Terms of Service

These terms of service (“Terms”) govern access to and use of the IDemGuard service, an identity and access management service published by CyberDefGeek (“IDemGuard” or the “Provider”). They apply to any organization that has subscribed to a plan (the “Customer”) and, to the extent relevant, to the persons it authorizes to use the service (the “Users”). This English translation is provided for convenience only; in the event of any discrepancy, the French version prevails.

1. Purpose

The Terms define the conditions under which IDemGuard makes available to the Customer, as SaaS (Software as a Service), a service for single sign-on, strong authentication and access lifecycle management for its applications, as well as the parties' respective rights and obligations. They are supplemented, where applicable, by the signed quote or purchase order, the data processing agreement (DPA) and the service documentation. In the event of a conflict, the quote prevails over the Terms, which prevail over the documentation.

2. Definitions

• Service: the IDemGuard platform, its administration interfaces, its APIs and its integrations, accessible remotely over the Internet.
• Connected Application: any third-party software, website or service whose authentication is delegated to the Service by the Customer (via OpenID Connect, SAML or any supported protocol).
• User: any natural person whose identity is managed in the Service on behalf of the Customer — employee, agent, contractor, customer or citizen.
• Active User: a User who has authenticated at least once through the Service during a calendar month. Plan limits are measured in Active Users, not created accounts.
• Administrator: a User designated by the Customer with configuration rights over the Service.
• Plan: one of the packages (Starter, Business, Enterprise) and options subscribed to by the Customer, as described in the quote.
• Customer Data: all data, including personal data, uploaded, synchronized or generated in the Service on behalf of the Customer.

3. Acceptance

Subscribing to a Plan — by signing the quote, validating the purchase order or activating the Service online — constitutes full and unreserved acceptance of the Terms in force on that date. The Customer vouches for compliance with the Terms by its Administrators and Users and undertakes to inform them of the Terms.

4. Description of the service

Depending on the subscribed Plan, the Service includes in particular:

• single sign-on (SSO) to Connected Applications and two-factor authentication (MFA);
• access lifecycle management: creation, modification, suspension and deletion of Users and their permissions, manually or through directory synchronization (LDAP, Active Directory);
• role-based access control (RBAC): definition of roles by the Customer and assignment of access rights to Connected Applications based on those roles;
• sign-in with third-party accounts through the identity providers built into Keycloak (Google, Microsoft, Facebook, LinkedIn, GitHub, GitLab, Bitbucket, Stack Overflow, OpenShift, PayPal, X/Twitter — Apple available on request) and, depending on the Plan, the FranceConnect, ProConnect and France Identité integrations, subject to the Customer being authorized by the competent authorities;
• an administration dashboard, and authentication and administration logs that can be consulted and exported;
• hosting of Customer Data in France, its backup, and supervision of the Service.

The Service is based on the open-source software Keycloak, which the Provider deploys, hardens, monitors and keeps up to date on the Customer's behalf. Keycloak is a trademark of the Linux Foundation; the Provider is affiliated with neither the Keycloak project nor the Linux Foundation.

The details of the features, limits (Active Users, Connected Applications) and options of each Plan are set out on the Pricing page and in the quote. IDemGuard does not provide the Connected Applications, whose operation is the responsibility of their respective publishers.

5. Access to the service

The Service is accessible 24/7, subject to the provisions of section 10, from any recent browser connected to the Internet. The Customer is responsible for its own equipment and connections.

Upon activation, IDemGuard provides the Customer with the credentials of its first Administrator. The Customer is solely responsible for designating its Administrators, safeguarding credentials, and any action carried out from an Administrator account. Two-factor authentication is mandatory for every Administrator account. Any fraudulent use or suspected compromise must be reported without delay to contact@idemguard.com.

6. Plans, term and pricing

Plans are subscribed, at the Customer's choice:

• as a monthly subscription, with no term commitment, tacitly renewed each month;
• as an annual subscription, for a twelve-month period tacitly renewed for periods of the same duration, with the discount indicated on the Pricing page.

Prices are expressed in euros excluding VAT. À la carte options are billed in addition to the Plan, from their activation until their deactivation by the Customer. If a Plan limit is exceeded (Active Users, Connected Applications), the Customer, informed by IDemGuard, may choose to subscribe to the corresponding option or Plan; failing a choice within 30 days, the corresponding option is billed automatically.

IDemGuard may revise its prices with 60 days' notice given by email. The revision applies from the next renewal; a Customer who refuses it may terminate free of charge before it takes effect.

7. Billing and payment

Subscriptions are billed in advance, monthly or annually depending on the chosen formula, and are payable on receipt and no later than 30 days, by SEPA direct debit, bank transfer or card. Options are billed pro rata for the current month.

In accordance with Articles L.441-10 and D.441-5 of the French Commercial Code, any late payment automatically incurs penalties calculated at the interest rate applied by the European Central Bank to its most recent refinancing operation plus 10 points, as well as a fixed indemnity of €40 for recovery costs. After formal notice remaining without effect for 15 days, IDemGuard may suspend access to the Service until full payment, without such suspension releasing the Customer from its obligations.

8. Customer obligations

The Customer undertakes to:

• use the Service in accordance with its intended purpose, the Terms, the documentation and applicable law;
• guarantee the lawfulness of Customer Data and hold all authorizations required for its processing in the Service, in particular towards its Users, whom it informs in accordance with the GDPR;
• configure the Service appropriately for its security needs (password policies, MFA, session durations, permissions) — IDemGuard provides secure defaults but cannot substitute for the Customer's choices;
• keep its Administrators' and Users' credentials confidential and revoke without delay the access of anyone who should no longer have it;
• obtain, where applicable, the necessary authorizations from DINUM for the use of FranceConnect, ProConnect or France Identité, and comply with their terms of use;
• cooperate in good faith with IDemGuard, in particular in the event of a security incident.

9. Prohibited uses

The Customer and its Users are prohibited in particular from: attempting to access other customers' data or environments; circumventing, testing or compromising the Service's security measures without prior written agreement; decompiling, disassembling or reverse-engineering the Service, except as permitted by law; using the Service to host or distribute unlawful content, or to impersonate a third party; reselling, sublicensing or making the Service available to third parties other than its own Users; generating abnormal load likely to degrade the Service.

In the event of a serious breach, IDemGuard may suspend access to the Service, after notice except in emergencies, without prejudice to the termination provided for in section 16 and to any damages.

10. Service levels

IDemGuard commits to a monthly availability of the Service, measured at the authentication endpoint, according to the subscribed Plan:

Excluded from the calculation are: planned maintenance notified at least 48 hours in advance and carried out outside French business hours (up to 4 hours per month); unavailability attributable to the Customer, its Connected Applications, its Internet providers or third-party services (FranceConnect, external identity providers); force majeure; and the suspensions provided for in sections 7 and 9.

If the availability commitment is not met, the Customer may request, within 30 days following the month concerned, a credit calculated as follows: 10% of the monthly fee per 0.5% below the target, capped at 50%. These credits are the sole compensation due for unavailability.

11. Maintenance and changes

IDemGuard provides corrective and evolutionary maintenance of the Service, whose updates are included in all Plans. IDemGuard may change the Service's features, provided it does not substantially reduce its essential capabilities; API changes and deprecations are announced with at least 90 days' notice, except for security imperatives.

12. Personal data

For Customer Data, the Customer is the data controller and IDemGuard acts as processor within the meaning of Article 28 of the GDPR. The parties' respective obligations — subject matter and duration of processing, nature and purposes, instructions, security measures, sub-processors, assistance, breach notification, fate of data at the end of the contract — are defined in the data processing agreement (DPA) annexed to the quote, which forms an integral part of the Terms.

IDemGuard undertakes to host and process Customer Data exclusively in France, to use no sub-processor established outside the European Union or subject to extraterritorial legislation, and to inform the Customer of any change of sub-processor with notice allowing the Customer to object. The processing of data collected by IDemGuard on its own behalf is described in the Privacy policy.

13. Security and confidentiality

IDemGuard implements the security measures described in the Privacy policy and the DPA, in line with the state of the art for an identity management service: encryption in transit (TLS 1.3) and at rest, environment isolation, logging, continuous monitoring, encrypted backups, disaster recovery plan. An annual security audit is carried out for the Enterprise Plan.

Each party undertakes to keep confidential the other party's information of which it becomes aware in connection with the contract — in particular, for IDemGuard, Customer Data and the Customer's configuration; for the Customer, non-public technical information about the Service — for the entire duration of the contract and five years after its end.

14. Intellectual property

The Service, its software, its documentation, its trademarks and all its components remain the exclusive property of IDemGuard or its licensors. The Terms transfer no rights; the Customer receives a personal, non-exclusive and non-transferable right to use the Service, for its own needs, for the duration of the contract and within the limits of the subscribed Plan.

Customer Data remains the exclusive property of the Customer. IDemGuard uses it solely to perform the Service and claims no rights over it. The Customer authorizes IDemGuard to mention its name and logo as a commercial reference, unless it refuses in writing at any time.

15. Liability

IDemGuard is bound by a best-efforts obligation in providing the Service, subject to the availability commitments in section 10. The Customer acknowledges that no security mechanism offers an absolute guarantee and that the Service does not relieve it of its own security and backup measures.

IDemGuard's liability, on any grounds whatsoever, is limited to proven direct damage and capped at the amount excluding VAT actually paid by the Customer over the twelve months preceding the triggering event. IDemGuard cannot be held liable for indirect damage — loss of revenue, of customers, of data attributable to the Customer, damage to image, commercial harm — nor for damage resulting from the Customer's breach of its obligations, misconfiguration, non-compliant use, or the failure of a third party (Connected Applications, identity providers, network).

These limitations do not apply in the event of gross negligence or willful misconduct, bodily injury, or breach by IDemGuard of its obligations under section 12.

16. Term and termination

The contract takes effect upon activation of the Service for the duration of the subscribed Plan (section 6).

• Monthly subscription: either party may terminate at any time, by email or from the administration interface; termination takes effect at the end of the current month.
• Annual subscription: either party may object to renewal by written notice at least 30 days before the renewal date. Amounts paid for the current period remain due.
• Termination for breach: in the event of a serious breach by either party not remedied within 30 days of formal notice, the other party may terminate as of right, without prejudice to damages. Non-payment and the prohibited uses in section 9 constitute serious breaches.

17. Reversibility

Upon expiry or termination of the contract, for any reason, the Customer has 30 days to export its Customer Data from the administration interface, in a standard, structured, machine-readable format — including realm export in the standard Keycloak format, allowing operations to be taken back in-house or by another provider with no application migration (JSON, CSV, LDIF depending on the data). On request, IDemGuard can assist the Customer with this migration, at the prices then in force.

At the end of this period, IDemGuard permanently deletes Customer Data from its production systems and backups within 30 days, and certifies this in writing on request, except for logs whose retention is required by law.

18. Force majeure

Neither party may be held liable for a failure to perform its obligations resulting from force majeure within the meaning of Article 1218 of the French Civil Code and French case law. The affected party shall inform the other without delay; if the impediment continues beyond 60 days, either party may terminate the contract without indemnity.

19. Changes to the Terms

IDemGuard may amend the Terms. The new version is notified to the Customer by email at least 30 days before it takes effect and published on the website. A Customer who refuses the changes may terminate free of charge before that date; otherwise, continued use of the Service constitutes acceptance. Changes required by legal or regulatory developments apply immediately.

20. Governing law and disputes

The Terms are governed by French law. The parties shall endeavor to resolve amicably any dispute relating to their interpretation or performance, within 30 days of written notice of the dispute by the more diligent party.

Failing an amicable agreement, any dispute shall be subject to the exclusive jurisdiction of the Créteil Commercial Court (Tribunal de commerce de Créteil), including for interim proceedings, third-party claims or multiple defendants. These Terms are addressed to professionals; the provisions of the French Consumer Code do not apply to them.