Last updated 9 July 2026
Terms and Conditions
These terms are written for IAMCastle Auditor as a commercial business-to-business SaaS platform. They should be reviewed alongside any signed order form and data processing agreement before production launch.
1. Agreement
These Terms and Conditions govern access to and use of IAMCastle Auditor, an independent identity evidence platform operated by IAMCastle. By creating an account, connecting a Microsoft Entra tenant, or using the service, the customer agrees to these terms and any applicable order form, subscription, data processing agreement, or written commercial agreement.
2. Service Description
IAMCastle Auditor connects to Microsoft Entra ID using Microsoft Graph and captures identity audit evidence into an IAMCastle-controlled evidence store. The service is intended to help customers understand who changed identity configuration, what changed, what the previous value was, what the new value is, and whether the evidence can be independently verified.
3. Account Registration and Authority
Customers must provide accurate company, tenant, and administrator information during onboarding. The person creating the account confirms they are authorised to bind the customer, connect the Microsoft Entra tenant, grant read-only Microsoft Graph permissions, and invite additional customer users.
4. Customer Users and Roles
Customer access is limited to two roles: Admin and Read Only. Admin users may manage customer users, settings, billing workflows, and evidence access. Read Only users may view, search, and verify evidence without changing tenant settings, billing, or user access.
5. Microsoft Entra and Graph Permissions
IAMCastle Auditor is designed to operate with read-only Microsoft Graph permissions. Customers are responsible for reviewing and approving requested Microsoft permissions, maintaining their Microsoft tenant configuration, and removing access if they no longer wish IAMCastle Auditor to collect evidence.
6. Evidence Integrity
The platform stores evidence records with cryptographic hash metadata and previous-hash references to support tamper-evident verification. Customers acknowledge that evidence records may contain sensitive identity, security, and administrative information and must be handled accordingly.
7. Free and Paid Plans
Free accounts may ingest evidence while limiting customer visibility to the current evidence window shown in the product. Older retained evidence may be blurred or restricted until the customer upgrades to a paid plan. Paid subscription features, pricing, and billing frequency are shown during checkout or in the applicable order form.
8. Billing
Paid subscriptions are processed through Stripe or another approved payment provider. Subscription fees are billed in advance on a recurring basis unless otherwise agreed in writing. Customers are responsible for maintaining valid billing details, paying applicable taxes, and reviewing invoices.
9. Acceptable Use
Customers must not misuse the service, attempt to bypass tenant isolation, probe unauthorised systems, reverse engineer the platform, interfere with availability, submit malicious content, or use IAMCastle Auditor in a way that violates law, regulation, or third-party rights.
10. Data Protection and Confidentiality
IAMCastle will treat customer evidence and tenant information as confidential information. Each party must protect confidential information using reasonable technical and organisational measures and may use it only to perform obligations, provide the service, comply with law, or exercise rights under these terms.
11. Availability and Changes
IAMCastle aims to provide a reliable commercial SaaS service and may update the platform to improve security, performance, evidence capture, user experience, or compliance. Material changes that reduce core functionality for paid customers will be communicated where commercially reasonable.
12. Suspension and Termination
IAMCastle may suspend access where required to protect the platform, prevent misuse, address non-payment, comply with law, or respond to security risk. Customers may request account closure, subject to evidence retention, legal, billing, and contractual obligations.
13. Limitation of Liability
IAMCastle Auditor provides evidence and verification workflows, but customers remain responsible for security decisions, investigations, regulatory submissions, and operational responses. To the maximum extent permitted by law, IAMCastle will not be liable for indirect loss, loss of profit, loss of business, or loss arising from customer configuration, Microsoft service availability, or third-party systems.
14. Order of Precedence
If a signed order form, enterprise agreement, or data processing agreement conflicts with these terms, the signed document will control for the specific customer and subscription it covers. These terms remain effective for all matters not expressly changed by the signed document.
15. Contact
Questions about these terms, billing, onboarding, or account closure should be sent by email to IAMCastle using the contact address provided during onboarding or in the customer’s commercial agreement.