Terms of Service

1. Acceptance of Terms

By accessing or using the Galeo identity and access management platform ("Service"), operated by Galeo ("Company", "we", "us"), you agree to be bound by these Terms of Service ("Terms"). If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

If you do not agree to these Terms, do not use the Service.

2. Description of Service

Galeo provides a multi-tenant identity and access management platform that includes:

• Single sign-on (SSO) via OIDC, SAML 2.0, and OAuth 2.0 protocols
• User authentication including passwords, passkeys (WebAuthn), TOTP, and smart card/mTLS
• Federated authentication with third-party identity providers
• User provisioning, role-based access control, and application management
• A self-service portal for end users and an administrative dashboard for tenant administrators

3. Accounts and Tenants

To use the Service, an authorized representative must create a tenant (organization account). You are responsible for:

• Providing accurate and complete registration information
• Maintaining the security of administrator credentials and API keys
• All activity that occurs under your tenant, including actions by users you provision
• Promptly notifying us of any unauthorized access or security breach

We reserve the right to suspend or terminate tenants that violate these Terms or pose a security risk to the platform.

4. Acceptable Use

You agree not to use the Service to:

• Violate any applicable law, regulation, or third-party right
• Attempt to gain unauthorized access to any part of the Service, other accounts, or connected systems
• Interfere with or disrupt the integrity or performance of the Service
• Reverse engineer, decompile, or disassemble any part of the Service
• Use the Service to store or transmit malicious code
• Resell, sublicense, or provide the Service to third parties without our written consent

5. Data Ownership and Responsibilities

You retain ownership of all data you submit to the Service ("Customer Data"), including user records, authentication credentials, and configuration. We process Customer Data solely to provide and improve the Service, as described in our Privacy Policy.

You are responsible for the lawfulness of Customer Data and for obtaining all necessary consents from your end users before provisioning them on the platform.

6. Service Levels and Availability

We use commercially reasonable efforts to maintain high availability of the Service. However, the Service is provided "as is" and we do not guarantee uninterrupted or error-free operation. Scheduled maintenance windows will be communicated in advance when possible.

7. Security

We implement industry-standard security measures to protect the Service and Customer Data, including encryption in transit and at rest, access controls, and regular security assessments. Details are available upon request.

You are responsible for configuring your tenant's authentication policies (password complexity, MFA requirements, session timeouts) appropriately for your security needs.

8. Intellectual Property

The Service, including all software, designs, documentation, and trademarks, is the intellectual property of the Company and is protected by applicable laws. These Terms grant you a limited, non-exclusive, non-transferable right to use the Service for the duration of your subscription.

9. Fees and Payment

Certain features of the Service may require a paid subscription. Fees, billing cycles, and payment terms will be set forth in a separate order form or subscription agreement. We may modify pricing with 30 days' written notice.

10. Termination

Either party may terminate these Terms with 30 days' written notice. We may immediately suspend or terminate your access if you breach these Terms or if required by law.

Upon termination, we will make your Customer Data available for export for 30 days. After that period, we may delete it in accordance with our data retention policy.

11. Limitation of Liability

To the maximum extent permitted by applicable law, the Company shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, revenue, or profits arising from your use of the Service. Our total aggregate liability shall not exceed the fees paid by you in the twelve months preceding the claim.

12. Indemnification

You agree to indemnify and hold harmless the Company from any claims, damages, or expenses arising from your use of the Service, violation of these Terms, or infringement of any third-party rights.

13. Modifications

We may update these Terms from time to time. Material changes will be communicated via email or a notice within the Service at least 30 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Terms.

14. Governing Law

These Terms shall be governed by and construed in accordance with the laws of the jurisdiction in which the Company is incorporated, without regard to conflict of law principles.

15. SMS Messaging Program

Galeo operates an SMS messaging program used solely to deliver account-security messages to end users whose tenant administrators have enabled SMS-based multi-factor authentication. The following terms apply to that program.

15.1 Program Description

The program is named "Galeo Account Alerts." Messages are transactional and consist of one-time verification codes (OTP) and related account-security notifications sent in response to a user action, such as signing in, registering a phone number for 2FA, or recovering account access. Galeo does not send marketing or promotional SMS messages.

15.2 Opt-In

A user opts in to the program only by voluntarily entering a mobile phone number into their Galeo account-security settings and confirming that number with a verification code. SMS-based 2FA is optional; users may instead use an authenticator app (TOTP), a passkey (WebAuthn), or backup codes.

15.3 Message Frequency

Message frequency varies and is driven by the user's own activity. A typical user receives a message only when signing in or modifying account-security settings.

15.4 Message and Data Rates

Message and data rates may apply, in accordance with the user's mobile carrier plan. Galeo does not charge users for SMS messages.

15.5 Help

Reply HELP to any program message to receive support contact information. You may also contact support@getgaleo.com at any time.

15.6 Opt-Out

Reply STOP to any program message to opt out. After opting out, you will receive a single confirmation message and no further SMS from the program. You may re-enable SMS 2FA at any time by removing and re-verifying your phone number in your account-security settings.

15.7 Privacy and Third Parties

Galeo will not share your phone number or SMS opt-in data and consent with any third parties. Your phone number and opt-in data are used only to deliver the account-security verification codes you have requested. For full details on how we handle personal information, see our Privacy Policy.

15.8 Carrier Disclaimer

Mobile carriers are not liable for delayed or undelivered messages.

15.9 Supported Carriers

The program is available on all major U.S. mobile carriers. Carriers are not responsible for the program's content or for the accuracy of any messages.

16. Contact

If you have questions about these Terms, please contact us at legal@getgaleo.com.