Effective 6 October 2026
Terms and Conditions
Business terms governing IAMCastle Auditor subscriptions, evidence collection, Microsoft Entra connections, security, retention and billing.
Effective date
Effective 6 October 2026. These terms apply to new IAMCastle Auditor subscriptions and continued use of the service from that date.
1. Our company and this agreement
IAMCastle Auditor is operated by IAM CASTLE LIMITED, company number 17263388, registered in England and Wales with its registered office at 4 Cobden Terrace, John Street, Rochester, United Kingdom, ME1 1TF. These terms, the applicable order or subscription, and the Data Processing Agreement form the agreement with the customer organisation. The Data Processing Agreement controls for processing customer personal data; a signed order form then takes precedence over these terms for any other conflict.
2. Business use and authority
The service is supplied for business use only and is not offered to consumers. A person creating an account confirms that they have authority to bind the customer, connect its Microsoft Entra tenant, approve the requested read-only Microsoft Graph permissions, and administer customer users.
3. Service description
IAMCastle Auditor connects to Microsoft Entra ID using consented read-only Microsoft Graph permissions. It collects and normalises available identity and configuration events and snapshots, records before-and-after values, creates tenant-scoped SHA-256 hash-chain metadata, and provides search, alerts, reports and exports according to the customer plan.
4. Evidence limitations
The service depends on Microsoft APIs, Microsoft licensing, customer configuration, internet connectivity and other third-party services. IAMCastle does not promise that Microsoft supplies every event or attribute, that collection is uninterrupted, or that an evidence record alone will be legally admissible. IAMCastle evidence supports investigation and audit; it is not legal, compliance or security advice and does not replace the customer's own controls or Microsoft records.
5. Customer users and responsibilities
Customer Admin users may manage customer users, settings, billing workflows and evidence access. Read Only users may view, search and verify evidence without changing customer administration. Customers must maintain accurate account details, promptly remove access that is no longer required, provide required privacy information to their tenant users, protect exports, and use the service only for tenants and data they are authorised to manage.
6. Microsoft permissions
IAMCastle Auditor is designed to operate with read-only Microsoft Graph permissions. Customers are responsible for reviewing and approving requested permissions, maintaining supported Microsoft licensing and configuration, and removing consent if they no longer wish IAMCastle to collect evidence.
7. Plans and evidence visibility
Plan features, evidence visibility, limits and billing frequency are shown at checkout or in an order form. Free accounts may collect evidence while limiting access to older retained records. IAMCastle may change free functionality on reasonable notice. Material reductions to paid core functionality will be communicated where practicable.
8. Billing, taxes and renewal
Paid subscriptions are billed in advance through Stripe or as stated in an order form and renew automatically for the selected monthly or annual period unless cancelled before renewal. IAM CASTLE LIMITED is not currently VAT registered, so VAT is not charged. Other applicable taxes remain the customer's responsibility. If VAT registration changes, affected pricing and invoices will be updated with appropriate notice. Fees already paid are non-refundable except where law, these terms or an order form expressly provides otherwise.
9. Acceptable use
Customers must not unlawfully access another tenant, bypass access controls, introduce malware, disrupt or overload the service, probe systems without written authorisation, reverse engineer the service except where law permits, infringe third-party rights, or use IAMCastle Auditor unlawfully.
10. Customer data and intellectual property
Customers retain their rights in data supplied from their tenants and customer-created configuration. Customers authorise IAMCastle to host, copy, transform and otherwise process that data only to provide, secure and support the service, follow authorised instructions and meet legal obligations. IAMCastle and its licensors retain rights in the service, software, documentation, designs, evidence normalisation and aggregated know-how.
11. Data protection
Each party must comply with applicable data protection law. The customer normally acts as controller and IAMCastle as processor for Microsoft Entra evidence processed to supply the service, subject to the IAMCastle Data Processing Agreement. IAMCastle acts as controller for its own account administration, billing, fraud prevention, platform security, legal compliance and business records as described in the Privacy Policy.
12. Security and confidentiality
IAMCastle applies technical and organisational measures appropriate to the identity evidence processed, including tenant isolation, role-based access, read-only Graph permissions, restricted administration, service authentication, audit logging, encryption in transit, provider-managed encryption at rest, private temporary exports and evidence hashing. Each party must protect the other's confidential information using reasonable care and use it only for the agreement or as required by law.
13. Retention, export and deletion
Customer evidence may be retained for up to seven years from collection. Retention may end earlier following account expiry or closure, an authorised deletion instruction, or an agreed special request, subject to identity and authority checks, technical processing time, legal obligations, dispute holds and backup ageing. An authorised customer Admin may request an export in a standardised machine-readable format through hello@iamcastle.io before deletion. Billing, tax, security and legal records may be retained separately where IAMCastle acts as controller and has a lawful reason to do so.
14. Availability and third-party services
IAMCastle aims to provide a reliable commercial SaaS service but does not commit to a particular uptime percentage unless an order form states an SLA. Planned maintenance, emergency security work, Microsoft or other provider outages, and events outside reasonable control may affect availability. IAMCastle remains responsible for its own contractual obligations when using subcontractors.
15. Suspension and termination
IAMCastle may suspend affected access where reasonably necessary for non-payment, unlawful use, material security risk, customer breach or legal obligations. Where practicable, IAMCastle will give notice and an opportunity to remedy. Customers may cancel recurring billing through the available controls. Cancellation normally takes effect at the end of the paid period; account closure and data handling then follow the retention and deletion provisions and the Data Processing Agreement.
16. Warranties
Each party warrants that it has authority to enter the agreement. IAMCastle will provide the service with reasonable care and skill and materially in accordance with its documentation. To the extent permitted by law, IAMCastle does not warrant that the service will be error-free, uninterrupted, detect every Microsoft change, prevent every security incident, or satisfy every legal or regulatory requirement applying to the customer.
17. Liability
Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or liability that cannot lawfully be excluded or limited. Subject to that, IAMCastle is not liable for indirect or consequential loss, or loss of profit, revenue, anticipated savings, goodwill or business opportunity. Any agreed monetary liability cap or different risk allocation in a signed order form will apply. Customers remain responsible for security decisions, investigations, regulatory submissions and operational responses.
18. Changes to these terms
IAMCastle may update these terms for legal, security, operational or service changes. The effective date will be displayed and paid customers will receive reasonable notice of a materially adverse change unless urgent law or security needs require earlier action. Earlier published versions will be retained for contract and audit history.
19. General
Neither party's failure to enforce a right is a waiver. If a provision is invalid, it will be adjusted or removed only as necessary and the remainder continues. Neither party may assign the agreement without consent, not to be unreasonably withheld, except to an affiliate or as part of a relevant merger, reorganisation or sale with notice. No third party has enforcement rights unless expressly stated.
20. Governing law
Unless a signed customer agreement states otherwise, the agreement and any non-contractual dispute are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
21. Contact
Questions about these terms, billing, onboarding, data export, cancellation, account closure or formal notices should be sent to hello@iamcastle.io. Postal notices may be sent to the registered office stated above.