Terms of Service

1. Introduction & acceptance

Welcome to Paswad. Paswad is a passwordless identity platform that lets people sign in to applications with passkeys (WebAuthn credentials) instead of passwords, lets developers add “Sign in with Paswad” to their applications using OAuth 2.1 and OpenID Connect, and — where offered — lets users establish a verified “web passport” identity. The Paswad service is owned and operated by Northfast Limited (“Northfast,” “we,” “us,” or “our”), a company incorporated under the laws of the Republic of Kenya.

These Terms of Service, together with any policies, schedules, and order forms we reference here (collectively, the “Terms”), govern your access to and use of the Paswad websites, applications, dashboards, developer console, APIs, SDKs, and related services (the “Service”).

By creating a Paswad account, registering a passkey, connecting or building an application, or otherwise accessing or using the Service, you confirm that you have read, understood, and agree to be bound by these Terms and by our Privacy Policy. If you do not agree, you must not access or use the Service. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and “you” refers to that entity.

2. Definitions

The following capitalised terms have the meanings set out below wherever they appear in these Terms:

• Account — the personal or organisational account through which you access the Service.
• Passkey — a WebAuthn/FIDO2 credential whose private key is generated and stored on your device or in your platform/cloud keychain and which is used to authenticate you. The corresponding public key is registered with Paswad.
• Verified Contact — an email address and/or WhatsApp phone number you confirm during signup through a one-time passcode (OTP), used for recovery and security alerts.
• Web Passport — an optional verified-identity record issued by Paswad that you may present to relying applications you authorise.
• Recovery Codes — single-use backup codes Paswad may issue so you can regain access if your devices are unavailable.
• Relying Application or OAuth App — a third-party or first-party application that uses Paswad to authenticate users via OAuth 2.1 / OpenID Connect.
• Developer — a person or entity that registers an OAuth App or uses the Paswad APIs, SDKs, or Developer Console.
• Monthly Active Identity (MAI) — a distinct end-user identity that authenticates through your OAuth App at least once in a calendar month, used to calculate certain fees.
• Content — any data, text, configuration, or materials you submit to or through the Service.

3. Eligibility & accounts

To use the Service you must be at least 18 years old, or the age of majority in your jurisdiction if higher, and capable of forming a binding contract. The Service is not directed to children, and you may not use it if you are barred from doing so under applicable law or sanctions regimes.

You are responsible for everything that happens under your Account. You agree to provide accurate, current, and complete information, to keep it up to date, and to maintain the security of your Account, including your passkeys, recovery codes, and Verified Contacts. You must notify us promptly at [email protected] if you suspect any unauthorised access to or use of your Account.

One person or entity may not maintain more than one Account except where expressly permitted (for example, a separate personal and organisational Account). You may not share, sell, or transfer your Account or Web Passport to any other person.

4. Description of the Service

Paswad provides identity infrastructure built around the following components, which we may add to, change, or discontinue over time:

• Passwordless sign-in with passkeys. Users authenticate using WebAuthn credentials. Private keys never leave the user’s device and are never transmitted to or stored by Paswad.
• OpenID Connect single sign-on. Developers can let users authenticate with “Sign in with Paswad” using standard OAuth 2.1 Authorization Code + PKCE and OIDC flows, receiving identity tokens and user-info claims based on the scopes the user approves.
• Web passport (verified identity). Where offered, Paswad can establish and maintain a verified-identity record that a user may present to relying applications they choose to authorise.
• Verified contacts & OTP at signup. Paswad verifies an email address and/or WhatsApp number during onboarding using one-time passcodes.
• Security alerts. Paswad sends notifications (for example, by email) about new sign-ins, new devices, unusual activity, and account changes.
• Recovery. Paswad offers recovery mechanisms such as backup passkeys, recovery codes, and dual-contact verification to help users regain access.

Paswad is an authentication and identity provider. We are not a party to, and do not control, the transactions, services, or content of any Relying Application you sign in to, and we do not guarantee the conduct of any Developer or relying party.

5. Account registration & verified contacts

Creating a Paswad identity requires registering at least one passkey and verifying the contact methods we require at signup. At minimum, you must verify a valid email address and, where required, a WhatsApp phone number, each confirmed through a one-time passcode. These Verified Contacts are used to send security alerts, to support account recovery, and to confirm material account changes.

You agree that the email address and phone number you register are owned and controlled by you, that you will keep them current, and that you will not register contact details belonging to another person without authorisation. We may periodically re-verify your Verified Contacts and may restrict certain functionality until verification succeeds.

You are responsible for safeguarding your Recovery Codes and any backup passkeys. If you lose access to all of your passkeys and recovery methods, we may be unable to restore access to your Account, and certain verified-identity records may need to be re-established.

6. Acceptable use & prohibited conduct

You agree to use the Service lawfully and not to misuse it. Without limitation, you must not, and must not permit any third party to:

• impersonate any person or entity, or misrepresent your identity, affiliation, or the source of any identity assertion;
• use the Service to circumvent identity-verification, sanctions, anti-money-laundering, or know-your-customer obligations;
• attempt to access, derive, intercept, or extract any private key, credential, secret, or token you do not own or are not authorised to use;
• probe, scan, or test the vulnerability of the Service, or breach or circumvent any security or authentication measure, except under an authorised security-testing program;
• interfere with or disrupt the integrity or performance of the Service, including through denial-of-service activity, scraping, or excessive automated requests outside published rate limits;
• reverse engineer, decompile, or disassemble any part of the Service, except to the extent that restriction is prohibited by law;
• use the Service to transmit malware, conduct phishing or fraud, or harvest credentials;
• resell, sublicense, or provide the Service to third parties except as expressly permitted; or
• use the Service in violation of any applicable law, regulation, or third-party right.

We may investigate suspected violations and may suspend or restrict accounts that show signs of fraud, takeover, or abuse while we do so.

7. Passkeys, credentials & security responsibilities

Passkeys are central to how Paswad works, and security is a shared responsibility. Paswad never sees, transmits, or stores your passkey private keys or biometrics; authentication relies on cryptographic proofs produced on your device. You are responsible for the devices, operating systems, and keychains that hold your passkeys, and for keeping them updated and protected.

You agree to maintain at least one current recovery method (such as a backup passkey or your Recovery Codes) so you can regain access if a device is lost, and to keep your Verified Contacts accurate. You are responsible for any activity authenticated by your passkeys, except to the extent caused by our breach of these Terms or by unauthorised access we are responsible for.

If you believe a passkey, recovery code, or device has been compromised, you must revoke it from your Paswad dashboard and notify us promptly. We may revoke credentials, require re-authentication, or take other protective action where we reasonably believe an Account is at risk.

8. Third-party integrations & developers

If you register an OAuth App or use our APIs, SDKs, or Developer Console, you additionally agree to the following. You must keep your client_secret and signing keys confidential and server-side, register accurate redirect URIs, request only the scopes your application needs, and present users with clear, truthful consent. You are responsible for the security and lawful operation of your application and for handling user data you receive in accordance with applicable law and your own privacy notices.

You must not request, store, or use Paswad-issued tokens or claims beyond the scopes the user granted, nor retain access tokens or refresh tokens insecurely. You must honour user revocation, respect token lifetimes, and validate identity tokens against our published signing keys (JWKS).

APIs are subject to rate limits and usage policies published in our developer documentation. We may throttle, suspend, or revoke API access or application credentials that exceed limits, threaten platform integrity, or violate these Terms. We may change, deprecate, or version APIs; we will use reasonable efforts to provide advance notice of breaking changes.

9. Fees, billing & monthly active identities

Some plans are free and others are paid. Fees, plan limits, and entitlements are described on our pricing page and any applicable order form. As of the date of these Terms, our plans are structured as follows (indicative; the current pricing page controls):

• Personal — free for individual end-user accounts.
• Business — a monthly base fee of US$99 per month plus US$0.02 per Monthly Active Identity (MAI) above any included allowance.
• Enterprise — custom pricing and terms agreed in an order form.

Usage-based charges such as MAI fees are measured by Paswad’s systems and billed in arrears. Unless stated otherwise, fees are exclusive of taxes, duties, and withholdings, which are your responsibility, and are non-refundable except where required by law. You authorise us (or our payment processor) to charge your designated payment method for all amounts due. If a payment fails or is overdue, we may suspend paid features after reasonable notice. We may change fees prospectively on notice; changes apply at the start of your next billing cycle.

10. Free trials

We may offer free trials or evaluation access to paid features. Unless we state otherwise, a trial lasts for the stated period and converts to a paid subscription at its end unless you cancel before the trial ends. We may modify or withdraw trials at any time. Trial usage is subject to all of these Terms, and we may apply usage limits during a trial.

11. Intellectual property & license

The Service, including all software, APIs, SDKs, documentation, designs, and the Paswad and Northfast names and logos, is owned by Northfast Limited or its licensors and is protected by intellectual-property laws. Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service for its intended purpose, and to use our SDKs and documentation to build and operate integrations with Paswad.

You may not use our trademarks except to accurately describe an integration (for example, a compliant “Sign in with Paswad” button) and in accordance with any brand guidelines we publish. All rights not expressly granted are reserved. If you provide feedback or suggestions, you grant us a perpetual, royalty-free license to use them without obligation to you.

12. User content & data

You retain ownership of the Content you submit to the Service. You grant us a worldwide, non-exclusive license to host, process, transmit, and display your Content solely as needed to provide, secure, and improve the Service and as otherwise permitted by our Privacy Policy. You are responsible for your Content and for having all rights and consents necessary to provide it.

If you are a Developer, you are the controller of end-user personal data you collect through your application and are responsible for your own lawful basis, notices, and data-subject responses with respect to that data. Where Paswad processes personal data on your behalf, that processing is governed by our data processing terms.

13. Privacy

Our Privacy Policy explains what personal data we collect, how we use and share it, and the choices and rights you have. Because Paswad is passwordless, the most sensitive secret in authentication — your private key — never reaches us. By using the Service, you acknowledge the practices described in the Privacy Policy. Our use of cookies and similar technologies is described in our Cookie Policy.

14. Service availability, changes & beta features

We work hard to keep the Service available, but we do not guarantee uninterrupted or error-free operation. The Service may be temporarily unavailable for maintenance, updates, or factors beyond our control. Any service-level commitments apply only where expressly agreed in a written order form.

We may add, modify, or discontinue features at any time. We may offer features identified as alpha, beta, preview, or experimental (“Beta Features”). Beta Features are provided “as is,” may be changed or withdrawn at any time, are excluded from any service commitments, and may have additional terms. Your use of Beta Features is at your own risk.

15. Suspension & termination

You may stop using the Service and close your Account at any time from your dashboard or by contacting us. We may suspend or terminate your access, in whole or in part, if you materially breach these Terms, if we reasonably believe your use poses a security, legal, or fraud risk, if required by law, or if you fail to pay fees when due. Where practicable and lawful, we will provide notice and an opportunity to cure.

On termination, your license to use the Service ends and we may delete or de-provision your Account and associated data in accordance with our retention practices and applicable law, except data we are required or permitted to retain. Sections intended by their nature to survive termination — including those on fees already incurred, intellectual property, disclaimers, limitation of liability, indemnification, governing law, and dispute resolution — survive.

16. Disclaimers of warranties

To the maximum extent permitted by law, the Service is provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, and any warranties arising from course of dealing or usage of trade. We do not warrant that the Service will be uninterrupted, secure, or error-free, that defects will be corrected, or that the Service will meet your requirements. You are responsible for maintaining recovery methods and for the security of your devices.

17. Limitation of liability

To the maximum extent permitted by law, neither Northfast Limited nor its affiliates, officers, employees, or suppliers will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, goodwill, or business, arising out of or relating to the Service or these Terms, even if advised of the possibility of such damages.

To the maximum extent permitted by law, our total aggregate liability arising out of or relating to the Service or these Terms will not exceed the greater of (a) the total fees you paid to us for the Service in the twelve months before the event giving rise to the liability, or (b) US$100. Some jurisdictions do not allow certain limitations, so some of the above may not apply to you. We are not liable for losses arising from your failure to maintain recovery methods or from actions you authorise with Relying Applications.

18. Indemnification

You agree to defend, indemnify, and hold harmless Northfast Limited and its affiliates, officers, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or related to: (a) your use of the Service; (b) your Content or your application; (c) your violation of these Terms or applicable law; or (d) your violation of any third-party right. We may assume the exclusive defence and control of any matter subject to indemnification, in which case you agree to cooperate.

19. Governing law & jurisdiction

These Terms and any dispute arising out of or relating to them or the Service are governed by the laws of the Republic of Kenya, without regard to its conflict-of-laws rules. Subject to the dispute-resolution section below, the courts located in Nairobi, Kenya have exclusive jurisdiction, and you consent to their personal jurisdiction and venue. Nothing in this section limits any mandatory consumer-protection rights you may have in your country of residence.

20. Dispute resolution & arbitration

We would like to resolve any concern informally first. Before filing a claim, you agree to contact us at [email protected] and to attempt in good faith to resolve the dispute for at least thirty days.

If we cannot resolve a dispute informally, the dispute will be finally settled by binding arbitration administered under the Arbitration Act of Kenya, seated in Nairobi, Kenya, before a single arbitrator and conducted in English. Judgment on the award may be entered in any court of competent jurisdiction. To the extent permitted by law, claims must be brought individually and not as part of a class or representative proceeding. Either party may seek urgent injunctive relief in court to protect intellectual property or confidential information. This section does not deprive you of any non-waivable rights under applicable consumer law.

21. Changes to these Terms

We may update these Terms from time to time. If we make material changes, we will provide reasonable notice, for example by posting the updated Terms with a new “Last updated” date or by notifying you through the Service or a Verified Contact. Changes take effect on the date stated, and your continued use of the Service after that date constitutes acceptance. If you do not agree to the updated Terms, you must stop using the Service.

22. Miscellaneous

• Entire agreement. These Terms, together with the policies and order forms they reference, are the entire agreement between you and us regarding the Service and supersede prior agreements on that subject.
• Assignment. You may not assign or transfer these Terms without our prior written consent. We may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of assets.
• Severability. If any provision is held unenforceable, the remaining provisions remain in full force, and the unenforceable provision will be modified to the minimum extent necessary.
• No waiver. Our failure to enforce any provision is not a waiver of our right to do so later.
• Force majeure. We are not liable for any delay or failure to perform caused by events beyond our reasonable control, including outages, natural disasters, war, or acts of government.
• Notices. We may provide notices through the Service or to a Verified Contact; notices to us should be sent to [email protected].
• No third-party beneficiaries. These Terms do not create rights for any third party except as expressly stated.

23. Contact

Questions about these Terms can be directed to our legal team at [email protected] or through our contact page. Paswad is operated by Northfast Limited, a company incorporated in Kenya (northfast.co.ke).