Terms of Service

1. The service

Authentify provides an API-based authorization layer that lets you define, evaluate, and enforce rules governing what actions an AI agent is permitted to take on your behalf, along with supporting tools: agent and rule management, audit logging, an optional end-user consent widget, and reporting (together, the "Service").

The Service is offered in two environments: sandbox, for testing, and production, for live traffic. Features, rate limits, and pricing differ between them as described in Section 3 and at authentify.bz/#pricing.

2. Eligibility and accounts

The Service is intended for business use by financial institutions, fintechs, and similar organizations, not for individual consumers. You must provide accurate registration information and keep your account credentials, including API keys, confidential.

You are responsible for all activity that occurs under your account and API keys, including activity from your own employees, contractors, and the agents you configure.

3. Sandbox and production

Sandbox access is provided free of charge for 30 days from account creation, with no minimum agent count and no per-authorization fee. Sandbox is for testing and evaluation only, is not covered by any service-level commitment, and is not intended for live financial transactions.

After a minimum of 7 days of sandbox testing, and once you have verified your email, added a billing method, and accepted the applicable service-level agreement, you may activate production. If you have not activated production within 30 days of account creation, sandbox access is suspended until you do.

4. Fees and billing

Paid tiers are billed monthly in advance for the base fee plus metered per-authorization usage, at the rates published at authentify.bz/#pricing and confirmed in your dashboard. Payment is processed by Stripe; by adding a billing method you agree to Stripe's terms in addition to these.

Fees are non-refundable except as required by law. We may suspend production access for accounts with a failed or overdue payment, after notice to the billing contact on file.

5. Your responsibilities

You are solely responsible for the authorization policies, scopes, and rules you configure, and for ensuring they reflect your actual risk tolerance and regulatory obligations. Authentify enforces the rules you set; it does not determine what those rules should be.

If your use of the Service involves the personal data of your own retail customers, for example through the consent widget, you are the data controller for that data, and you are responsible for having a lawful basis to process it and for your own end users' privacy notices and consents. See our Privacy Policy for how Authentify processes data on your behalf in that flow.

6. Acceptable use

You will not: circumvent or attempt to circumvent rate limits, scope enforcement, or consent checks; use the Service to facilitate unlawful transactions; share API keys outside your organization; or reverse-engineer or resell the Service without our written consent.

We may suspend access for activity that we reasonably believe is fraudulent, abusive, or a security risk, and will notify you promptly when we do.

7. Service availability

Production service-level commitments, uptime targets, and support response times are described in the Service Level Agreement presented during production activation and available in your dashboard. Sandbox is provided without any uptime commitment.

8. Data, audit logs, and retention

Authorization decisions and related audit log entries are retained for the periods described in our Privacy Policy and are made available to you through the dashboard and API. You may export your data at any time while your account is active.

On termination, we retain data only as long as necessary for legal, audit, or legitimate business purposes as described in the Privacy Policy.

9. Intellectual property

Authentify retains all rights in the Service, including the API, dashboard, consent widget, and documentation. You retain all rights in your own data, agent configurations, and rules.

We may use aggregated, de-identified data from your use of the Service to improve the Service, provided it does not identify you or your end users.

10. Disclaimers and limitation of liability

The Service is provided "as is" except as expressly stated in the applicable SLA. To the maximum extent permitted by law, Authentify disclaims all implied warranties, and our aggregate liability arising out of or related to the Service will not exceed the fees you paid us in the 12 months preceding the claim.

Neither party is liable for indirect, incidental, or consequential damages. Nothing in these Terms limits liability where prohibited by law.

11. Termination

Either party may terminate for convenience with 30 days' written notice, or immediately for a material breach that is not cured within 15 days of notice. We may suspend or terminate immediately for conduct that poses a security or legal risk.

Sections that by their nature should survive termination, including Sections 8, 9, 10, and 12, will survive.

12. Governing law

These Terms are governed by the laws of the State of Indiana, without regard to conflict-of-laws principles, and any dispute arising out of these Terms will be brought exclusively in the state or federal courts located in Indiana.

13. Changes to these Terms

We may update these Terms from time to time. If we make material changes, we will notify the contact on your account and update the effective date above. Continued use of the Service after changes take effect constitutes acceptance.

14. Contact

Questions about these Terms can be sent to legal@authentify.bz.