Terms of service
The terms for using TDACorp Identity, whether directly or through a TDACorp product built on top of it. This is a draft pending review by the owner and is not yet an approved contract.
On this page
Draft
Draft
This page is pending owner review. TDACorp has not approved it, and it is not yet a statement of TDACorp policy. Anything marked "pending legal review by the owner" below is deliberately cautious and may change.
Acceptance
Creating an account on TDACorp Identity, or signing in to a TDACorp product that uses it for authentication, means agreeing to these terms. If you do not agree to them, do not create an account or sign in.
| Item | Statement |
|---|---|
| Service operator | TDACorp Private Limited, an Indian company incorporated 17 July 2026 |
| Last reviewed | 5 October 2026 |
| Status of this text | Draft, pending review by the owner |
| How acceptance is shown | By creating an account or signing in. The repository records no separate click-through acceptance step and no version history of accepted terms, so none is claimed |
| Who may not accept | Anyone who does not agree. Eligibility is covered below |
| Related documents | The privacy policy, the security practices page, the data processing addendum, the subprocessor list and the vulnerability disclosure policy |
The service and its pre-production status
TDACorp Identity is TDACorp's shared identity, authentication and access-control platform. It handles registration, sessions, two-factor authentication and passkeys, and the issuing of tokens to the applications you use it with. It does not decide why an account exists in a given product or what that product does with it beyond authentication.
The service is in pre-production and may change or be reset. That has practical consequences you should plan for.
| What may happen | What it means for you |
|---|---|
| Data may be reset | An account created during pre-production could be removed or re-created. Do not treat the platform as the only record of anything you cannot lose |
| Features may change or disappear | Some features are switched off by default or exist only in code; see the security page for the current state |
| Behaviour may differ from a later launch | Numbers such as session lifetimes and limits are today's defaults, not promises for launch |
| Background work may be late | Exports, erasure and similar jobs can run up to about a day late on the current hosting plan |
| Keys are held by a software provider | Pre-production key custody is weaker than the planned design, as the security page states |
| The primary database is not in India | The owner waived that placement for this period; see the privacy policy |
| What the service includes | Provided through |
|---|---|
| Sign-in with a password, passkey, magic link or, where an operator enables it, a linked provider | The sign-in and registration pages |
| Second factors and recovery | Authenticator app, recovery codes and account recovery |
| Sessions, devices and activity | The account pages |
| Tokens for applications | OpenID Connect and OAuth 2.0 endpoints, with consent screens |
| Personal access tokens | The account pages, with step-up |
| Organizations and permissions | Memberships, role bindings and the authorization API used by products |
| Personal-data export and deactivation | The privacy page of your account |
Accounts and eligibility
| Topic | Terms |
|---|---|
| Who may hold an account | Any person who can form a binding agreement where they live and who is not prohibited by law from using it. The repository documents no age check or parental consent flow and collects no date of birth, so the service is not designed for children. Pending legal review by the owner |
| One person, one account | The platform does not check that an account belongs to one person; it is your responsibility to use your own account rather than share it |
| Accurate information | Provide accurate registration information and keep it current. A verified email address is required before an address can be used to sign in |
| Ways an account is created | Self-registration with an email address, or an invitation from an organization (valid 7 days, single use) |
| Unverified registrations | An unverified claim lives 24 hours and is then swept |
| Disposable addresses | The registration flow refuses a curated list of disposable email domains |
| Deleting an account | You may delete your account at any time from the privacy page of your account. It is deactivated at once and cannot be reactivated by you; personal data is erased 30 days later |
| Support | Operators of the platform are a very small group; no support team or support hours are promised |
Credentials and security duties
You are responsible for activity that happens under your account. The platform gives you the controls; using them is your side of the arrangement.
| You agree to | Why it matters |
|---|---|
| Keep your password, passkeys and recovery codes secure and not share your credentials with anyone else | A credential held by someone else is you, as far as the platform can tell |
| Use a long, unique password and not reuse it elsewhere | The platform refuses only the weakest passwords and checks a breach corpus, but cannot know about reuse |
| Use the security features offered, such as a passkey and an authenticator app, where you consider it appropriate | They are the strongest protection available to you |
| Store recovery codes offline | They are shown once and cannot be shown again |
| Keep access to the mailbox on your account | Anyone who controls it can start recovery by design; a 24-hour hold and notices to you are the safeguard |
| Review your sessions, devices and connected applications | You can revoke any of them yourself |
| Read security alert emails and act on a "this was not me" message | Alerts are always sent for changes you make; some events you did not cause are not alerted yet |
| Tell us promptly at security@tdacorp.in if you believe your account is compromised | You can also use the "secure my account" link in a sign-in alert email, which ends every session and token |
| The platform will | The platform will not |
|---|---|
| Hash your password with Argon2id and never store it in a form anyone can reverse | Ask for your password by email or message |
| Email you when security-relevant changes happen | Reveal a recovery code after it is first shown |
| Show you your own sessions and activity | Verify that a person is who they claim to be |
| Limit repeated attempts | Lock an account permanently after failed attempts: there is no lockout |
Acceptable use
Use the service only for lawful purposes and in the way it is meant to be used. The lists below give examples and are not exhaustive.
| Not permitted | Permitted |
|---|---|
| Interfering with the service, including its rate limits, or degrading it for other users | Using the service at normal human or application rates within the limits |
| Attempting to bypass or circumvent a security control, such as two-factor authentication, passkey verification or step-up re-authentication | Using step-up when asked, and using recovery when you are locked out |
| Impersonating another person, account or organization | Choosing a display name and username of your own |
| Using automated means to create accounts, probe credentials or otherwise abuse the service | Using the documented token endpoints and personal access tokens from your own scripts |
| Credential stuffing, password spraying or guessing against any account | Reporting a weakness under the vulnerability disclosure policy |
| Using disposable or throwaway addresses to evade a control | Using any address you control and can verify |
| Sending the service data you have no right to send, or content that is unlawful | Uploading a profile picture (PNG, JPEG or WebP, at most 128 KiB) that you have the right to use |
| Attempting to access another person's account, session, token or data, or another organization's data | Reviewing and revoking your own sessions, tokens and consents |
| Using a webhook or client redirect to make the platform send requests to internal or private addresses | Registering webhooks that point to public https endpoints, where you hold that capability |
| Load testing, denial of service or scanning without our written agreement | Testing your own account for security, within the scope and good-faith rules of the disclosure policy |
| Reselling or sharing access to the service | Signing in to TDACorp products with your own account |
Note
A report of a vulnerability made in good faith under the disclosure policy is not a breach of these terms. The disclosure policy is itself a draft pending owner review.
Third-party applications and consent
When an application asks to sign you in, the platform shows what it is asking for and records your decision. These terms govern the platform; the application's own terms and privacy notice govern what it does with what you give it.
| Topic | How it works today |
|---|---|
| Consent | A third-party application needs your consent for the scopes it requests; a first-party TDACorp application is treated as the platform's own surface and does not ask |
| Review and revoke | The Connected apps page lists applications and lets you revoke each consent |
| What an application receives | Identifiers and the profile claims in the scopes you consented to |
| Sender-constraint | Tokens issued to third-party applications are bound to a key the application holds, so a copied token is not enough |
| Token lifetimes | Access tokens live at most 15 minutes. A third-party refresh token lives at most 7 days sliding and 30 days absolute and rotates on every use |
| Redirects | An application can only send you back to a redirect address registered for it |
| Applications you register | A feature to register OAuth clients of your own exists but is switched off unless an operator enables it; if enabled you are responsible for the client, its keys and what it does |
| TDACorp is not responsible for third parties | An application you connect is operated by someone else. Review it before consenting |
Organizations and administrators
An organization can invite you, give you roles and see your membership. Administrators act within bounds the platform enforces, and their actions are recorded.
| Topic | Terms |
|---|---|
| Joining | Accepting an invitation creates a membership. If you have no account, one is created and you must enrol a credential before the session is established |
| What administrators can do | Invite and remove members, grant and revoke roles, suspend memberships, and, for platform administrators, suspend and reactivate accounts, force resets and start recovery |
| What administrators cannot do | See your password or passkey private key, or read a secret the platform stores only as a hash |
| Roles and notices | You are emailed when a role is granted to you or removed from you in an organization |
| Support access | A support engineer's access to your account is time-boxed, authorized by an elevation and recorded; you are emailed when it starts and when it ends |
| Leaving | You can leave an organization from the Organizations page |
| Organization deletion | An organization marked for deletion has a 30-day grace period recorded; the worker that performs the hard delete is not described as built |
| Product terms | An organization or product may have its own terms that apply in addition to these |
If you are building a product on this platform, the terms under which the platform processes data on your product's behalf are on the data processing addendum page.
Availability and changes
The service is provided as is. No uptime guarantee or service level agreement exists for this platform. TDACorp may modify, suspend or discontinue a feature at its discretion.
| Topic | State |
|---|---|
| Availability promise | None. Service level objectives exist as internal design targets, only some of their metrics are emitted, and none is a promise |
| Support hours or response times | None promised |
| Scheduled maintenance windows | None promised |
| Notice of changes | Changes to the service may be made without individual notice; terms changes are covered below |
| Backups and recovery | Backup jobs are written and not yet run, and no restore time has been measured; do not rely on a restoration |
| Data location | The primary database is in AWS US East 1 (N. Virginia), not in India, during pre-production |
| Third-party dependency | The service relies on a hosting provider, a database provider and an email provider; their outages are outside TDACorp's control |
| Email delivery | Sign-in and security email depends on a provider with a daily allowance; a heavy abuse event could delay mail |
Data and privacy
What personal data this platform collects and why is described on the privacy policy. If you are building a product on this platform, the terms under which it processes data on your product's behalf are on the data processing addendum. The subprocessor page lists the vendors involved. Nothing in these terms narrows the rights listed on the privacy policy.
| Question | Where to look |
|---|---|
| What data is held about me | Privacy policy, data inventory |
| How long it is kept | Privacy policy, retention schedule |
| How to export or delete it | The privacy page of your account |
| How the platform protects it | Security practices page |
| Who else processes it | Subprocessor list |
Intellectual property
The repository contains no intellectual property terms for this service, so none is stated as settled here. The following is a cautious draft that is pending legal review by the owner.
| Topic | Draft position |
|---|---|
| TDACorp's materials | The platform, its software, its brand and its documentation belong to TDACorp or its licensors, and these terms give you no ownership of them |
| Your content | You keep whatever rights you have in content you provide, such as a profile picture, and grant the platform the limited permission it needs to store it and show it to the applications you sign in to |
| Feedback | Suggestions you send about the service may be used without obligation to you |
| Marks | Using TDACorp's name or logo requires permission |
| Open-source components | Third-party components keep their own licences |
Suspension and termination
You may delete your own account at any time from the privacy page of your account. TDACorp may disable or terminate an account for violating these terms, for abusive use of the service, or where required by law.
| Action | Who | Effect | Notice |
|---|---|---|---|
| Delete your account | You | Deactivated at once: every session, token and personal access token is revoked and you cannot sign in; personal data is erased 30 days later | The page asks for a typed confirmation and a fresh second factor; the request is logged and a security alert is emailed |
| Suspend an account | A platform administrator | The principal is refused on its next request; the account can later be reactivated | No dedicated suspension email exists in the repository, so none is promised |
| Suspend or remove a membership | An organization administrator | You lose that organization's access | You are emailed about role removal; a membership suspension has no dedicated email |
| Force a reset or start administrator-assisted recovery | A platform administrator | Credentials are reset or recovery starts | Every verified address receives a hold notice with a one-click cancel |
| Revoke consent for an application | You | The application's tokens for you end | None needed |
| Access by support | A support engineer with an authorized elevation | Time-boxed access | Emails at start and end |
| Disable for abuse or legal reasons | TDACorp | Account disabled | Not promised; the repository describes no abuse notice procedure |
| Break-glass | Two platform administrators | Emergency platform access | Audited; the operations monitor emails an alert to the operator address on its next daily pass |
What survives termination: the audit log keeps events about the account for the retention in the privacy policy; the account identifier and some past session records remain as described there.
Limitation of liability and disclaimers
Pending legal review by the owner
The text below is a cautious draft and has not been approved.
| Topic | Draft position |
|---|---|
| As is | The service is provided as is and as available, in pre-production, without a warranty that it is uninterrupted or error free. To the extent the law allows, warranties not stated here are disclaimed |
| Limit | To the maximum extent permitted by law, TDACorp is not liable for indirect, incidental or consequential damages arising from your use of, or inability to use, this service |
| No fee cap stated | There is no payment relationship between an end user and this platform at this layer, so no cap tied to fees paid applies |
| What is not limited | Nothing here limits liability that the law does not allow to be limited |
| Your responsibility | You are responsible for your credentials and for what is done under your account |
| Pre-production risk | Data loss, resets and security gaps listed on the security page are known and accepted by using the service in this period |
Governing law and disputes
TDACorp Private Limited is an Indian company. These terms, and TDACorp's own processing under them, are governed by the laws of India, including the Digital Personal Data Protection Act, 2023. This is a statement about TDACorp's own processing, not a claim about where any vendor on the subprocessors page operates.
| Topic | State |
|---|---|
| Governing law | The laws of India, as stated above |
| Courts, seat of arbitration, venue | Placeholder, to be decided by the owner. The repository states none, so none is stated here |
| Dispute resolution steps | Not described in the repository. Placeholder pending the owner |
| Notices to you | By email to your verified addresses, or by publication on this page |
Changes to these terms
These terms are revised as the product changes, not on a fixed schedule. Continued use of the service after a change is published here means acceptance of the revised terms. The date at the top, "Last reviewed", records when the text was last reconciled against the code. The repository states no commitment to notify you individually of a change.
Contact
Email security@tdacorp.in, also published in the machine-readable security.txt file at /.well-known/security.txt. No postal address, telephone number or named officer is recorded in the repository, so none is given.
What this page does not claim
- No uptime guarantee or service level agreement is offered, and no support hours or response times are promised.
- TDACorp holds no third-party security certification, such as SOC 2 or ISO 27001.
- This page is a draft pending owner review. It is not an approved contract and is not legal advice.
- This page does not cover a TDACorp product built on this platform beyond authentication; that product has its own terms, which apply in addition to these.
- This page does not cover tdacorp.in, TDACorp's marketing site, which has its own terms.
- Courts, venue, arbitration and dispute steps are not stated and are marked as placeholders.
- No intellectual property terms are approved; the draft position above is for review.
- No age limit or parental consent process is stated, because none is documented in the repository.
- No suspension notice, appeal or abuse-handling procedure is promised beyond what the table above states as built.
- No version history of accepted terms is kept or claimed.
- No claim is made that any statute applies to a particular use beyond the statement of governing law above.
- The repository does not record an organization-specific terms flow; any such terms belong to the organization or product.