These terms are an agreement between you and Instatus, Inc. ("Instatus", "we", "us"). They cover orbitid.com, the dashboard at app.orbitid.com, the OrbitID API, the hosted sign-in and Admin Portal pages, and the docs (together, "OrbitID"). If you use OrbitID on behalf of a company, you accept these terms for that company and confirm you are allowed to.
Who you are contracting with
OrbitID is a product of Instatus, Inc., a Delaware corporation with its mailing address at 9450 SW Gemini Dr PMB 30900, Beaverton, Oregon, USA. When these terms say "you", they mean the person or company that created the OrbitID team, and everyone that team invites.
Accepting these terms
By creating an account or using OrbitID, you agree to these terms, our Privacy Notice and our Refund Policy. If you keep using OrbitID after we update them, you agree to the new version. We email team owners at least 30 days before a change that reduces your rights takes effect.
Your account
- You must be at least 18 and use OrbitID for a business or professional purpose.
- Give us accurate details when you sign up and keep them current.
- Each login belongs to one person. Invite teammates instead of sharing a login.
- Keep your sign-in email, API keys, client secrets and SCIM tokens safe. You are responsible for everything done with them and by the people you invite.
- Tell us at [email protected] as soon as you suspect someone has accessed your account or keys without permission.
What OrbitID does
OrbitID lets your application offer single sign-on (SAML 2.0 and OpenID Connect) and directory sync (SCIM 2.0 and Google Workspace) to the organizations that use your product ("your customers"). It includes a dashboard, an API, webhooks, hosted sign-in pages and an Admin Portal your customers' IT admins can use to set up their own connections. Every team has a free Sandbox environment for testing and a Production environment for live connections.
Your data and your customers
- You own your data. Everything you or your customers send to OrbitID, including identity assertions, directory users and groups, and configuration ("Customer Data"), stays yours. You give us permission to host, copy and process it only to run OrbitID for you.
- You are responsible for your connections. Before you connect a customer's identity provider or directory, make sure you are allowed to, and that your customers know their data passes through OrbitID.
- We act as your processor. For your customers' users, we process personal data on your instructions, as described in our Privacy Notice. A data processing agreement with standard contractual clauses is available from [email protected].
Acceptable use
You must not use OrbitID to:
- Break any law, or help anyone else break one.
- Commit fraud, send spam, or phish for credentials, including by imitating an identity provider's sign-in page.
- Infringe anyone's intellectual property or privacy.
- Upload malware or code meant to harm OrbitID or anyone using it.
- Probe, scan or test the security of OrbitID without our written permission. Report vulnerabilities to [email protected] instead.
- Scrape the service, get around rate limits, or put a load on OrbitID that harms other customers.
- Resell OrbitID on its own as a single sign-on or directory service. Offering it to your customers inside your own product is exactly what it is for.
Plans, prices and payment
- Sandbox is free, up to 5 connections. It is for building and testing, not for your customers' live sign-ins: connections your customers rely on belong in Production. We may limit or switch off Sandbox connections that serve live customer traffic, after telling you by email.
- Production costs $25 per month for each active SSO connection and each active Directory Sync connection. New teams get a 7-day free trial of Production. Current prices are on the pricing page.
- The subscription is billed monthly. The quantity follows the number of active Production connections, and connections added or removed during a month are prorated.
- Prices exclude taxes. Sales tax or VAT is calculated at checkout and added where it applies.
- We may change prices with at least 30 days' notice by email. The new price applies from your next billing period after the notice ends.
Paddle is our Merchant of Record
Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle handles checkout, payment, invoices, receipts, sales tax and VAT, and processes refunds. Your purchase is also covered by Paddle's Buyer Terms.
Renewal and cancellation
- Your subscription renews every month until you cancel it.
- Team owners can cancel at any time from Billing in the dashboard. Cancelling stops the next renewal. Production connections keep working until the end of the period you have paid for, then stop. Your Sandbox keeps working.
- Refunds follow our Refund Policy.
Failed payments
If a payment fails, Paddle retries it and lets you know by email. If it is still unpaid after 14 days, we may pause your Production connections until it is paid. Your data is not deleted while a payment is overdue.
Suspension and termination
- We may suspend or end your access to OrbitID if you seriously or repeatedly breach these terms, do not pay, put the security of OrbitID or other customers at risk, use it for fraud, or if the law requires us to.
- Pausing Production stops your customers' users from signing in, so unless there is an urgent security or legal reason, we will email you first and give you a chance to fix the problem.
- You can delete your team at any time from the dashboard.
- After your team is deleted, its data is removed from our live systems within 30 days and from backups within 60 days. Export anything you want to keep before you delete it.
Availability and support
We work hard to keep OrbitID running and publish its health at orbitid.instatus.com. We may change or retire features, and we will give reasonable notice before removing anything you depend on. Support is by email at [email protected].
Our intellectual property
We own OrbitID, including its software, design, documentation and brand. These terms do not give you any rights to them beyond using OrbitID as described here. Parts of OrbitID are built on open-source software, which stays under its own licence. If you send us feedback, we may use it without owing you anything.
Confidentiality
Each of us will keep the other's non-public information confidential and use it only for the purpose of these terms. This does not cover information that is already public, that the other party already had, or that a law or court order requires us to disclose.
Disclaimers
OrbitID is provided "as is" and "as available". To the extent the law allows, we do not promise that it will be uninterrupted, error-free or fit for a particular purpose. Nothing in these terms limits rights you have under consumer protection law that cannot be limited by contract.
Limitation of liability
To the extent the law allows:
- Neither of us is liable for indirect, incidental, special or consequential losses, or for lost profits, revenue or data.
- Our total liability for any claim relating to OrbitID is limited to the amount you paid for OrbitID in the 12 months before the claim.
These limits do not apply to your payment obligations, or to liability that cannot be limited by law.
Indemnity
You will defend us against claims from third parties that arise from your application, from Customer Data you had no right to send us, or from your breach of the acceptable use rules above, and cover the costs that result.
Changes to these terms
We may update these terms as OrbitID changes. The date at the top shows when they last changed. Changes that reduce your rights are emailed to team owners at least 30 days before they apply.
Contact
Questions about these terms: [email protected]. Security issues: [email protected].
