Terms of Service

1. Acceptance of Terms & Ecosystem Scope

These Terms of Service ("Terms") constitute a legally binding agreement between you ("User", "you") and Veylor Systems ("Veylor", "we", "us", or "our"), governing your access to and use of the Veylor Single Sign-On (SSO) identity platform, located at https://sso.veylor.dev, including all associated authentication APIs, authorization servers, and identity management portals (collectively, the "Service").

Veylor SSO serves as the unified authentication and authorization provider across the Veylor ecosystem and authorized third-party relying parties, including but not limited to eGarage (https://egarageapp.uk), Relay, Pager, and Warden. By creating an account, authenticating through the Service, or utilizing any Veylor authentication endpoint, you agree to be bound by these Terms.

2. Account Provisioning & Security Responsibilities

To access services within the Veylor ecosystem, you must register a universal Veylor identity account. You agree to:

• Provide accurate, current, and complete legal name and valid email address during account provisioning.
• Complete mandatory email verification to activate production relying party access and administrative privileges.
• Maintain the absolute confidentiality and security of your account credentials, passwords, and active session tokens.
• Never share credentials, reuse sensitive passwords from other services, or delegate account access to unauthorized parties.
• Promptly notify Veylor Security ([email protected]) immediately upon suspecting any unauthorized access, token leakage, or credential compromise.

All passwords are protected using the memory-hard Argon2id cryptographic hashing algorithm. Veylor will never ask for your plaintext password via email, phone, or direct message.

3. OAuth 2.0, OpenID Connect & Authorization Grants

The Service implements standard RFC 6749 (OAuth 2.0), RFC 7636 (PKCE), and OpenID Connect Core 1.0 specifications.

• Authorization Codes & PKCE: Authorization codes are strictly single-use, cryptographically generated, short-lived (10 minutes), and bound to SHA-256 code challenges (S256). Any attempt to replay, tamper with, or exchange an expired code will result in immediate revocation.
• Access & ID Tokens: Tokens issued by Veylor SSO are digitally signed with RSA (RS256) public keys published at /.well-known/jwks.json. Access tokens (typ: at+jwt) and ID tokens are strictly scoped to granted permissions.
• Relying Party Delegation: When authorizing an external application (such as eGarage), you grant that relying party permission to receive identity claims (sub, email, name) within the consented scopes. Veylor is not responsible for relying party actions beyond the identity layer.

4. Acceptable Use & System Integrity

You agree not to misuse, disrupt, or attack the Service or its underlying infrastructure. Specifically prohibited activities include:

• Conducting automated brute-force attacks, credential stuffing, or password-spraying against authentication endpoints.
• Attempting to forge, manipulate, or sign JSON Web Tokens (JWTs) without authorized private keys.
• Bypassing or attempting to bypass rate limits, anti-CSRF protections, or client validation checks.
• Reverse-engineering, decompiling, or exploiting authorization flows to gain unauthorized access to relying party resources.
• Using the Service to transmit spam, phishing campaigns, malware, or unlawful content.

Violations of acceptable use policies may result in immediate IP banning, credential revocation, and reporting to competent law enforcement agencies.

5. Account Termination & Session Revocation

We reserve the right to suspend, lock, or terminate any account, API client, or browser session at any time without prior notice if we reasonably believe you have breached these Terms, compromised platform integrity, or if required by law.

Users may terminate their account or revoke active sessions at any time via the Veylor account management portal or by submitting an account deletion request to [email protected].

6. Service Availability & Disclaimers

The Service is provided on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind, whether express, implied, or statutory. While Veylor employs defense-grade security protocols, high-availability infrastructure, and automated backups, we do not warrant that authentication services will be uninterrupted, error-free, or entirely resilient against external distributed denial of service (DDoS) events.

To the maximum extent permitted by applicable law, Veylor Systems shall not be liable for any indirect, incidental, consequential, or punitive damages, or loss of profits, data, or business goodwill arising from your use of or inability to use the Service.

7. Governing Law & Jurisdiction

These Terms are governed by and construed in accordance with the laws of England and Wales. Any disputes, controversies, or claims arising out of or in connection with these Terms or your use of the Service shall be subject to the exclusive jurisdiction of the courts of England and Wales.

8. Contact Information

For security vulnerabilities, please contact our security team at [email protected]. For legal, privacy, or general operational questions, contact [email protected].