Skip to content
Sign up freeSign in

Legal review required

This document is a draft and has not been reviewed by legal counsel. Do not treat it as final legal language.

Effective date: 2026-02-16

Last updated: 2026-02-16

Acceptable Use Policy

Plain English Summary

This policy describes prohibited activities, security expectations, and how we handle violations.

1. Prohibited Activities

The following activities are strictly prohibited when using SingleSign. This list is not exhaustive; any activity that threatens the security, integrity, or availability of the Service or its users may be considered a violation.

Attacks and abuse

  • Automated attacks: Launching or facilitating denial-of-service (DoS/DDoS) attacks, brute-force attacks, or any form of automated attack against SingleSign or applications connected through SingleSign.
  • Credential stuffing: Using automated tools to test lists of stolen or leaked credentials against SingleSign accounts.
  • Rate limit circumvention: Attempting to bypass or circumvent API rate limits through any means, including rotating IP addresses, distributing requests across multiple accounts, or exploiting implementation details.

Data misuse

  • Data scraping: Using automated means to collect, harvest, or extract user data, profile information, or any other data from the Service without prior written authorization.
  • Unauthorized data access: Attempting to access, view, or obtain data belonging to other users or applications without proper authorization.
  • Data exfiltration: Extracting or transmitting user data in bulk from the Service for purposes not authorized by the data subjects.

Identity and trust

  • Impersonation: Creating accounts, applications, or content that impersonates another person, organization, or entity, or falsely claims an affiliation.
  • Fake accounts: Creating or operating fake, bot, or automated accounts for any purpose, including inflating metrics, testing, or circumventing restrictions.
  • Phishing: Using SingleSign or its branding to create phishing pages, fraudulent consent screens, or deceptive login flows designed to steal user credentials or data.

Malicious software and content

  • Distributing malware: Using the Service to distribute, host, or facilitate the distribution of viruses, ransomware, spyware, trojans, or any other form of malicious software.
  • Exploit distribution: Sharing or distributing exploits, vulnerabilities, or attack tools that target SingleSign, its users, or connected applications.

Illegal use

  • Illegal purposes: Using the Service for any activity that violates applicable local, state, national, or international laws or regulations.
  • Facilitating illegal activity: Using the Service to facilitate, promote, or support illegal activities by others.
  • Sanctions violations: Using the Service from or on behalf of entities or individuals in jurisdictions subject to comprehensive sanctions, or who are listed on applicable sanctions lists.

2. Security Expectations

All users and developers of SingleSign are expected to follow security best practices. Failure to meet these expectations may expose your account or application to risk and may constitute a violation of this policy.

For Developers

  • Keep secrets confidential: Client secrets, API keys, and other credentials must be stored securely. Never embed secrets in client-side code (JavaScript, mobile apps), public repositories, or any location accessible to end users.
  • Validate redirect URIs: Register specific, exact-match redirect URIs for your application. Do not use wildcard or overly broad redirect patterns. Validate that the redirect URI in authorization requests matches a registered URI.
  • Use HTTPS: All communications with SingleSign APIs must use HTTPS (TLS 1.2 or higher). Never transmit tokens, secrets, or user data over unencrypted connections.
  • Implement PKCE: Public clients (single-page applications, mobile apps, desktop apps) must implement Proof Key for Code Exchange (PKCE) as specified in RFC 7636. This protects against authorization code interception attacks.
  • Token handling: Access tokens and refresh tokens must be stored securely and transmitted only over encrypted channels. Tokens must not be logged, cached insecurely, or exposed to unintended parties.
  • Scope minimization: Request only the scopes your application genuinely requires. Do not request broad scopes "just in case" — this erodes user trust and violates the principle of least privilege.
  • Prompt security updates: Address security vulnerabilities in your application promptly. If a vulnerability in your application could impact SingleSign users, notify us at security@singlesign.com.

For Users

  • Use strong passwords: Choose a unique, strong password for your SingleSign account. Passwords must be at least 8 characters and include a symbol; we recommend using a password manager and a longer password combining letters, numbers, and symbols.
  • Enable MFA: Enable multi-factor authentication (MFA) on your SingleSign account. MFA significantly reduces the risk of unauthorized access, even if your password is compromised.
  • Report suspicious activity: If you notice any unauthorized access, unusual activity, or potential security issues with your account, report it immediately to security@singlesign.com.
  • Keep credentials private: Never share your SingleSign password, MFA codes, or recovery codes with anyone, including SingleSign support. We will never ask you for your password.
  • Review connected apps: Periodically review the applications you have authorized through SingleSign and revoke access for any applications you no longer use or trust.

3. Enforcement

SingleSign takes violations of this policy seriously. We reserve the right to take action against any account or application that violates this policy, our Terms of Service, or any other applicable policy.

Actions we may take

Depending on the nature and severity of the violation, we may take one or more of the following actions:

  • Warning: For minor or first-time violations, we may issue a warning and request that you correct the behavior.
  • Rate limiting: We may impose temporary or permanent rate limits on your account or application to protect the Service and its users.
  • Feature restriction: We may restrict access to specific features or API endpoints.
  • Account suspension: We may temporarily suspend your account or application pending investigation or resolution of a violation.
  • Permanent ban: For severe or repeated violations, we may permanently terminate your account or revoke your application's API access.
  • Legal action: In cases involving illegal activity, we reserve the right to report the violation to law enforcement and pursue legal remedies.

Investigation

  • We may investigate suspected violations using available data, including logs, usage patterns, and reports from other users.
  • During an investigation, we may temporarily restrict access to the account or application in question.
  • We strive to provide notice before taking action, but reserve the right to act immediately when necessary to protect the Service or its users.

Appeals

If you believe action was taken against your account or application in error, you may appeal by contacting support@singlesign.com with a detailed explanation. We will review appeals in good faith and respond within ten (10) business days.

Reporting abuse

If you become aware of any activity that violates this policy, please report it to:

Please include as much detail as possible, including relevant URLs, screenshots, timestamps, and a description of the activity. All reports are reviewed and treated confidentially.