Terms of Service

1. What are these Terms?

These Terms of Service (the “Terms”) are a contract between AnySCIM (“AnySCIM”, “we”, “us”) and the organization that uses the AnySCIM Service (the “Customer”, “you”). They also apply to every person who signs in to AnySCIM on the Customer’s behalf (a “User”).

You accept these Terms when you create an account, accept an invitation, or otherwise use the Service. If you accept them on behalf of a company or other organization, you confirm that you have the authority to bind it. If you don’t have that authority, or you don’t agree with these Terms, don’t use the Service.

AnySCIM is a business service. You must be of legal age to enter into contracts where you live, and you must use the Service for your organization’s business purposes, not as a consumer.

2. What is the AnySCIM Service?

The “Service” is AnySCIM’s hosted user-provisioning platform. It reads your organization’s users, groups and organizational units from Google Workspace and creates, updates and deactivates matching accounts in third-party applications (“Vendors”) through the SCIM 2.0 protocol. It includes the dashboard at anyscim.com, the related APIs, the website, the documentation at /docs, and the support we provide.

3. Do other agreements apply?

These Terms are the whole agreement for most customers. Enterprise customers may sign an order form or a separate agreement with us. Where that document conflicts with these Terms, it prevails, but only on the subject it covers. How we handle personal data is described in our Privacy Policy. If your organization needs a data processing agreement for the personal data we process on its behalf, contact us and we’ll provide one.

4. Can these Terms change?

Yes. We may update these Terms to reflect new features, changes in how the Service works, or new legal requirements. When a change is material, we’ll email the owners of each organization at least 30 days before it takes effect. Changes required by law, or that only concern new features, may take effect sooner.

The date at the top of this page shows when the Terms last changed. If you keep using the Service after a change takes effect, the updated Terms apply. If you don’t accept them, stop using the Service and close your organization as described in section 16. Any other change to these Terms requires a written agreement signed by both parties; an email or chat message isn’t enough.

5. Accounts and organizations

To use the Service you need an account, with your name, a work email address and a password. Everything you give us must be accurate and kept up to date.

• Organizations. When you sign up you create an organization and become its owner. Connections, Google Workspace sources, sync history and audit logs belong to the organization, not to an individual User.
• Roles. Owners can do everything, including managing billing and deleting the organization. Admins can invite people and change the configuration. Members can view it. The Customer is responsible for who it invites and which role each person has.
• Security. Keep your password secret and use one you don’t use anywhere else. You are responsible for all activity on your account and in your organization. If you think someone has accessed your account without permission, change your password and contact us straight away.
• Equipment. You provide and pay for your own devices and internet access.

6. Can I share my account?

No. Every person who needs access should have their own account. Invite colleagues to your organization from the dashboard instead of sharing a password. That way each person has the right role, the audit log shows who did what, and you can remove access when someone leaves. We aren’t responsible for actions taken by someone you gave your credentials to.

7. Free trial, plans and billing

• Free trial. Each new organization gets a 14-day free trial with every feature, and no credit card is required. When the trial ends without an active subscription, the dashboard stays readable but changes are disabled and automatic syncs pause until you subscribe.
• Plans. Plans are based on the number of users in your directory, as described on the pricing page. If your directory grows past your plan’s limit, we’ll tell you in the dashboard. You then have 14 days to move to the right plan, after which the organization loses access until you do.
• Payments. Payments are processed by Stripe. Your card details go directly to Stripe and never pass through or get stored on AnySCIM. Stripe’s own terms apply to the payment.
• Automatic renewal. Subscriptions are billed in advance, monthly or yearly, and renew automatically for the same period until cancelled. You authorize us, through Stripe, to charge your payment method at each renewal.
• Cancelling. Owners can cancel at any time from the Billing page in the dashboard. Cancellation takes effect at the end of the current billing period, and you keep full access until then.
• Refunds. Fees already paid are non-refundable, except where the law requires otherwise or as described in section 13.
• Price changes and taxes. If we change a plan’s price, we’ll tell you at least 30 days in advance and the new price will apply from your next renewal. Prices don’t include taxes, which are added where applicable.
• Late payment. If a payment fails and isn’t fixed, we may switch the organization to read-only or suspend it until the balance is paid.

Enterprise subscriptions are invoiced under the terms of the Enterprise customer’s order form.

8. Who owns my data?

You do. “Customer Data” means everything your organization brings into the Service or that the Service generates for you: directory data read from Google Workspace, connection settings, attribute mappings, sync history and audit logs. As between you and us, the Customer owns all Customer Data.

You give us a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit and display Customer Data only as needed to provide, secure and support the Service, which includes sending it to the Vendors you configure. The licence ends when the Customer Data is deleted from the Service. We may share it with our service providers only to the extent they need it to help us run the Service.

We don’t sell Customer Data, we don’t use it for advertising, and we don’t use it to train AI models. We may access it to provide support you ask for, to investigate a security issue or a breach of these Terms, or when the law requires it.

9. Directory and vendor access

To work, AnySCIM needs access to your Google Workspace directory and to the SCIM endpoint of each Vendor you connect.

• Google Workspace. We request read-only scopes for users, groups and organizational units. AnySCIM never modifies your directory and never reads or stores your users’ passwords.
• Vendor credentials. SCIM tokens and client secrets you enter are encrypted at rest, with a master key that is never stored in the database, and are used only to call the Vendor you entered them for.
• Your authority. You confirm that you are authorized by your organization to grant this access and to create the tokens you enter. You can revoke our access at any time, in Google Workspace or in each Vendor’s settings. Syncs that depend on that access will then stop working.

10. Who is responsible for what gets synced?

AnySCIM acts on the configuration you choose: which groups and organizational units to include, how attributes are mapped, and which Vendors to connect. Based on that configuration it creates, updates and deactivates accounts in your Vendors, automatically and on a schedule. Because of this:

• You are responsible for your configuration and for reviewing its effects. Use dry-run to preview the changes before you enable a connection, and check the audit log.
• Deactivating or removing a user in a Vendor can have consequences that depend on that Vendor, such as losing access to data, licences being released, or content being transferred or deleted under the Vendor’s own policies. We don’t control how Vendors handle those operations.
• You confirm that you have a legal basis under applicable data protection law, and any notice or consent it requires, to transfer your users’ personal data to each Vendor you connect.

11. Rules of use

You agree to use the Service lawfully and in line with these Terms, and to make sure everyone in your organization does too. You must not:

• connect directories, Vendors or accounts that you aren’t authorized to manage, or use the Service to access data that isn’t yours;
• use the Service to send unsolicited messages, or to process data unlawfully;
• probe, scan or test the vulnerability of the Service, or bypass its security or access controls, except as part of a responsible disclosure agreed with us in advance;
• interfere with the Service, overload it, or access it by any means other than the interfaces and APIs we provide;
• copy, modify, reverse engineer or decompile the Service, except where the law expressly allows it;
• resell, sublicense or rent the Service, or provide it to third parties as a managed service, without our written permission;
• use the Service to build a competing product, or to benchmark it publicly without our consent;
• hide the origin of requests, or impersonate another person or organization.

If we reasonably believe the Service is being used unlawfully or in breach of these Terms, we may investigate. During the investigation we may temporarily restrict the affected connections or accounts, and afterwards we may take the steps described in section 16.

12. Third-party services

The Service works with products that we don’t own or control, including Google Workspace, the Vendors you connect, and Stripe. Your use of them is governed by their own terms, and we aren’t responsible for their availability, their behaviour or what they do with your data. Vendors may change or withdraw their SCIM APIs. When that happens we’ll make reasonable efforts to keep the affected integration working, but we can’t guarantee that every Vendor will remain supported.

13. Our rights and service changes

AnySCIM and its licensors own the Service, including its software, design, documentation and trademarks. Subject to these Terms and to payment of any fees, we grant the Customer a limited, non-exclusive, non-transferable right to use the Service for its internal business purposes during its trial or subscription. Any right not expressly granted is reserved.

The Service evolves. We may add, change or remove features, integrations and limits, and we may temporarily interrupt the Service for maintenance or security reasons. If we make a change that materially reduces the core functionality of a paid subscription, owners can contact us. Depending on the case and on what the law requires, we’ll fix the problem, extend the subscription, or refund the unused part of the current billing period.

We use carefully selected service providers, for example for hosting, email delivery and payments, to run the Service.

14. Early access features

We may offer features labelled beta, preview or early access. They are experimental, may not work as expected, may change or disappear without notice, and aren’t covered by any support commitment. Use them with care, especially on connections that provision real accounts. Sections 18 to 20 apply to them in full.

15. Ideas and feedback

We welcome suggestions. If you send us ideas or feedback about the Service, we may use them freely, without any obligation of confidentiality or compensation to you.

16. Closing, suspension and deletion

By you. An owner can delete the organization at any time from the dashboard, after cancelling any active subscription. Each User can delete their own account. If you are the only owner of an organization with other members, you must first make someone else an owner or delete the organization.

By us. We may suspend, restrict or close an organization or account if you seriously or repeatedly breach these Terms, if fees remain unpaid, if your use creates a security risk or legal exposure for us or others, if the law requires it, or if we discontinue the Service. Where possible we’ll give at least 30 days’ notice by email, so you can export what you need, such as your audit logs. We may act immediately when there is a security risk or a legal obligation.

What happens to your data. When an organization is deleted, its connections, credentials, directory snapshots, sync history and audit logs are deleted from the Service and can’t be recovered by you or by us. Residual copies may remain in encrypted backups for a limited time, until those backups expire. Billing records are kept for as long as tax and accounting law requires.

17. Where is my data processed?

The Service is available worldwide, so Customer Data may be processed in countries other than your own, including the United States, by us, our service providers and the Vendors you connect. Where the law requires it, we use appropriate safeguards for international transfers.

18. Disclaimer of warranties

We work hard to keep AnySCIM reliable and secure, but the Service is provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement. We don’t guarantee that the Service will be uninterrupted, error-free or free of security incidents, that every sync will complete, or that every Vendor will accept every request.

19. Limitation of liability

To the maximum extent permitted by law:

• neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, even if it was told they were possible;
• we aren’t liable for the actions of Google, the Vendors or other third parties, for the effects of a configuration you chose, or for unauthorized access caused by credentials you didn’t keep secure;
• our total liability for all claims relating to the Service is limited to the greater of the amounts the Customer paid us for the Service in the 12 months before the event giving rise to the claim, or 100 US dollars.

Nothing in these Terms limits liability for fraud, wilful misconduct or gross negligence, for death or personal injury, or any other liability that cannot be limited under applicable law.

20. Indemnification

The Customer will defend and indemnify AnySCIM, its affiliates, employees and service providers against third-party claims, and the resulting losses and reasonable legal fees, that arise from Customer Data, from a transfer of personal data to a Vendor the Customer connected, or from the Customer’s or its Users’ breach of these Terms. We’ll tell you promptly about any such claim.

21. Export controls and sanctions

You must comply with the export control and sanctions laws that apply to you, including those of the European Union, the United Kingdom and the United States. You may not use the Service if you are located in a country subject to comprehensive sanctions or are listed on a restricted-party list, and we may suspend access where necessary to comply with those laws.

22. Governing law and disputes

These Terms are governed by the laws of Italy, without regard to its conflict-of-law rules. The courts of Italy have exclusive jurisdiction over any dispute arising from these Terms or the Service, unless mandatory law gives you the right to bring a claim elsewhere.

Before going to court, please write to us describing the problem and what you are asking for. Both parties will try in good faith to resolve the dispute within 60 days of that notice. Either party may still seek urgent interim relief from a court at any time.

23. Notices and contact

We send notices by email to the address of your account, to the owners of the organization concerned, or through the dashboard. Keep your email address up to date: a notice is considered received when we send it to the address on file.

For legal notices, questions about these Terms, or support, email sales@anyscim.com.

24. Anything else?

• Entire agreement. These Terms, together with any order form or separate agreement described in section 3, are the entire agreement between us and replace earlier versions.
• Severability. If a court finds a provision unenforceable, it will be enforced to the maximum extent possible in line with the parties’ intent, and the rest of the Terms stay in force.
• No waiver. If we don’t enforce a provision straight away, we don’t give up our right to enforce it later.
• Assignment. You may not transfer these Terms without our written consent. We may transfer them as part of a merger, acquisition or sale of assets, and we’ll let you know if we do.
• Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control, such as outages of third-party infrastructure, natural disasters or acts of government. This doesn’t apply to payment obligations.
• Survival. Sections that by their nature should survive termination, including 8, 15 and 18 to 22, continue to apply.
• Headings. Headings are for convenience only and have no legal effect.