Terms of Service

1. Agreement

By purchasing, accessing, or using any IdentityFirst service, you agree to be bound by these Terms of Service. IdentityFirst services are provided exclusively to businesses and organisations (B2B). These terms do not apply to consumers as defined under the Consumer Rights Act 2015.

If you are entering into these terms on behalf of an organisation, you represent that you have authority to bind that organisation.

2. Services

IdentityFirst provides the following services as described in your service agreement or order form:

• Identity Health Assessment — a one-time assessment of your identity estate using the IdentityMRI™ engine.
• Continuous Identity Governance — ongoing subscription access to the IdentityFirst™ platform.
• Proof of Concept — a 2-month guided POC engagement.
• Advisory & Implementation — professional services as scoped in a Statement of Work.

The specific scope, deliverables, and fees for each engagement are set out in the relevant service agreement or Statement of Work.

3. Data & Security

We process your data in accordance with our Privacy Policy and any Data Processing Agreement (DPA) in place between us.

All connectors operate in read-only discovery mode by default. IdentityFirst does not make changes to your identity systems without your explicit instruction and approval through the designated approval workflow.

We maintain appropriate technical and organisational security measures commensurate with the sensitivity of the data processed.

4. Intellectual Property

The IdentityFirst platform, all software, assessment reports, documentation, and related materials are the intellectual property of IdentityFirst Ltd and are protected by copyright and other applicable laws.

Your data — including identity records, configuration data, and assessment inputs — remains your property at all times. We claim no ownership over your data.

Assessment reports produced for you are licensed to you for internal business use. You may not redistribute, publish, or commercialise reports without our written consent.

5. Acceptable Use

You agree not to:

• Reverse engineer, decompile, or disassemble the IdentityFirst platform or any component thereof.
• Resell, sublicence, or white-label the platform without a separate written agreement.
• Use the services for any unlawful purpose or in violation of applicable regulations.
• Attempt to circumvent authentication, security controls, or rate limits.
• Use the platform to process data you are not authorised to access.

6. Limitation of Liability

To the maximum extent permitted by law, IdentityFirst Ltd's total aggregate liability to you arising out of or in connection with these terms or any services shall not exceed the total fees paid by you in the 12 months immediately preceding the claim.

IdentityFirst Ltd shall not be liable for any indirect, consequential, special, incidental, or punitive loss or damage, including loss of profits, loss of data, or business interruption, whether arising in contract, tort, or otherwise, even if advised of the possibility of such damages.

Nothing in these terms limits liability for death or personal injury caused by negligence, fraud, or any other matter that cannot be excluded by law.

7. Governing Law

These terms are governed by and construed in accordance with the laws of England and Wales.

Any dispute arising out of or in connection with these terms shall be subject to the exclusive jurisdiction of the courts of England and Wales, unless otherwise agreed in writing.

8. Changes to these Terms

We may update these terms from time to time. For material changes, we will provide at least 30 days notice to active customers via email or via a notice on our website before the new terms take effect.

Continued use of the services after the effective date of updated terms constitutes acceptance of the revised terms.

9. Contact

If you have any questions about these terms, please contact us at mark@identityfirst.net.

IdentityFirst Ltd, United Kingdom.