These terms govern your use of the Sidaxis platform, the hosted sessions, the API and the MCP servers. By creating an account or calling an endpoint you accept them on behalf of the entity you represent.
Sidaxis provides trust infrastructure: identity verification, anchored receipts, execution rails and the hosted sessions built on them. We provide the rail. We do not provide legal, medical, credit or investment advice, and nothing produced by the platform constitutes such advice from us — the decision, and the responsibility for it, remains yours.
Sidaxis holds no funds, no private keys and no raw biometric data on your behalf or on behalf of your customers. Settlement moves between accounts you and your counterparty control. We are never a party to the transaction, and we never take title to anything that moves across the rail.
We target 99.9% monthly availability on production rails. Enterprise agreements carry a written SLA with service credits. Sandbox is provided as-is, without an availability commitment, and may be reset without notice.
Subscriptions are billed monthly in advance against the volume limit of your plan. Volume above the limit is billed at the overage rate published on your plan, or blocked, at your choice. Fees are exclusive of tax. We give 30 days notice before any price change takes effect on your account.
Either party may terminate for convenience with 30 days notice, or immediately for material breach. On termination your data is exported in a machine-readable format and deleted according to the retention window you configured. Your anchored receipts remain independently verifiable — they do not depend on your account, or on us, to be checked.
Neither party is liable for indirect or consequential loss. Our aggregate liability is capped at the fees you paid in the twelve months preceding the claim, except for our breach of confidentiality, our infringement of your intellectual property, or our gross negligence.
These terms are governed by the laws of the State of Delaware, United States. Enterprise customers may negotiate a different governing law and venue in their order form.
This notice explains what Sidaxis does with personal data, in the two distinct roles we occupy: as a controller of the data of the people who use our own website and dashboard, and as a processor of the data your integration handles on your instruction.
When your integration verifies an identity, collects a consent or settles a payment, you are the controller and we are the processor. We act only on your documented instruction, we never use that data for our own purposes, and we never train any model on it. Our processing terms are set out in the Data Processing Addendum below, which forms part of your agreement automatically.
This is the part that matters most, so it is stated plainly. A liveness check runs on the subject’s device. What returns to us is a cryptographic proof that a live human was present and consenting, together with a one-way template that cannot be reversed into a face. The image and the video are never transmitted to us and never stored. There is no gallery of faces in our infrastructure — nothing to breach, nothing to sell, nothing to subpoena.
Our sub-processors are published and kept current, and every one of them is bound by terms no weaker than these. We give 30 days notice before adding a sub-processor, and you may object. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
You choose the region your data lives in — United States, European Union, Brazil, or your own region under an enterprise agreement — and the retention window per jurisdiction. Cross-border transfers are explicit, logged and revocable, never a silent default, and are covered by Standard Contractual Clauses where required.
Access, correction, deletion, portability and objection, exercisable at privacy@sidaxis.com. Where we process on your behalf as a processor, we forward the request to you within two business days and assist you in answering it. Our Data Protection Officer is reachable at the same address.
This Data Processing Addendum applies whenever Sidaxis processes personal data on your behalf. It is incorporated into your agreement automatically — you do not need to request or sign a separate copy, though we will countersign one on request.
You are the controller. Sidaxis is the processor. Where you are yourself a processor for your own customer, Sidaxis is the sub-processor and these terms flow through unchanged.
You may audit our compliance once a year, or at any time after a breach, either by reviewing our penetration-test summary and security questionnaire — and our SOC 2 report once the audit completes — or by an on-site audit at your cost. Separately, and without asking us at all, you can export the full anchored audit trail yourself at any time — an audit that depends on the vendor’s cooperation is not an audit.
Standard Contractual Clauses apply where personal data leaves the EEA, the UK or Brazil, and are incorporated by reference. Choosing a residency region in the console keeps the data in that region.
The current list is published and versioned. We give 30 days notice before adding one. If you reasonably object and we cannot offer an alternative, you may terminate the affected service without penalty.