Terms of service.

These Terms of Service govern your access to and use of Simple SAML, including its website and all related services (collectively, the "Service"). By creating an account or using the Service, you agree to be bound by these Terms. If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization.

If you do not agree to these Terms, do not use the Service.

Simple SAML is built to serve teams from small startups through large enterprises. A signed data processing agreement, a contractual service level agreement, and SOC 2 Type 1 certification are currently in development. A business associate agreement and a third-party certification beyond SOC 2 are not on the near-term roadmap.

Procurement teams that need any of these today can reach legal@simplesaml.com for current status and interim documentation.

Simple SAML is a hosted SAML proxy. You configure connections, each of which links one identity provider to one client application. When a user initiates SSO, Simple SAML runs the complete SAML protocol with their identity provider and delivers a signed JWT to your application via redirect. Your application never handles SAML directly.

We reserve the right to modify, suspend, or discontinue any part of the Service at any time, with or without notice.

You are responsible for all activity that occurs under your account, whether or not you authorized it. Keep your credentials secure and do not share your password. If you suspect your account has been compromised, notify us immediately at security@simplesaml.com.

You must be at least 18 years old to create an account. If you are accepting these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity.

You may use the Service only for lawful purposes and in accordance with these Terms. You agree not to:

• Violate any applicable law, regulation, or third-party rights.
• Forge, manipulate, or replay SAML assertions or identity data.
• Circumvent or attempt to circumvent rate limits, replay protection, or any other security control.
• Interfere with or disrupt the integrity, performance, or availability of the Service or its infrastructure.
• Introduce malicious code, viruses, or other harmful material.
• Attempt to gain unauthorized access to any part of the Service, its underlying systems, or other users' accounts.
• Sublicense, resell, or otherwise make the Service available to third parties without our prior written consent. Authenticating your application's end users through a connection you configure is the intended use of the Service and does not count as making it available to third parties.

We may investigate and take action against any use that we reasonably believe violates these Terms, including suspending or terminating accounts without prior notice.

After running SAML with the identity provider, we deliver a signed JWT to your application. We sign JWTs with RS256 and publish the corresponding public keys as a JWKS at /.well-known/jwks.json. Your application is responsible for fetching the JWKS, caching it per standard practice, verifying the signature, and checking the iss, aud, and exp claims on every token.

We are not liable for unauthorized access to your application resulting from failure to verify JWTs correctly, failure to respect token expiration, or caching public keys beyond their published lifetime.

Simple SAML is currently free to use. There are no paid plans, usage fees, or overages today. If we introduce paid plans in the future, the applicable terms will be communicated through the dashboard and these Terms updated. We may change pricing, plans, and features at any time and for any reason.

The Service is provided on a best-effort basis. We do not offer a contractual uptime guarantee or support response time commitment, and scheduled maintenance and unplanned outages may occur without advance notice. See the Disclaimer of warranties below.

Simple SAML and its licensors own all right, title, and interest in the Service, including all software, design, documentation, and content. These Terms do not grant you any ownership interest in the Service. You receive a limited, non-exclusive, non-transferable license to use the Service for its intended purpose during the term of these Terms.

You own your connection configuration data. By using the Service, you grant us a limited license to process and store that data solely to operate the Service.

You may cancel your account at any time from the account settings page. Cancellation takes effect immediately, and account data is deleted immediately, subject to the short server-log retention window described in the Privacy Policy.

We may terminate or suspend your account immediately if you materially breach these Terms, if continued operation of your account would put other users or the Service at risk, or if required by law.

Upon termination, your right to use the Service ends and your account data is deleted immediately, subject to the same short server-log retention window described in the Privacy Policy.

The Service is provided "as is" and "as available" without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, or uninterrupted availability. We do not warrant that the Service will be error-free or that defects will be corrected.

Some jurisdictions do not allow the exclusion of implied warranties, so some of the above may not apply to you.

To the maximum extent permitted by applicable law, Simple SAML and its officers, directors, employees, and agents will not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, data, or goodwill, arising out of or related to your use of the Service.

While the Service is provided free of charge, and to the maximum extent permitted by applicable law, we will not be liable to you for any monetary damages, refunds, credits, or other monetary compensation arising out of or related to these Terms or your use of the Service, regardless of the cause of action. Your sole and exclusive remedy for any dissatisfaction with the Service is to stop using it and cancel your account. If we introduce paid plans in the future, the limitation of liability for any account on a paid plan will be set out in the order form or applicable subscription terms.

Some jurisdictions do not allow these limitations, so they may not apply to you in full.

You agree to indemnify and hold harmless Simple SAML and its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of your use of the Service, your violation of these Terms, or your infringement of any third-party right.

We will promptly notify you of any claim covered by this section, and you will have sole control of the defense and settlement, provided that no settlement may impose any obligation, payment, or admission on us without our prior written consent.

These Terms are governed by the laws of the State of Indiana, United States, without regard to its conflict-of-law provisions. Disputes are resolved as set out in the Arbitration section below, with carve-outs that will be heard exclusively in the state or federal courts located in Indiana. You consent to personal jurisdiction in those courts.

Before filing any formal claim, you must provide written notice of the dispute by email to legal@simplesaml.com and give us at least 30 days to resolve it.

Any dispute arising out of or related to these Terms or the Service that is not resolved through the pre-suit process above will be settled by binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules. The arbitration will take place in Indiana, and judgment on the award may be entered in any court of competent jurisdiction.

You and Simple SAML each waive any right to a jury trial and any right to participate in a class action, collective action, or representative proceeding. Disputes must be brought in your individual capacity only.

This section does not apply to (a) claims that may be brought in small claims court, or (b) claims for infringement or misuse of intellectual property rights. Those claims may be brought in the Indiana courts identified in the Governing law section.

You may opt out of this arbitration agreement and the class-action waiver by emailing legal@simplesaml.com within 30 days of first accepting these Terms. Your opt-out notice must include your name, the email on your account, and a clear statement that you wish to opt out. Opting out has no effect on any other part of these Terms.

Entire agreement

These Terms, together with our Privacy Policy , constitute the entire agreement between you and Simple SAML and supersede all prior agreements and understandings.

Severability

If any provision of these Terms is found to be unenforceable, that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.

No waiver

Our failure to enforce any right or provision of these Terms will not be considered a waiver of those rights.

Assignment

You may not assign or transfer your rights under these Terms without our prior written consent. We may assign our rights freely, including in connection with a merger, acquisition, or sale of assets.

We may update these Terms from time to time. The current version is always posted at this URL with an updated effective date. By continuing to use the Service after the effective date, you accept the revised Terms. If you do not agree to the changes, you may cancel your account.

Questions about these Terms? Email us at legal@simplesaml.com. We're happy to clarify anything in plain English.