NewCasdoor for AI agents: OAuth for MCP servers, Token Exchange and DPoP

Terms of Service

Last updated: October 2, 2026

These Terms of Service ("Terms") are an agreement between you and Casbin Inc. ("Casbin", "we", "us"), and govern your use of Casdoor Cloud and casdoor.com (together, the "Service"). If you use the Service on behalf of an organization, you accept these Terms for that organization and confirm that you are authorized to do so. If you do not agree, do not use the Service.

1. The Service

Casdoor Cloud provides a hosted, dedicated instance of Casdoor, an open-source identity and access management server, together with the upgrades, certificates and support included in your plan. Open-source Casdoor is licensed separately under the Apache License 2.0; nothing in these Terms limits your rights under that license for software you run yourself.

2. Accounts

  • You must provide accurate information and keep it up to date.
  • You are responsible for all activity in your account and your instance, including keeping administrator passwords secret, changing any default credentials and enabling multi-factor authentication for administrators.
  • Tell us promptly at admin@casdoor.org if you suspect unauthorized access.

3. Plans, billing and renewal

  • Plans are sold as monthly or yearly subscriptions through our payment partner Gumroad, which acts as merchant of record and charges any applicable sales tax or VAT.
  • Subscriptions renew automatically at the end of each billing period until you cancel.
  • Prices and plan features are described on our pricing page. We will give you at least 30 days' notice of any price increase, which applies from your next renewal.
  • Payments are non-refundable except as described in our Refund Policy.

4. Cancellation and end of subscription

  • You can cancel at any time in Gumroad. Your instance stays available until the end of the period you have paid for.
  • When a subscription ends, or a renewal payment fails and is not resolved, we may suspend the instance and later permanently delete it and its Customer Data. Export any data you need before your subscription ends.

5. Acceptable use

You must not, and must not allow anyone else to:

  • use the Service for anything illegal, fraudulent or harmful, or to violate anyone else's rights;
  • attempt to access other customers' instances, databases or data, or our infrastructure beyond your own instance, including through features such as database syncers, storage providers, webhooks or file uploads;
  • probe, scan, penetration-test or load-test the Service without our prior written permission;
  • upload malware, web shells or other malicious code, or use the Service to attack any system;
  • send spam, or abuse SMS, email or other messaging features (for example, artificially inflated SMS traffic);
  • resell or sublicense the Service without a written agreement with us.

We may suspend or terminate access immediately, without refund, if we reasonably believe you have breached this section or that your use threatens the security or stability of the Service or other customers. We may also refuse service to anyone who has done so in the past.

6. Customer Data

  • You keep all rights to the data you and your users put into your instance ("Customer Data").
  • You give us permission to host, copy, process and transmit Customer Data only as needed to provide, secure and support the Service, and as described in our Privacy Policy.
  • You are responsible for having a lawful basis for the personal data in your instance and for giving your users any required notices. If you need a data processing agreement, contact us.

7. Availability and support

We work to keep the Service available and secure, but it may be interrupted for maintenance, upgrades or events outside our control. Unless we have agreed a service level in writing with you, the Service has no guaranteed uptime. Support is provided through the channels and hours of your plan.

8. Third-party services

You can connect your instance to third-party services such as identity, SMS, email, storage or payment providers. Your use of those services is governed by your agreements with them, and we are not responsible for them.

9. Intellectual property

Except for open-source software licensed to you under its own license and your Customer Data, we and our licensors own the Service, the casdoor.com website and the Casdoor and Casbin names and logos. Feedback you give us may be used without obligation to you.

10. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE.

11. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL OR DATA, EVEN IF ADVISED OF THEIR POSSIBILITY. OUR TOTAL LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE AMOUNT YOU PAID US FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. SOME JURISDICTIONS DO NOT ALLOW THESE LIMITATIONS, SO THEY MAY NOT FULLY APPLY TO YOU.

12. Indemnity

You will defend and indemnify us against third-party claims arising from your Customer Data or from your use of the Service in breach of these Terms or the law.

13. Termination

You may stop using the Service at any time. We may terminate these Terms or your access as described in sections 4 and 5, or with 30 days' notice for any other reason, in which case we will refund any prepaid fees for the unused period. Sections 6 and 9 to 15 survive termination.

14. Governing law and venue

These Terms and any dispute arising out of or relating to them or the Service are governed by the laws of the State of Delaware and the applicable federal laws of the United States of America, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Any such dispute will be brought exclusively in the state or federal courts located in the State of Delaware, and both parties consent to the personal jurisdiction of those courts. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

15. Export controls and sanctions

You must comply with United States export control and economic sanctions laws when using the Service. You represent that you are not located in, or ordinarily resident in, a country or region subject to comprehensive U.S. sanctions, and that you are not on any U.S. government list of prohibited or restricted parties. You will not use the Service for any end use prohibited by those laws.

16. Changes to these Terms

We may update these Terms. We will post the new version on this page and notify customers by email of material changes at least 30 days before they take effect. Continued use after that date means you accept the updated Terms.

17. Contact

Casbin Inc. · Email: support@casbin.com.