Everything a security or procurement review needs, in one place. Ask
legal@oauth.work for an executed copy of any of these, or
for entity details.
Agreements
- Terms of Service — the contract for using the platform: subscription,
acceptable use, liability, and termination.
- Data Processing Addendum — how we process personal data on your behalf,
our sub-processors, transfer mechanisms, and breach notification.
Notices
- Privacy notice — what we process and why, retention periods, cookies,
sub-processors, and how to exercise your rights.
- Security — what the platform does to protect accounts, keys, and
audit history.
- Status — live availability of the token, authorization, and discovery
endpoints.
Sub-processors
The current list, and the notice we give before changing it, are in the
privacy notice and the DPA. In short:
Cloudflare for compute, storage, bot mitigation, and transactional email, and Neon for managed
PostgreSQL. Identity providers you connect are your own integrations, not our sub-processors.