Terms of use

1. Purpose

These terms of use (the Terms) set out the conditions under which the publisher of Obexal, a French company currently being incorporated whose registration details will be published as soon as the incorporation is complete (the Provider), makes the Obexal service (the Service) available to you (the Customer). Obexal is a sovereign European identity provider that offers single sign-on, multi-factor authentication, directory, conditional access, AI agent identity and audit features. By accessing or using the Service, you accept these Terms in full. If you do not accept them, do not use the Service.

2. Access to the Service

The Service is provided on a hosted basis and accessed through a browser or through the documented APIs. Access requires a valid subscription or an active trial. The Provider may update, extend or modify the features of the Service, provided the core functions described in the applicable order are maintained.

• Trials and evaluations may be subject to usage or duration limits stated at sign-up.
• API access is governed by the published administration API specification and any rate limits communicated to the Customer.
• The Provider may require reasonable technical prerequisites (supported browsers, network access to the endpoints).

3. Accounts

The Customer is responsible for the accounts, administrators and end users it creates or provisions in the Service, including through SCIM 2.0. The Customer must keep credentials confidential and enable the authentication factors appropriate to its risk profile (password aligned with NIST guidance, passkeys or WebAuthn, TOTP, email OTP).

• The Customer is responsible for all activity carried out under its tenant and its administrators' accounts.
• The Customer must notify the Provider without undue delay of any suspected unauthorised access at contact@obexal.com.
• The Provider may suspend an account or a tenant in case of a serious security risk, using the kill switch and revocation controls where applicable.

4. Acceptable use

The Customer agrees to use the Service lawfully and in accordance with these Terms. The following are prohibited:

• Attempting to gain unauthorised access to the Service, other tenants, or underlying infrastructure.
• Interfering with the integrity, availability or performance of the Service, including through excessive automated requests outside published limits.
• Uploading unlawful content or using the Service to infringe third party rights.
• Circumventing security, audit or conditional access controls.
• Reselling or making the Service available to third parties beyond the scope of the applicable order, unless the multi-tenant white label offering expressly permits it.

5. Intellectual property

The Service, its software, interfaces, documentation and trademarks remain the exclusive property of the Provider or its licensors. These Terms grant the Customer a non exclusive, non transferable right to use the Service for the duration of the subscription. The Customer retains all rights to its own data and content. No right is granted beyond what is expressly stated here.

6. Availability

The Service is provided as is during the launch phase; a contractual SLA will be offered with the paid plans. The Provider makes reasonable efforts to keep the Service available and to operate it within the European Union. Planned maintenance may temporarily interrupt the Service and will be communicated where practicable. The Service is provided without any warranty other than those expressly stated in these Terms or in the applicable order.

7. Liability

To the extent permitted by applicable law, the Provider's liability is limited to direct and foreseeable damage; any caps are set out in the applicable order or quote. The Provider is not liable for indirect or consequential damages, loss of data resulting from the Customer's configuration, or use of the Service in breach of these Terms. Nothing in these Terms excludes liability that cannot be excluded by law.

8. Termination

Either party may terminate the subscription under the conditions set out in the applicable order. On termination, access to the Service ceases; the Customer may request the export of its data through the standard interfaces (administration API, SCIM 2.0), after which permanent deletion takes place within 30 days of the request, in accordance with our privacy policy. Automatic deprovisioning of downstream applications may be triggered on departure of users (joiner, mover, leaver).

9. Governing law and jurisdiction

These Terms are governed by French law. Any dispute relating to their validity, interpretation or performance falls under the jurisdiction of the competent French courts, subject to any mandatory provision applicable to consumers or specific parties.

10. Contact

For any question regarding these Terms, contact the Provider at contact@obexal.com or by phone on +33 9 84 25 52 61. Publisher: a French company currently being incorporated; registration details will be published as soon as the incorporation is complete.

Version dated 2 July 2026.