Terms of Service & B2B Subscription Agreement.

1. Agreement to Terms & Platform Overview

These Terms of Service ("Terms") constitute a legally binding business-to-business ("B2B") agreement between your organization ("Customer", "you", or "your") and KyoRox ("KyoRox", "we", "us", or "our"), governing your access to and use of the KyoRox Enterprise SSO Platform available at https://kyorox.com, the Customer Control Plane at https://kyorox.com/dashboard, and the production SAML 2.0 to JWT authentication gateway at https://sso.kyorox.com (collectively, the "Service").

By purchasing a subscription, provisioning a tenant workspace, or configuring an Identity Provider ("IdP") connection through the Service, you represent and warrant that you are acting on behalf of a business entity or commercial software project and have full authority to bind that entity to these Terms.

2. Stateless Volatile RAM Architecture & Zero-PII Processing

KyoRox operates exclusively as a stateless cryptographic protocol translator between OASIS SAML 2.0 Identity Providers and your downstream application:

• Volatile RAM Pass-Through: When an end-user authenticates via an enterprise IdP, KyoRox verifies the RSA-SHA256 XML signature and normalizes user attributes (such as NameID email, given name, family name, and group roles) strictly in volatile memory (<15ms execution window) and immediately issues a short-lived RFC 7519 HS256 JSON Web Token ("JWT") to your whitelisted HTTPS callback URL.
• Zero End-User PII Storage: KyoRox stores 0 bytes of end-user Personally Identifiable Information ("PII") on persistent disk, database tables, or application log files. Only non-PII SAML AssertionID cryptographic nonces are cached in memory for 300 seconds to prevent replay attacks.
• Downstream Session Responsibility: Once KyoRox redirects the authenticated user and signed JWT to your whitelisted redirect_uri, your application is solely responsible for verifying the JWT signature using your Tenant Client Secret and managing your own application session lifecycle.

3. Account Provisioning, Email Verification & Control Plane Access

Upon successful subscription checkout, KyoRox automatically provisions an isolated tenant workspace identified by a unique Tenant UUID (UUID v4) and dispatches your initial onboarding credentials—including your Tenant UUID, one-time Live API Key (kx_live_...), and 256-bit JWT Client Secret—to the email address provided during checkout.

You agree to provide and maintain an accurate, active work email address capable of receiving transactional security notifications. If you misplace your welcome email or initial API key, you may use the built-in Email Verification & Credential Recovery flow inside the Control Plane login gate (kyorox.com/dashboard), which dispatches a time-bound 6-digit One-Time Passcode ("OTP") to your registered billing email address to verify workspace ownership before rotating credentials.

4. API Key Security, Irreversible Hashing & Self-Serve Key Rotation

KyoRox enforces zero-trust cryptographic custody for all tenant administrative and signing credentials:

• Irreversible SHA-256 API Key Hashing: Your Live API Key (kx_live_...) is stored exclusively as an irreversible one-way SHA-256 hash verified via constant-time comparison. KyoRox personnel cannot view or retrieve your plaintext API key after initial issuance.
• AES-256-GCM Secret Vault: Your 256-bit HS256 JWT Client Secret and uploaded IdP X.509 certificates are encrypted at rest using FIPS-197 AES-256-GCM with unique 96-bit initialization vectors and 128-bit authentication tags.
• Self-Serve Atomic Key Rotation: When you execute the Self-Serve API Key & Secret Rotation action inside the Control Plane (authenticated via your bound email OTP), your previous API key and JWT Client Secret are immediately and permanently invalidated. You are solely responsible for updating your backend environment variables promptly upon rotation.

5. Customer IdP Configuration & X.509 Certificate Maintenance

KyoRox provides self-serve documentation (/docs) for configuring Okta Workforce Identity, Microsoft Entra ID (Azure AD), Google Workspace, JumpCloud, PingIdentity (PingOne / PingFederate), and Custom OASIS SAML 2.0 providers, along with an automated X.509 Certificate Expiry Radar inside the Control Plane.

While KyoRox sends automated pre-expiry warnings for Growth and Enterprise plans, you remain solely responsible for maintaining accurate IdP Entity IDs, SSO URLs, strict HTTPS allowed_redirect_uris whitelists, and renewing expiring IdP X.509 signing certificates prior to their expiration timestamp.

6. Subscriptions, Plan Quotas, Merchant of Record & Checkout Taxes (VAT/GST/Sales Tax)

KyoRox offers three flat-rate monthly subscription tiers with unlimited Monthly Active Users ($0 MAU tax) and unlimited SAML authentications:

• Starter Plan ($39/month USD): Includes up to 1 Active SAML 2.0 IdP Connection.
• Growth Multi-Tenant Plan ($139/month USD): Includes up to 5 Active SAML 2.0 IdP Connections plus automated 30 / 14 / 7-day X.509 certificate expiry email alerts.
• Enterprise Scale Plan ($349/month USD): Includes up to 999 Active SAML 2.0 IdP Connections (unlimited production scale), automated certificate expiry radar, and priority 99.9% SLA coverage.

Merchant of Record & Checkout Tax Calculation: All subscription payments, recurring billing, invoicing, and global tax compliance are processed by our authorized Merchant of Record, Lemon Squeezy. Listed subscription prices ($39, $139, and $349 USD) are exclusive of applicable local indirect taxes. During checkout, Lemon Squeezy automatically calculates and adds any legally required local Sales Tax, Value Added Tax (VAT), or Goods and Services Tax (GST) based on your billing country and jurisdiction (unless a valid B2B VAT/Tax ID is entered at checkout for reverse-charge exemption where supported by law).

7. Plan Upgrades, Cancellations & Refunds

You may upgrade, downgrade, or cancel your KyoRox subscription at any time through your Lemon Squeezy billing portal or by contacting our billing desk at support@kyorox.com:

• Real-Time Quota Scaling: Upgrading or downgrading your subscription tier automatically updates your tenant's active IdP connection quota in real time.
• Subscription Cancellations: You may cancel your recurring subscription at any time prior to your next monthly renewal date to prevent future charges. Upon subscription expiration or cancellation, active SAML 2.0 proxy connections associated with your tenant are automatically deactivated.
• Refund & Tax Adjustment Rules: Eligibility for subscription refunds and the handling of checkout taxes (VAT, GST, or Sales Tax) upon refund are governed by our official Refund & Billing Policy (/refund).

8. Acceptable Use Policy (AUP) & Security Restrictions

To protect the cryptographic integrity and availability of the KyoRox gateway for all enterprise tenants, you agree not to use, nor permit any third party to use, the Service to:

• Conduct unauthorized authentication interception, credential harvesting, phishing, or spoofing of any third-party Identity Provider or corporate domain.
• Attempt to bypass allowed_redirect_uris HTTPS whitelist validations, forge SAML 2.0 XML signatures, inject XML External Entities (XXE), or replay consumed AssertionID nonces.
• Perform unapproved automated stress testing, denial-of-service (DoS/DDoS) floods, or network reconnaissance against kyorox.com or sso.kyorox.com.
• Violate any applicable data protection, export control, or commercial software laws.

KyoRox reserves the right to immediately suspend or terminate any tenant workspace that violates these security boundaries or poses a threat to platform stability.

9. Service Availability, Live Telemetry & Support SLA

KyoRox is engineered for high-availability enterprise authentication. Real-time gateway operational telemetry and latency metrics are published publicly at https://kyorox.com/status, and cryptographic or gateway release milestones are documented at https://kyorox.com/changelog.

Guaranteed 24 to 36 Hour Engineering Support SLA: All customer inquiries submitted to our official support channel at support@kyorox.com or via https://kyorox.com/contact receive a direct response and resolution path from technical systems engineers within 24 to 36 hours.

10. Intellectual Property & Customer Configuration Ownership

KyoRox Intellectual Property: KyoRox retains all right, title, and interest (including all copyright, trade secret, and proprietary rights) in and to the KyoRox SAML-to-JWT proxy engine, the Customer Control Plane interface, visual design, and developer documentation.

Customer Ownership: You retain full ownership of your downstream software applications, domain names, whitelisted callback URLs, and tenant IdP configuration metadata uploaded to your workspace.

11. Disclaimer of Warranties & Limitation of Liability

Except as expressly stated in these Terms, the Service is provided on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability or fitness for a particular purpose. KyoRox is not responsible for authentication failures caused by third-party Identity Provider outages (including Okta, Microsoft Entra ID, Google Workspace, JumpCloud, or PingIdentity downtime), expired customer X.509 certificates, or misconfigured customer callback servers.

Limitation of Liability: To the maximum extent permitted by applicable law, in no event shall KyoRox be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, business contracts, or data arising out of or related to these Terms. KyoRox's total cumulative liability for all claims arising out of or relating to the Service shall not exceed the net subscription fees (excluding indirect taxes) actually paid by Customer for the Service during the one (1) month immediately preceding the event giving rise to liability.

12. Legal Notices, Updates to Terms & Contact Information

We may update these Terms periodically to reflect new platform capabilities, security enhancements, or regulatory requirements. Material updates will be posted on this page with an updated effective date. Continued use of the Service after an update constitutes acceptance of the revised Terms.