Terms of Service

Scope and suitability

Simple SAML does not offer a signed data processing agreement, formal service level agreement, business associate agreement, or third-party security certification such as SOC 2 or ISO 27001. If your organization requires any of these, this service is not the right fit.

What Simple SAML does

Simple SAML is a hosted SAML broker. You configure connections, each of which links one identity provider to one client application. When a user initiates SSO, Simple SAML runs the complete SAML protocol with their identity provider and delivers a signed JWT to your application via redirect. Your application never handles SAML directly.

We reserve the right to modify, suspend, or discontinue any part of the Service at any time, with or without notice.

Your account

You are responsible for all activity that occurs under your account, whether or not you authorized it. Keep your credentials secure and do not share your password. If you suspect your account has been compromised, notify us immediately at security@simplesaml.com.

You must be at least 18 years old to create an account. If you are accepting these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity.

Acceptable use

You may use the Service only for lawful purposes and in accordance with these Terms. You agree not to:

• Violate any applicable law, regulation, or third-party rights.
• Forge, manipulate, or replay SAML assertions or identity data.
• Circumvent or attempt to circumvent rate limits, replay protection, or any other security control.
• Interfere with or disrupt the integrity, performance, or availability of the Service or its infrastructure.
• Introduce malicious code, viruses, or other harmful material.
• Attempt to gain unauthorized access to any part of the Service, its underlying systems, or other users' accounts.
• Sublicense, resell, or otherwise make the Service available to third parties without our prior written consent.

We may investigate and take action against any use that we reasonably believe violates these Terms, including suspending or terminating accounts without prior notice.

JWT verification

After running SAML with the identity provider, we deliver a signed JWT to your application. We sign JWTs with RS256 and publish the corresponding public keys as a JWKS at /.well-known/jwks.json. Your application is responsible for fetching the JWKS, caching it per standard practice, verifying the signature, and checking the iss, aud, and exp claims on every token.

We are not liable for unauthorized access to your application resulting from failure to verify JWTs correctly, failure to respect token expiration, or caching public keys beyond their published lifetime.

Pricing and service availability

Simple SAML is free. There are no paid plans, usage fees, or overages. If we introduce paid plans in the future, no charges will apply to your existing account without your explicit opt-in.

The Service is provided on a best-effort basis. We do not offer a service level agreement, uptime guarantee, or support response time commitment. Scheduled maintenance and unplanned outages may occur without advance notice. See the Disclaimer of warranties below.

Intellectual property

Simple SAML and its licensors own all right, title, and interest in the Service, including all software, design, documentation, and content. These Terms do not grant you any ownership interest in the Service. You receive a limited, non-exclusive, non-transferable license to use the Service for its intended purpose during the term of these Terms.

You own your connection configuration data. By using the Service, you grant us a limited license to process and store that data solely to operate the Service.

Termination

You may cancel your account at any time from the account settings page. Cancellation takes effect immediately, and data deletion follows within a reasonable period of time.

We may terminate or suspend your account immediately if you materially breach these Terms, if continued operation of your account would put other users or the Service at risk, or if required by law.

Upon termination, your right to use the Service ends. Your account and its data are deleted within a reasonable period of time, subject to the short server-log retention window described in the Privacy Policy.

Disclaimer of warranties

The Service is provided "as is" and "as available" without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, or uninterrupted availability. We do not warrant that the Service will be error-free or that defects will be corrected.

Some jurisdictions do not allow the exclusion of implied warranties, so some of the above may not apply to you.

Limitation of liability

To the maximum extent permitted by applicable law, Simple SAML and its officers, directors, employees, and agents will not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, data, or goodwill, arising out of or related to your use of the Service.

The Service is provided free of charge. To the maximum extent permitted by applicable law, we will not be liable to you for any monetary damages, refunds, credits, or other monetary compensation arising out of or related to these Terms or your use of the Service, regardless of the cause of action. Your sole and exclusive remedy for any dissatisfaction with the Service is to stop using it and cancel your account.

Some jurisdictions do not allow these limitations, so they may not apply to you in full.

Indemnification

You agree to indemnify and hold harmless Simple SAML and its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of your use of the Service, your violation of these Terms, or your infringement of any third-party right.

Governing law and disputes

These Terms are governed by the laws of the State of Indiana, United States, without regard to its conflict-of-law provisions. Disputes are resolved as set out in the Arbitration section below, with carve-outs that will be heard exclusively in the state or federal courts located in Indiana. You consent to personal jurisdiction in those courts.

Before filing any formal claim, you must provide written notice of the dispute by email to legal@simplesaml.com and give us at least 30 days to resolve it. Most issues can be sorted out without lawyers getting involved.

Arbitration and class action waiver

Any dispute arising out of or related to these Terms or the Service that is not resolved through the pre-suit process above will be settled by binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules. The arbitration will take place in Indiana, and judgment on the award may be entered in any court of competent jurisdiction.

You and Simple SAML each waive any right to a jury trial and any right to participate in a class action, collective action, or representative proceeding. Disputes must be brought in your individual capacity only.

This section does not apply to (a) claims that may be brought in small claims court, or (b) claims for infringement or misuse of intellectual property rights. Those claims may be brought in the Indiana courts identified in the Governing law section.

General

Entire agreement

These Terms, together with our Privacy Policy , constitute the entire agreement between you and Simple SAML and supersede all prior agreements and understandings.

Severability

If any provision of these Terms is found to be unenforceable, that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.

No waiver

Our failure to enforce any right or provision of these Terms will not be considered a waiver of those rights.

Assignment

You may not assign or transfer your rights under these Terms without our prior written consent. We may assign our rights freely, including in connection with a merger, acquisition, or sale of assets.

Changes to these terms

We may update these Terms from time to time. The current version is always posted at this URL with an updated effective date. By continuing to use the Service after the effective date, you accept the revised Terms. If you do not agree to the changes, you may cancel your account.

Contact us

Questions about these Terms? Email us at legal@simplesaml.com. We're happy to clarify anything in plain English.