Terms of Service

ID Posture is a security posture management platform for Microsoft Entra ID and (optionally) Azure environments. Once Customer grants read-only Microsoft Graph API access (and, optionally, Azure Resource Manager read access) via Microsoft's own admin consent flow, the Service automatically scans the connected tenant on a nightly schedule, evaluates a fixed set of finding rules, computes a posture score, and presents findings, drill-down detail, and on-demand PDF reports through the customer portal at app.idposture.io.

The Service is advisory, not a guarantee. Findings, scores, and framework-mapping features (including Essential Eight and ISO 27001 references) reflect the state of Customer's tenant as observed via read-only API access at the time of each scan. They are a tool to help Customer assess and improve its own security posture; they are not a certification, an audit opinion, a compliance determination, or a warranty that Customer's environment is secure or compliant with any law, standard, or framework. Customer remains solely responsible for its own security posture and compliance obligations.

• Customer must connect using a genuine Microsoft work or school account with authority to grant the requested Graph API/Azure permissions for the organisation being scanned. Personal Microsoft accounts are not supported.
• All authentication is via Microsoft single sign-on. ID Posture does not issue or store local passwords.
• Customer is responsible for the accuracy of information provided at signup and for promptly removing portal access for individuals who should no longer have it, using the Service's own user-management functionality.
• Portal user roles (tenant_admin, tenant_viewer) determine what each individual within Customer's organisation can view or change within the Service. Customer is responsible for assigning roles appropriately within its own organisation.

New accounts receive a 30-day free trial, starting from the point Customer's Microsoft tenant is successfully connected (not from signup). No payment method is required to start a trial. On trial expiry without conversion to a paid subscription, dashboard and scan access is suspended; tenant data is deleted per the retention schedule in the Data Processing Agreement (section 8) if the trial is not converted within the further window described there.

• Paid subscriptions are quote-based and billed annually, payable by bank transfer. ID Posture does not use Stripe or any other card-processing intermediary, and does not store payment card details.
• Subscriptions do not auto-renew. Each term requires a fresh quote or order accepted by Customer before it begins.
• Fees are as set out in the applicable order form or quote accepted by Customer, and are inclusive of GST.
• If a payment is not received by its due date, ID Posture may mark the account's payment status as overdue and, following a 14-day grace period, restrict access. ID Posture will never auto-suspend an account on the same day a payment is missed. Any suspension for non-payment is always a deliberate, manual decision by ID Posture staff, reflecting that a security product should not lock a customer out of its own security visibility over a slow bank transfer.

Customer must not, and must not permit any third party to:

• connect a Microsoft tenant or Azure subscription that Customer is not authorised to represent or grant consent for;
• attempt to access, scan, or assess any tenant other than Customer's own, or use the Service to assess a third party's environment without that third party's authorisation;
• attempt to reverse-engineer, decompile, or bypass the Service's read-only access model, or otherwise attempt to gain write access to Customer's own or any other tenant through the Service;
• resell, sublicense, or provide the Service to any third party as a bureau or managed service, except where a multi-tenant/MSP mode is separately agreed in writing;
• use the Service in a way that violates any applicable law, or Microsoft's own terms of service for the Entra ID/Azure APIs the Service depends on;
• attempt to probe, scan, or test the vulnerability of the Service itself, or breach any security or authentication measure, except through a coordinated disclosure process ID Posture may separately publish.

Customer retains all rights to its own tenant data. ID Posture processes that data only as described in the Privacy Policy and, where Customer's own subscription agreement incorporates it, the Data Processing Agreement. Both documents are incorporated into these Terms by reference. ID Posture claims no ownership over Customer's Entra ID or Azure data, findings generated about Customer's own tenant, or reports Customer generates.

ID Posture and its licensors retain all right, title, and interest in the Service itself, including the scoring methodology, finding rules, software, user interface, and the ID Posture name and logo. These Terms grant Customer a limited, non-exclusive, non-transferable right to access and use the Service for its own internal security assessment purposes during the term of its subscription. No other rights are granted.

The Service is provided on a reasonable-efforts basis. Scheduled nightly scans run once per 24-hour period; the Service does not guarantee a specific scan completion time, and processing may be delayed by upstream Microsoft Graph API throttling outside ID Posture's control. No formal SLA is published, and this section does not raise or disclaim one.

9.1. This section applies whether or not access to the Service is provided for payment (including during a trial). Applicable law, including the Australian Consumer Law, may not allow the exclusion of certain warranties, so to that extent certain exclusions set out below may not apply.

9.2. THE SERVICE IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED. ID POSTURE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND THOSE ARISING BY STATUTE OR FROM A COURSE OF DEALING OR USAGE OF TRADE. ID POSTURE DOES NOT GUARANTEE THAT THE SERVICE WILL BE FREE OF BUGS, SECURITY VULNERABILITIES, OR ERRORS, OR THAT ITS FINDINGS, SCORES, OR FRAMEWORK MAPPINGS ARE COMPLETE OR ACCURATE. THE SERVICE MAY OCCASIONALLY BE UNAVAILABLE FOR ROUTINE MAINTENANCE, UPGRADES, OR OTHER REASONS. YOU AGREE THAT ID POSTURE IS NOT RESPONSIBLE FOR ANY CONSEQUENCES TO YOU OR ANY THIRD PARTY RESULTING FROM TECHNICAL PROBLEMS WITH THE INTERNET, MICROSOFT'S GRAPH API OR AZURE PLATFORM, SLOW CONNECTIONS, OR OVERLOAD OF OUR OR OTHER PARTIES' SERVERS.

9.3. EXCEPT AS EXPRESSLY STATED IN THE PRIVACY POLICY AND DATA PROCESSING AGREEMENT, ID POSTURE DOES NOT MAKE ANY FURTHER REPRESENTATION, WARRANTY, OR CONDITION AS TO THE SECURITY OF ANY INFORMATION CUSTOMER PROVIDES OR ACTIVITIES CUSTOMER ENGAGES IN DURING ITS USE OF THE SERVICE.

10.1. TO THE FULLEST EXTENT PERMISSIBLE BY LAW, ID POSTURE WILL NOT BE LIABLE FOR ANY INDIRECT, EXEMPLARY, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES OF ANY KIND, OR FOR ANY LOSS OF DATA, REVENUE, PROFITS, OR REPUTATION, ARISING UNDER THESE TERMS OR OUT OF CUSTOMER'S USE OF, OR INABILITY TO USE, THE SERVICE, EVEN IF ID POSTURE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES. Nothing in these Terms excludes any guarantee, warranty, or other term implied by the Australian Consumer Law that cannot lawfully be excluded, and this section does not limit liability for such non-excludable terms.

10.2. Except as provided in sections 10.3 and 10.4, IN NO EVENT WILL ID POSTURE'S AGGREGATE LIABILITY FOR ANY DAMAGES ARISING UNDER THESE TERMS OR OUT OF CUSTOMER'S USE OF, OR INABILITY TO USE, THE SERVICE EXCEED THE TOTAL AMOUNT OF FEES PAID BY CUSTOMER TO ID POSTURE FOR THE SERVICE DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

10.3. Liability for (a) a party's breach of its confidentiality obligations (section 15), or (b) either party's indemnification obligations under section 11, other than Customer's obligation under section 11.1(a) (section 10.4), is not subject to the cap in section 10.2, but is instead capped at an amount equal to two (2) times the fees referred to in section 10.2.

10.4. Customer's indemnification obligation under section 11.1(a) (Customer connecting a Microsoft tenant or Azure subscription it was not authorised to connect) is not subject to any cap under this section 10.

11.1. By Customer. Customer agrees to defend, indemnify, and hold harmless ID Posture and its officers, directors, employees, and agents from and against any and all claims, damages, obligations, losses, liabilities, costs, and expenses (including reasonable legal fees) arising from: (a) Customer connecting a Microsoft tenant or Azure subscription it was not authorised to connect; or (b) Customer's violation of these Terms. To the extent conduct falls within both section 11.1(a) and section 11.1(b), section 11.1(a) and the cap treatment in section 10.4 apply, and section 10.3 does not.

11.2. By ID Posture. ID Posture will defend Customer against any third-party claim alleging that Customer's authorised use of the Service, as provided by ID Posture, infringes that third party's patent, copyright, or trademark, and will indemnify Customer for damages finally awarded (or agreed in settlement) as a result, provided Customer promptly notifies ID Posture of the claim, gives ID Posture sole control of the defence and settlement, and reasonably cooperates. This obligation does not apply to claims arising from Customer's misuse of the Service, unauthorised modifications, or use of the Service in combination with materials not provided by ID Posture.

11.3. These are each party's sole remedy, and the indemnifying party's sole liability, for the claims described in this section 11.

• These Terms apply for as long as Customer holds an active trial or paid subscription.
• Customer may request account deletion at any time; ID Posture will delete Customer's tenant data per the retention and deletion terms in the Data Processing Agreement (section 8).
• ID Posture may suspend or terminate access for a material breach of these Terms (including the acceptable-use restrictions in section 5) that is not cured within a reasonable period after notice, or immediately where continued access would pose a security risk to ID Posture or other customers.
• On termination for any reason, Customer's right to access the Service ends immediately; data deletion follows the same schedule as a voluntary account deletion.
• Survival. Sections 7 (Intellectual property), 9 (Warranty disclaimer), 10 (Limitation of liability), 11 (Indemnity), 14 (Governing law and dispute resolution), and 15 (Confidentiality), and any payment obligations accrued before termination, survive termination or expiry of these Terms. Section 15's confidentiality obligations survive for three (3) years after termination.

ID Posture may update these Terms from time to time. Material changes will be notified to Customer's tenant_admin user(s) by email, and take effect no earlier than thirty (30) days after that notice. If Customer objects to a material change, Customer may terminate its subscription by written notice to ID Posture given before the change takes effect, in which case ID Posture will refund a pro-rata portion of any prepaid fees for the unused remainder of the then-current term. Continued use of the Service after a change takes effect constitutes acceptance of the updated Terms.

14.1. Informal dispute resolution. If a dispute arises between Customer and ID Posture, both parties agree to first make a good-faith effort to resolve it informally before commencing any formal dispute resolution proceeding. This requires sending a written description of the dispute to the other party, including, at minimum: the sending party's name, a description of the nature of the claim, and the specific relief sought. For a dispute Customer initiates, send this to [email protected]. For a dispute ID Posture initiates, we will send it to the email address of Customer's registered tenant_admin(s). If the dispute is not resolved within sixty (60) days of receipt, either party may proceed under section 14.2. Any relevant limitation period or filing deadline is tolled while this informal process is underway.

14.2. Formal resolution. If a dispute is not resolved under section 14.1, either party may commence proceedings in the courts of Victoria, Australia. These Terms are governed by the laws of Victoria, Australia.

15.1. Each party may have access to confidential information of the other party in connection with these Terms, including non-public business, technical, or financial information (“Confidential Information”). Each party agrees to use the other party's Confidential Information only as necessary to perform its obligations under these Terms, and to protect it using the same degree of care it uses for its own confidential information of a similar nature, but no less than reasonable care.

15.2. Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was already known to the receiving party without an obligation of confidentiality before disclosure; (c) is independently developed by the receiving party without use of the disclosing party's Confidential Information; or (d) is required to be disclosed by law or a valid order of a court or governmental authority, provided the receiving party gives the disclosing party prompt notice where legally permitted to do so.

15.3. Personal Data processed under the Service is separately, and more specifically, governed by the Data Processing Agreement; this section addresses confidentiality of business and technical information more broadly, and does not limit either party's obligations under the Data Processing Agreement. The obligations in this section 15 survive termination or expiry of these Terms for the period specified in section 12.

Questions about these Terms can be sent to [email protected].