Terms of Use

Last updated: July 24, 2026

1. Acceptance of these terms

These Terms of Use (the “Terms”) form a binding agreement between Kevra (“Kevra”, “we”, “us”) and the organization or person that uses the service (“Customer”, “you”). By creating an account, ordering a subscription, or using the website or service, you agree to these Terms. If you accept on behalf of an organization, you represent that you are authorized to bind it. If you do not agree, do not use the service.

2. Definitions

3. The service

Kevra deploys, hosts, updates, and monitors open-source software so you do not have to run it yourself. We provision your Instances (for example, a new identity realm, a security tenant, or an infrastructure organization and its workspaces), apply security patches and version upgrades as described in sections 8 and 9, run backups, monitor health, and expose management through the dashboard. We may offer both shared and dedicated Instances, and we may add, change, or deprecate features over time; where a change is material and adverse we will give reasonable notice.

Some features may be offered as beta or preview. Beta features are provided “as is” and “as available”, are excluded from any availability, support, or patching commitment, may be changed, suspended, or withdrawn at any time without notice, and you use them at your own risk.

4. Accounts & eligibility

The service is for business use by organizations and individuals who are at least 18 years old and can form a binding contract. You agree to provide accurate account information and keep it current. You are responsible for your account, for the acts of your users, and for keeping credentials secure. Tell us promptly at contact@kevra.io if you suspect unauthorized access.

5. Fees & billing

• Plans and fees. Fees are set out in your Order and on our pricing page. Unless stated otherwise, fees are exclusive of taxes, which you are responsible for.
• Payment. Subscriptions are billed through our payment processor, Stripe. You authorize us to charge your payment method for the recurring fees and any usage-based charges in your plan.
• Renewal. Subscriptions renew automatically for the same term unless cancelled before the renewal date. You can cancel from the dashboard or by contacting us.
• Changes. Upgrades take effect immediately with a prorated charge where applicable; downgrades take effect at the next renewal. We may change prices with notice, effective at your next renewal.
• Late or failed payment. If a charge fails or fees are overdue, we may suspend the service (see section 16).
• Refunds. Except where required by law, fees are non-refundable, and there are no refunds or credits for partial billing periods or for any period during which the service is suspended under these Terms.

6. Your data

As between you and Kevra, you own your Customer Data. You grant us a limited license to host, process, transmit, and display it only as needed to provide and support the service. We act as a processor for Customer Data and process it only on your documented instructions. Our Data Processing Agreement forms part of these Terms and governs that processing.

You are responsible for your Customer Data and for having the rights and lawful basis to provide it, including any personal data of your End Users. You must give your End Users any notices and obtain any consents that the law requires. On termination, you may export your Customer Data during the window described in section 15.

7. Acceptable use

You agree not to, and not to allow anyone to:

• use the service unlawfully, or to store, transmit, or send unlawful, infringing, or harmful content, including spam or malware;
• breach, probe, or circumvent the security or integrity of the service or others’ systems, except for testing you are authorized to perform on your own Instances;
• interfere with or disrupt the service, or place an unreasonable load on shared infrastructure;
• resell, sublicense, or provide the service to third parties except as your Order permits;
• reverse engineer the platform except to the extent the law permits, or use it to build a competing service.

If you connect an external account or system to the service (for example, a cloud account that your Security instance scans, or an environment your Infrastructure workspaces deploy to), you represent that you are authorized to grant that access and to have those operations performed against it. You are responsible for the scope of the credentials you provide and for the code and configuration you run through the service, including the changes your infrastructure runs make to your environments.

We may investigate suspected violations and take action, including suspension under section 16.

8. Open-source software & updates

The tools we host are built on independent open-source projects, including Keycloak, Prowler, and Terrakube, each licensed under its own terms. We provide hosting and management; we do not sell the underlying software, and we are not affiliated with, or endorsed by, those projects or their trademark holders. Kevra also maintains its own extensions and modifications to this software, and these are part of the Kevra platform. You are responsible for complying with the applicable open-source licenses when you use the hosted software, and nothing in these Terms limits your rights under those licenses.

The upstream projects are developed by third parties. Kevra does not author or control that software and is not responsible for defects or vulnerabilities in the upstream code itself; a vulnerability originating in the upstream software is not a breach of these Terms by Kevra. Our responsibility is how we operate it: we monitor the security advisories of the projects we host and apply upstream security releases to your Instances, with an operational target of 14 days for vulnerabilities rated critical and 30 days for other security fixes, counted from the upstream project publishing a stable release compatible with your Instance. These targets are operational goals, not a warranty or service level commitment, and missing a target is not itself a breach of these Terms. If an upstream release is incompatible with the service or introduces regressions, we may defer it and protect your Instances through other measures until a stable fix can be applied.

9. Availability & support

We use commercially reasonable efforts to keep the service available and to provide support through the channels on our website. We perform scheduled maintenance, such as version upgrades and infrastructure changes, and will aim to give advance notice where meaningful disruption is likely. We may perform emergency maintenance without notice where needed to address a security vulnerability or protect the integrity of the service. Any specific uptime commitment applies only if it is stated in a written service level agreement in your Order.

10. Intellectual property

Kevra and its licensors own the platform, dashboard, and all related software, content, and trademarks, except for the open-source software and your Customer Data. We grant you a non-exclusive, non-transferable right to use the service during your subscription. You may not use the Kevra name or logo without our permission. If you send us feedback or suggestions, you grant us a perpetual, royalty-free license to use them to improve the service.

11. Confidentiality

Each party may access non-public information of the other. The receiving party will use it only to perform under these Terms, protect it with reasonable care, and not disclose it except to those who need it and are bound by similar obligations. This does not apply to information that is public, independently developed, or lawfully received from a third party, or where disclosure is legally required.

12. Warranties & disclaimers

Each party warrants that it has the authority to enter into these Terms. Except as expressly stated, the service is provided “as is” and “as available”, and Kevra disclaims all other warranties to the fullest extent permitted by law, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the service will be uninterrupted, error-free, or free of vulnerabilities, including vulnerabilities in the third-party open-source software we host, or that it will meet every requirement.

13. Limitation of liability

To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or exemplary damages, or for lost profits, revenue, goodwill, or data, arising from these Terms or the service. Each party’s total aggregate liability is limited to the fees you paid to Kevra for the service in the twelve (12) months before the event giving rise to the claim, or 100 euros if no fees were paid. These limits do not apply to your payment obligations, to your indemnification obligations under section 14, or to any liability that cannot be excluded by law, including liability for death or personal injury caused by negligence, or for fraud.

14. Indemnification

You will defend and indemnify Kevra against third-party claims and related losses arising from your Customer Data, your use of the service in breach of these Terms, or your violation of law or third-party rights.

If a third party claims that the Kevra platform (excluding the open-source software, other third-party components, and your Customer Data) infringes their intellectual property rights, Kevra may, at its option and expense, obtain the right for you to continue using the service, modify the service so it is non-infringing, or terminate the affected service and refund any prepaid fees for the unused part of the term. This paragraph states Kevra’s entire liability and your sole and exclusive remedy for infringement claims.

15. Term & termination

These Terms apply for as long as you use the service or have an active subscription. Either party may terminate for material breach that is not cured within 30 days of notice. You may stop using the service and cancel at any time; cancellation takes effect at the end of the current billing period.

On termination, your right to use the service ends. For 30 days afterward you may export your Customer Data in the standard formats of the hosted software (for example, realm exports, security findings, and Terraform state files). After that window we have no obligation to retain Customer Data and may delete it, except where the law requires retention. We may make export assistance beyond the standard tools conditional on payment of outstanding fees. Terms that by their nature should survive (fees owed, confidentiality, intellectual property, disclaimers, liability limits, indemnities, and governing law) survive termination.

16. Suspension

We may suspend the service or an Instance, in whole or in part, and where necessary immediately and without prior notice, if fees are overdue, if you breach section 7, or if we reasonably believe suspension is needed to address a security risk, legal exposure, or harm to the platform or others. Where reasonably practical we will notify you and give you an opportunity to resolve the issue first, and we will lift the suspension once the cause is resolved. Fees continue to accrue during a suspension caused by you, and Kevra is not liable for loss resulting from a suspension applied under this section.

17. Changes to these Terms

We may modify these Terms at any time. We will post the updated version on this page with a revised date and, for material changes, give reasonable advance notice through the dashboard or by email. If you do not agree to a change, you may cancel before it takes effect. Continued use after the effective date means you accept the updated Terms.

18. Governing law & disputes

These Terms are governed by the laws of the country where Kevra has its registered seat, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. The courts of that place have exclusive jurisdiction over any dispute arising out of or in connection with these Terms, and each party consents to that jurisdiction. Before starting formal proceedings, the parties will try in good faith to resolve the dispute directly.

19. General

• Entire agreement. These Terms, your Order, and the Data Processing Agreement are the entire agreement and supersede prior discussions. The Privacy Policy describes how we handle personal data as a controller and does not form part of this agreement.
• Order of precedence. If there is a conflict, a signed Order prevails over these Terms for its subject matter, and the Data Processing Agreement prevails for data protection matters.
• Assignment. You may not assign these Terms without our consent; we may assign them to an affiliate or in connection with a merger or sale.
• Severability & waiver. If any provision is unenforceable, the rest remains in effect, and a failure to enforce a right is not a waiver of it.
• Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.
• Notices. We may give notice through the dashboard or by email; you may give notice to contact@kevra.io.
• Independent parties. Nothing here creates a partnership, agency, or employment relationship.

20. Contact

Questions about these Terms? Email contact@kevra.io.