Terms of use

DataCEVA Authentication Broker · last updated 10 September 2026

These terms cover use of the DataCEVA Authentication Broker, the service that holds authorised access to third-party accounts on behalf of DataCEVA and its clients. Using the Service, or granting it access to an account, means accepting them.

1. Definitions

• Service — the DataCEVA Authentication Broker at broker.dataceva.com.
• Provider — a third-party platform whose account is authorised, such as Meta or Google.
• Client — the organisation that engaged DataCEVA.
• Integrator — an application holding a credential issued by the Service.
• Engagement — a signed agreement, statement of work or data processing agreement between you and DataCEVA.

2. What the Service does

It performs the authorisation handshake with a Provider, stores the resulting tokens in encrypted form, keeps them current, and issues short-lived access tokens to applications that have been granted the relevant access. It does not itself read, transform or store the data that those tokens grant access to.

3. Granting access

• You must be entitled to grant the access you are granting — normally by administering the account concerned.
• Connect the account you intend to. The Service records which Provider account granted each connection, but it does not currently verify that a later authorisation comes from that same account — repairing a connection is done by making a new one, and choosing the right account remains yours to get right. Signing in as a different account produces a separate connection rather than replacing the first.
• Only the scopes shown on the Provider's consent screen are requested, and only the services selected for that connection.

4. Acceptable use

If you operate or integrate with the Service:

• Keep credentials issued to you confidential. Report a suspected compromise promptly; any credential can be revoked immediately.
• Hold Provider tokens in memory only. An application that writes a Provider token to its own database or to disk has recreated the risk this Service exists to remove, and does so outside these protections.
• Do not attempt to reach a Client, Provider or connection you have not been granted.
• Do not use access obtained here for a purpose the granting party would not expect.
• Do not probe, load-test, reverse-engineer or interfere with the Service, or attempt to circumvent its authorisation checks or rate limits, except with written permission.
• Do not use the Service to collect data about people who are not the subject of the engagement, or for advertising targeting, profiling or resale.

5. Provider terms and Platform Data

Data reached through this Service remains subject to the terms of the Provider it came from. Nothing here grants rights beyond what that Provider grants, and a Provider's restrictions on use, retention and onward disclosure continue to apply. Where a Provider's terms and these terms conflict as to what may be done with that Provider's data, the Provider's terms prevail.

6. Availability

The Service is provided on a commercially reasonable basis without a specific uptime commitment unless one is agreed in writing in an Engagement. Because it sits between an application and a Provider, applications are expected to treat a failure to obtain a token as retryable rather than fatal. Maintenance may interrupt token issuance briefly; tokens already issued remain valid for their lifetime.

7. Suspension

Access may be suspended without notice where it is necessary to protect the Service, a Client's data, or compliance with a Provider's own terms — including a credential believed to be compromised, or use that a Provider prohibits. Where we suspend access we will say why as soon as it is safe to do so.

8. Ending access

Access can be withdrawn at any time, by you at the Provider or by asking DataCEVA. On termination of an Engagement, the associated grants are revoked and their stored tokens destroyed. Records of configuration changes and administrative actions are retained for accountability, as described in the privacy policy.

9. Intellectual property

The Service, its software and its documentation remain the property of DataCEVA. These terms grant no licence to copy, modify or redistribute them. Data reached through the Service belongs to whoever owned it before — nothing here transfers ownership of a Client's data to DataCEVA.

10. No warranty

To the extent permitted by law, the Service is provided "as is" and without warranties of any kind, whether express or implied, including fitness for a particular purpose and non-infringement. DataCEVA does not warrant that the Service will be uninterrupted or error-free, nor that a Provider will continue to offer the access a connection depends on. Nothing in this section excludes a warranty that cannot lawfully be excluded.

11. Liability

To the extent permitted by law, DataCEVA is not liable for indirect or consequential loss arising from use of this Service, and its total liability is limited to the amounts payable under the relevant Engagement. Nothing limits liability that cannot lawfully be limited.

12. Changes

These terms may change. The "last updated" date above records when, and material changes affecting Clients will be notified. Continuing to use the Service after a change takes effect means accepting the updated terms.

13. Governing law

These terms are governed by the laws of the State of Illinois, United States, without regard to its conflict-of-laws rules, and the state and federal courts sitting in Cook County, Illinois have exclusive jurisdiction over any dispute arising from them. Where an Engagement specifies a different governing law, jurisdiction or dispute procedure, that Engagement prevails over this section.

14. General

• Severability. If any provision is found unenforceable, the rest remains in force.
• No waiver. A failure to enforce a provision is not a waiver of it.
• Assignment. You may not assign these terms without our written consent; we may assign them as part of a business transfer, subject to the same obligations.

15. Precedence

Where these terms conflict with an Engagement between you and DataCEVA, that document prevails. These terms govern the Service itself and do not narrow any commitment made in writing elsewhere.

16. Contact

DataCEVA, Chicago, Illinois, United States.
Write to [email protected].