Scope: These Terms apply only to public self-service products and plans. Enterprise customers receive a separate contract. Services, trials and onboarding covered by an enterprise or other individually agreed contract are governed by that contract and its annexes. These website terms apply to those services only if that contract expressly incorporates them, and then only as supplementary terms: the individual contract and its annexes take precedence. Creating an account, signing in or using the management console does not replace or amend an enterprise contract. Contact our sales team for an enterprise agreement.
The provider is Corbado GmbH, Lindwurmstraße 44, 80337 Munich, Germany, registered at the commercial registry of the district court of Munich under HRB 273934, represented by its managing directors ("Corbado", "we", "us" or "our").
These Terms of Service ("Terms" or "Agreement") govern the self-service software and hosted services selected by the customer ("Services"). They apply exclusively to customers acting as entrepreneurs (Unternehmer) within the meaning of Section 14 of the German Civil Code (Bürgerliches Gesetzbuch, BGB), not to consumers. The person registering must have authority to bind the customer ("Customer" or "you").
The agreed self-service plan and order confirmation specify the product, features, usage allowance, fees and billing period. Individual agreements take precedence over these Terms. A data processing agreement governs processing on your behalf and takes precedence on data protection matters. Customer purchasing terms apply only if agreed by Corbado. Merely visiting the Website or discussing an enterprise engagement does not conclude this Agreement.
You submit an offer to enter into this Agreement when you register for a self-service account and accept these Terms. Corbado accepts by confirming your registration or making the selected Service available. Paid subscriptions require your acceptance of the applicable fees and billing terms. Corbado may decline a registration before accepting it.
You must provide accurate registration details, keep them current and protect your account access. The Privacy Policy explains how Corbado processes website visitor and account contact data; it does not replace a data processing agreement for Customer Data processed on your behalf. Account creation and access under an enterprise contract remain subject to the scope and precedence provisions above.
Corbado provides cloud-based authentication and authentication observability products, including SDKs, APIs, a management console and dashboards, as included in the selected plan. The Services are standard cloud subscriptions with logical separation of customer projects. Corbado retains its source code; no source-code delivery or on-premises installation is included. Hosting locations and any dedicated deployment are specified in the applicable service description and data processing agreement. Dedicated infrastructure requires a separate agreement.
Where Corbado Observe is included, it provides read-only frontend observability of authentication journeys. Its SDK or JavaScript tag is loaded asynchronously and operates outside the authentication decision. When integrated as documented, end-user login does not depend on Observe being available: event transmission is fire-and-forget, with a timeout, no synchronous call and no retry. A missing SDK is not an authentication error, and collection resumes automatically after an outage. This frontend integration does not require a network path or credentials to the Customer's backend systems. These characteristics describe Observe, not authentication products that actively participate in login.
You are responsible for integrating and configuring the Services according to the documentation and testing your integration before production use. Test and staging projects, additional applications, brands, affiliates and dashboard users are included to the extent specified in your plan or individual agreement. Corbado provides product updates; you must use supported SDK and API versions and apply required security updates.
Corbado makes daily backups of its data systems, retained for up to ten (10) days in multiple locations. Backups cover data held under the applicable retention configuration and support service recovery. Restoration of individual Customer Data deleted by mistake or through valid API calls is not included. Data return and deletion at the end of the Agreement are governed by Section 12 and the applicable data processing agreement.
Self-service support includes the integration assistance and support channels specified in your plan, generally in German or English. Custom development, individual dashboards, a dedicated authentication engineer, strategic consulting and enterprise single sign-on are included only if expressly agreed. Enterprise onboarding, support hours, response times and operating commitments are governed by the enterprise contract and its support annexes; these Terms do not limit them.
Corbado retains all rights in the Services, SDKs, APIs, dashboards, documentation and know-how. For the agreed term, Corbado grants you a worldwide, non-exclusive, non-transferable and non-sublicensable right to use the Services for your business purposes, subject to the selected plan and payment of applicable fees. Use for affiliates is permitted where included in the plan or individual agreement.
Customer Data. As between the parties, you retain all rights in data submitted to or collected through the Services on your behalf, including data collected from your login journeys ("Customer Data"). Corbado processes that data to provide the agreed Services and in accordance with your instructions and the applicable data processing agreement. Corbado does not use your personal or pseudonymized Customer Data for its own purposes. You may export your data using the export functions and APIs included in the Service; you may also request its return under Section 12.
Aggregated insights and feedback. Subject to the restrictions below, Corbado may use anonymized, aggregated insights to improve its products and may freely use feedback you provide. This does not permit disclosure of confidential information or use of personal or pseudonymized Customer Data for Corbado's own purposes. Pseudonymization alone is not anonymization.
Authentication Intelligence. This is a manually maintained body of general error patterns and rules about how authentication methods behave in particular client environments, such as a browser or operating-system version. Corbado derives these rules from anonymized, aggregated statistics without personal references or publicly available industry knowledge and makes them available to customers as explanations of dashboard anomalies. Authentication Intelligence does not involve automated analysis or pooling of personal data across customers. Automated anomaly detection on your own Customer Data is part of the Service performed on your instructions; its results are available only to you and your authorized users.
Limits on data use. Your business outcome metrics, including conversion rates, and cost metrics linked to your backend systems are excluded from the use of aggregated insights and Authentication Intelligence described above. Corbado does not analyze personal or pseudonymized Customer Data across customers or include it in cross-customer benchmarks. Corbado does not use Customer Data to train its own or third-party AI models. The limited permission for anonymized, aggregated insights does not override these restrictions.
Fees, included volumes, usage units (such as monthly active users or events), billing periods and payment dates are those accepted when you select your plan or place an order. All prices exclude statutory VAT. Any communications surcharges, for example for SMS or WhatsApp messages, must be disclosed and accepted as part of the applicable pricing and are shown separately on invoices. Invoices identify the service period.
Corbado will not charge for additional usage beyond an agreed allowance without your express approval, including approval of clearly disclosed usage-based pricing when ordering. Where a plan has a hard usage cap, Corbado will notify you before that cap is reached and agree with you in text form on additional volume, sampling or pausing collection, as applicable. Sampling must be agreed in advance and identified as such; it must not be presented as complete data. These Terms do not authorize unapproved overage charges.
Free trials, integration periods and the start of paid service are as specified in the accepted plan or order. Enterprise prices, volume thresholds, purchase order requirements, payment periods and billing start dates are governed solely by the applicable enterprise agreement.
The Services are generally available 24/7. Corbado seeks to minimize disruption from backups, maintenance and repairs. For production use under these self-service Terms, Corbado will maintain monthly availability of at least 99.9% for the core hosted functions of the subscribed Service. Availability is measured from Corbado's facilities for the Customer's projects as follows:
Availability = (total minutes in the month − downtime in minutes) / total minutes in the month × 100%.
Downtime excludes unavailability caused by the following circumstances to the extent outside Corbado's responsibility: third-party activities (including denial-of-service attacks), malfunctions in the Customer's software or systems, internet connection interruptions, actions or omissions of the Customer, or force majeure.
If monthly availability falls below this commitment, you may request a credit calculated from the fee attributable to the affected Service for that month. Annual fees are allocated proportionately to the month. The credit is 5% of the monthly fee for availability below 99.9% and at least 99.0%; 10% for availability below 99.0% and at least 95.0%; and 20% for availability below 95.0%.
Credits are applied to the next invoice. Any unused credit at the end of the Agreement is applied against outstanding fees or paid to you if no fees remain. Only one availability band applies per Service per month. There is no monetary credit for a Service provided free of charge. These commitments do not apply to test or staging environments. A Customer in breach of its payment obligations at the time of the outage is not entitled to a contractual service credit.
Request a credit in text form within five (5) business days of the event giving rise to it. On request, Corbado will provide an availability report for the affected month. Credits do not exclude statutory remedies or liability under Section 7; a credit is taken into account against compensation for the same loss to avoid double recovery. Enterprise availability, support and credit commitments are governed by the enterprise contract and its annexes.
Subject to the exceptions below and to the extent permitted by applicable law, each party's total aggregate liability arising out of or in connection with this Agreement is limited to the fees paid or payable for the twelve (12) months preceding the event giving rise to liability. This limitation also applies to contractual indemnification claims and processing under the data processing agreement, subject to mandatory data protection law and any individual agreement. It does not reduce the Customer's obligation to pay agreed fees.
The limitation does not apply to intent or gross negligence, injury to life, body or health, fraudulent concealment, or liability that cannot be limited by law, including mandatory product liability. Article 82 GDPR remains unaffected. For simple negligence in the breach of an essential contractual obligation, liability for foreseeable loss typical of this type of agreement remains available; the monetary cap above applies only to the extent legally permissible. An essential obligation is one whose performance is necessary for proper execution of the Agreement and on which the other party may ordinarily rely.
For Services provided entirely free of charge, liability is governed by the applicable statutory rules; these Terms do not impose a nominal or zero liability cap. Statutory limitation periods apply. This Section survives termination and does not replace a liability provision in an enterprise or other individual agreement.
Corbado will provide the Services substantially in accordance with the agreed specifications. Corbado does not promise that software will be entirely error-free or that it will detect or prevent every instance of fraud or malicious code. These qualifications do not limit the agreed service commitments or statutory rights in the event of defects.
Report defects promptly and provide information reasonably needed to investigate them. Corbado will remedy defects for which it is responsible within a reasonable period, including through a correction or reasonable workaround. If remediation fails, your statutory rights, including reduction of fees or termination where applicable, remain unaffected. Damages are governed by Section 7. Work outside Corbado's contractual or statutory obligations may be charged only if you agree to the additional work and fees in advance.
You must provide reasonable cooperation for integration, operation and defect resolution, maintain accurate account information and keep access credentials secure. You are responsible for your applications, their configuration and the lawful collection and submission of Customer Data, including required notices, legal bases and permissions. You must use the available export functions to retain copies you need independently of the Service.
Each party is responsible for breaches of its obligations in accordance with applicable law and Section 7. Customer cooperation obligations do not transfer Corbado's own service, security or data protection responsibilities to you.
You may use the Services for lawful business authentication, observability, development, testing and related purposes within your plan. You must not use them to infringe third-party rights, distribute malicious code, gain unauthorized access, interfere with other customers or evade agreed usage limits. Corbado may require you to stop a use that breaches this Agreement.
If a third party brings a claim against Corbado arising from your culpable breach of these obligations, you will indemnify Corbado for justified claims and reasonable defense costs to the extent you are responsible, subject to Section 7. Corbado will promptly notify you, allow reasonable participation in the defense and not agree to a settlement imposing obligations on you without your consent. This does not cover loss caused by Corbado's own breach.
Corbado may temporarily suspend affected access where reasonably necessary to address a material breach of Section 10 or a concrete security threat. Corbado will consider your legitimate interests, limit the scope and duration of the suspension, and give notice and an opportunity to resolve the issue where reasonably possible. If immediate action is needed, Corbado will inform you as soon as possible and restore access once the reason for suspension is resolved.
This Agreement starts on acceptance under Section 1. Unless an accepted self-service plan specifies a fixed term and renewal conditions, either party may terminate on thirty (30) days' notice. Any fixed term, renewal and notice period must be disclosed and accepted when ordering. Either party retains the right to terminate for good cause. Notices may be given in text form, including email, or through the account's termination function. Enterprise commencement, minimum terms and renewals are governed by the enterprise contract.
At the end of the Agreement, you must stop using the Services and remove the relevant SDK or integration. Corbado will, at your choice, return or delete Customer Data and delete remaining copies in accordance with the data processing agreement, unless applicable law requires retention. You should request return before termination so it can be arranged before deletion. Corbado will coordinate an outstanding return request before deleting the relevant data. Backup copies are deleted under the applicable backup retention schedule and remain protected until deletion.
Accrued payment and remedy rights, the data-use restrictions in Section 4, liability under Section 7, data return and deletion obligations, confidentiality for the period stated in Section 13, and Section 15 survive as needed to give them effect.
Both parties must comply with applicable data protection laws. Before Corbado processes personal data on your behalf, the parties must conclude a data processing agreement under Article 28 GDPR. That agreement specifies the processing, technical and organizational measures, subprocessors, data locations, transfers and assistance obligations. The restrictions in Section 4 also apply.
Observe is designed to collect technical runtime events, such as pseudonymized identifiers, browser and device metadata and timestamps, rather than passwords, access credentials or payment data. You must configure the Observe integration accordingly. Data requirements of authentication products are described separately in their documentation and data processing agreement. Hosting in AWS Frankfurt, other regional arrangements and any dedicated instance are governed by the applicable service description and individual agreement.
Corbado maintains an ISO/IEC 27001-certified information security management system and a SOC 2 Type II report. Certificates and assurance reports are available on request, subject to appropriate confidentiality protections. Additional evidence and customer-specific security reviews are provided as agreed. See our security information and Trust Center.
Each party must protect the other's non-public information and use it only to perform this Agreement, during its term and for three (3) years afterwards. Disclosure to employees, advisers, service providers or affiliates is permitted only where needed for that purpose and subject to appropriate confidentiality obligations. Data protection and deletion duties remain unaffected.
Confidentiality does not apply to information that the recipient can demonstrate was already lawfully known, independently developed, lawfully obtained from a third party without a confidentiality restriction, or publicly available without breach. Legally required disclosure is permitted; the recipient must notify the other party in advance where legally permitted and limit disclosure to what is required.
Neither party may publicly name the other, use its name or logo as a reference, or publish a case study without the other party's prior consent. This does not prevent legally required disclosures.
Corbado may publish revised terms for future self-service agreements. Changes to an existing Agreement require agreement in text form, including an express electronic acceptance that can be retained. Publishing a new version, silence or continued use alone does not amend an existing Agreement. If a proposed change is not accepted, the existing terms continue unless the Agreement is terminated in accordance with Section 12. Website updates never amend an enterprise contract; its own change procedure applies.
Neither party may transfer this Agreement without the other's consent, except where permitted by mandatory law. This does not restrict affiliate use expressly included in the agreed scope.
German law applies, excluding the United Nations Convention on Contracts for the International Sale of Goods. Munich, Germany, is the exclusive place of jurisdiction where legally permissible, including where the Customer is a merchant, a legal entity under public law or a special fund under public law.
These Terms, the accepted self-service plan or order and the applicable data processing agreement form the agreement for the relevant self-service products. They do not supersede an enterprise or other individual agreement. Individual agreements and their annexes take precedence; data protection matters are governed by the applicable data processing agreement. No failure or delay in exercising a right constitutes a waiver. If a provision is invalid, the remaining provisions continue to apply and the applicable statutory rules govern in its place.