may offer further integrations over time, and each one remains governed by whoever runs it.

Your use of a third-party service is governed by that provider’s own terms and privacy notice. We do not control it, do not warrant it, and are not responsible for its availability or for how it handles data once it receives it.

The integration also brings data in: when someone signs in with an outside account, the end user lets that provider hand us part of their profile, and that is what we then hold.

By turning a provider on, you state that you may turn it on — that the account is yours or that you have permission from whoever owns it, and that you have accepted that provider’s terms.

Where you configure your own delivery provider, that provider is your sub-processor under your own agreement with it, not ours.

099. Intellectual property

We own the Service, including the software, the Console, the documentation, the SDKs and our trademarks, together with all improvements to them. These Terms grant you the right of use described above and nothing more. All rights not expressly granted are reserved.

You own Customer Content. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit and display it solely to provide and support the Service, and to comply with law.

You may not copy, modify, translate, reverse engineer, decompile or create derivative works of the Service, except to the extent that restriction is unenforceable under applicable law.

If you send us feedback, suggestions or feature requests, we may use them without restriction, attribution or payment. Feedback is not your Confidential Information.

1010. Open source components

The Service and the SDKs include third-party open source components, each licensed under its own terms. Where an open source licence conflicts with these Terms in respect of that component, the open source licence governs that component.

A current list of components and licences is available on request.

1111. Confidentiality

Each party may receive information the other treats as confidential, including pricing, roadmap, security documentation and Customer Content. The receiving party will use it only to perform under these Terms, protect it with at least the care it uses for its own confidential information, and disclose it only to people who need it and are bound by similar duties.

This does not apply to information that is public through no fault of the receiver, was already known to it without duty of confidence, is received from a third party free to disclose it, or is independently developed.

Disclosure compelled by law or by a court is permitted, provided the other party is notified in advance where lawful and the disclosure is limited to what is required.

These obligations survive for three years after termination, and indefinitely for Personal Data and for trade secrets.

1212. Data protection

Our handling of Personal Data is described in the Privacy Policy. Where you act as a controller subject to the GDPR, the UK GDPR, the LGPD or a comparable law, the Data Processing Addendum applies and forms part of these Terms.

The Data Processing Addendum sets out how we process Personal Data on your instruction, names the sub-processors we engage, and carries the transfer mechanisms for data leaving the European Economic Area, Switzerland or the United Kingdom.

1313. Representations and warranties

Each party represents that it has the authority to enter into these Terms and that doing so does not breach another agreement binding on it.

You represent that Customer Content and your use of the Service do not infringe third-party rights, that you have the lawful basis and consents described above, and that you will comply with the laws applicable to your product and your End Users.

We represent that we will provide the Service with reasonable skill and care, and in accordance with the technical and organisational measures described in the Data Processing Addendum.

1414. Disclaimers

Except as expressly stated in these Terms, the Service is provided "as is" and "as available". To the fullest extent permitted by law, we disclaim all other warranties, whether express, implied or statutory, including merchantability, fitness for a particular purpose, quiet enjoyment and non-infringement.

We do not warrant that the Service will be uninterrupted or error-free, that defects will be corrected, that it will meet your requirements, or that it will operate with any particular third-party service. No availability commitment applies unless a written service level agreement is in force between us.

The Service is a tool. It does not make your product compliant with any law or standard on its own, and configuring it is your responsibility.

1515. Limitation of liability

To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, nor for lost profits, revenue, goodwill, business or data, however caused and on any theory of liability, even if advised such damages were possible.

Each party’s total aggregate liability arising out of or relating to these Terms is limited to the fees you paid or owed us in the twelve months before the event giving rise to the claim. Where no fees were paid, that liability is limited to one hundred United States dollars.

The cap does not apply to your obligation to pay fees, to either party’s indemnity obligations, or to a party’s breach of confidentiality.

Nothing in these Terms limits liability that cannot be limited by law, including for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that applicable consumer law does not permit to be excluded.

1616. Indemnity

You will defend us against third-party claims arising from Customer Content, from your use of the Service in breach of these Terms, or from your failure to meet your obligations as controller of your End Users’ Personal Data, and will indemnify us for amounts finally awarded or agreed in settlement.

We will defend you against third-party claims that the Service, used as permitted by these Terms, infringes that party’s intellectual property, and will indemnify you for amounts finally awarded or agreed in settlement. This does not cover claims arising from Customer Content, from your configuration, from use after we told you to stop, or from combination with anything we did not supply.

If the Service becomes, or in our opinion is likely to become, subject to such a claim, we may at our option obtain the right to continue, modify it to be non-infringing, or terminate the affected part and refund fees paid for the unused period.

The indemnified party must notify the other promptly, allow it to control the defence, and give reasonable cooperation. No settlement admitting liability may be made without the indemnified party’s consent.

1717. Term, suspension and termination

These Terms take effect when you first accept them and continue while your Account exists.

You may close your Account at any time from the Console.

We may suspend access, in whole or in part, without prior notice where there is a security risk, a legal requirement, a payment more than fifteen days overdue, or use that threatens the Service or other customers. We will restore access once the cause is resolved.

Either party may terminate for material breach that is not cured within thirty days of written notice, or immediately if the other becomes insolvent or enters liquidation.

On termination your right to use the Service ends. Customer Content remains available for export for thirty days, after which it is deleted from production systems in line with the Privacy Policy and the Data Processing Addendum.

Sections that by their nature should survive — fees owed, intellectual property, confidentiality, disclaimers, limitation of liability, indemnity, governing law and these survival provisions — survive termination.

1818. Export control and sanctions

Each party will comply with applicable export control and economic sanctions laws.

You represent that you are not located in, and are not a national or resident of, a country subject to a comprehensive embargo, that you are not on a restricted-party list, and that you will not make the Service available to anyone who is.

You will not use the Service in connection with weapons of mass destruction, or for any purpose prohibited by those laws.

1919. Publicity

Neither party may use the other’s name, logo or trademarks in public materials without prior written consent, except that you may state that you use the Service and we may identify you as a customer once you have agreed to it in writing.

Consent given for a specific use does not extend to other uses, and may be withdrawn on reasonable notice.

2020. Changes to these Terms

We may update these Terms. Where a change is material, we will give at least thirty days’ notice by email to your Account address or through the Console before it takes effect. Continuing to use the Service after the effective date means you accept the change.

If you do not accept a material change, your remedy is to stop using the Service and close your Account before the change takes effect; we will refund fees paid for the unused portion of the current period.

2121. Notices

Notices to us must be sent to [email protected] and, where these Terms require a formal notice, also in writing to NULVLESS CLOUD LTDA, R. Amélia Rodrigues, Cond. Vila Olímpica 1, CEP 44.430-716, Santo Antônio de Jesus, BA, Brazil.

Notices to you may be sent to the email address on your Account or posted in the Console. It is your responsibility to keep that address current.

A notice by email is deemed given on the day it is sent, unless the sender receives a delivery failure.

2222. General

These Terms are governed by the laws of Brazil, without regard to conflict-of-law rules, and the courts of Santo Antônio de Jesus, State of Bahia have exclusive jurisdiction, without prejudice to mandatory consumer protections in your place of residence.

You may not assign these Terms, in whole or in part, without our prior written consent. We may assign them to an affiliate or in connection with a merger, acquisition or sale of substantially all assets. Any other attempted assignment is void.

Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disaster, war, civil unrest, labour action, network or power failure, or acts of government. This does not excuse payment obligations.

The parties are independent contractors. Nothing here creates a partnership, joint venture, agency or employment relationship, and neither may bind the other.

If a provision is held unenforceable, it will be limited to the minimum extent necessary and the rest remains in force. A failure to enforce a provision is not a waiver of it, and a waiver must be in writing.

There are no third-party beneficiaries to these Terms.

These Terms, with the Privacy Policy, the Data Processing Addendum and the Cookie Policy, are the entire agreement between the parties on this subject and supersede prior discussions. Any conflicting terms in your purchase order or vendor portal have no effect.