This Master Services Agreement ("MSA") is the framework agreement under which Didit provides identity and fraud-prevention infrastructure to Enterprise customers (the "Client") who sign one or more Order Forms referencing this MSA. The full self-serve contract, including the embedded Service Level Agreement (SLA) and Data Processing Agreement (DPA), is at /terms/business. This MSA is offered as a standalone document for procurement teams that prefer a separate MSA / Order Form / DPA / SLA structure; in case of conflict, the order of precedence in Section 3 of this MSA governs.
1. Parties and contracting entity
This MSA is entered into between the Client identified in the applicable Order Form and the Didit entity that, under Section 16.6 (Governing Law and Jurisdiction), contracts with that Client:
- Didit Identity Spain, S.L., CIF B22929327, Calle Nápoles 227, P. 1, 08013 Barcelona, Spain. Contracts with Clients established in the European Union, European Economic Area, United Kingdom, and Switzerland.
- Didit Identity, Inc., EIN 39-2860573, 1111B S Governors Ave STE 34855, Dover, Delaware 19904, United States. Contracts with Clients established in the United States, Canada, Latin America, Asia-Pacific, the Middle East, and all other jurisdictions not allocated to Didit Identity Spain, S.L.
All formal notices to Didit are sent to legal@didit.me.
2. Scope of the Services
Didit provides the identity and fraud infrastructure platform described at `didit.me`, the Business Console at `business.didit.me`, the public APIs documented at `docs.didit.me`, the Software Development Kits (SDKs) for Web, iOS, Android, React Native, and Flutter, the Model Context Protocol (MCP) server, and any product line Didit makes available, including User Verification (KYC), Business Verification (KYB), Transaction Monitoring, and Wallet Screening (KYT) (collectively, the "Services"). The Services available to the Client at any time, and any commercial terms specific to the Client, are described in the relevant Order Form.
3. Order of precedence
In case of conflict between the documents that form the agreement between the Parties, the following descending order of precedence applies:
- The signed Order Form between the Parties.
- The Data Processing Agreement (DPA) signed by the Parties (or, if none is separately signed, the DPA), with respect to the processing of Personal Data.
- This Master Services Agreement.
- The Service Level Agreement (SLA) at /terms/service-level-agreement (or, if the Order Form names a specific SLA, that SLA).
- Any other policy or annex expressly incorporated by reference.
4. Term and termination
4.1 Term. This MSA starts on the Effective Date stated in the first Order Form between the Parties and continues until every Order Form has expired or been terminated.
4.2 Termination for convenience. Unless the Order Form says otherwise, either Party may terminate any Order Form on thirty (30) days' written notice; the Client forfeits unused prepaid Credits except where the termination is by Didit for convenience, in which case Didit refunds the value of the unused purchased prepaid Credits (excluding service credits issued under the SLA) by bank transfer within thirty (30) days.
4.3 Termination for cause. Either Party may terminate immediately if the other Party (a) materially breaches the agreement and fails to cure within thirty (30) days of written notice, or (b) becomes insolvent or enters into an equivalent proceeding. Where the Client terminates under this Section 4.3 for Didit's uncured material breach or insolvency, Didit refunds the Client's unused purchased prepaid Credits. Didit may suspend or terminate immediately if the Client uses the Services unlawfully, in breach of Section 5, or in a way that compromises the security or integrity of the Services.
4.4 Chronic SLA failure. The Client may terminate the affected Order Form, as a non-monetary remedy, on thirty (30) days' written notice if the Monthly Uptime Percentage under the SLA falls below 99.0% in any two (2) of three (3) consecutive calendar months, or below 95.0% in any single calendar month. Upon such termination, Didit refunds the value of the unused purchased prepaid Credits by bank transfer within thirty (30) days. Service credits under the SLA remain the sole and exclusive monetary remedy for availability failures; this Section confers a termination right (and the associated refund of unused purchased Credits) only and gives rise to no damages or further payment.
4.5 Effect of termination. Sections that by their nature should survive (Intellectual Property, Confidentiality, Liability, Indemnification, Governing Law) survive termination. Service credits accrued under the SLA lapse on termination and are never payable as money.
5. Client obligations and use restrictions
The Client agrees to: (a) use the Services in compliance with all applicable laws and regulations, including data-protection, anti-money-laundering, and counter-terrorist-financing laws; (b) obtain and maintain every notice, consent, and authorization required from End Users for Didit to process their personal data (including biometric data, where applicable); (c) protect the confidentiality of its Access Credentials; (d) ensure the accuracy of Client Data; and (e) not (i) reverse-engineer the Services, (ii) build a competing identity-verification service using the Services, (iii) use Verification results or Client Data to train AI/ML models without Didit's prior written consent, (iv) abuse the free or trial plan by creating multiple organizations or accounts, or (v) interfere with the security or operation of the Services.
6. Fees and payment
6.1 Prepaid Credits. Unless an Order Form specifies otherwise, the Services are paid for through prepaid Credits denominated in USD; Credits do not expire. Charges accrue per completed Verification Feature. Wherever this MSA provides for a refund of unused Credits, the refund equals only the amounts actually paid to and retained by Didit for unused purchased Credits, never exceeds the cash actually received by Didit for them, excludes SLA service credits and promotional, bonus, or other no-charge Credits, and is paid by bank transfer within thirty (30) days; Sections 4.2, 4.3, 4.4, 12.1, and 16.1 are the exhaustive refund events.
6.2 Order-Form pricing. The Order Form may specify volume commitments, custom pricing, invoicing terms, and payment terms that prevail over the standard pay-as-you-go model.
6.3 Failed payments. Three consecutive failed automatic charges, or non-payment of an invoice past its due date, allow Didit to suspend the Services or terminate this MSA in accordance with Section 4. Overdue amounts accrue interest at the lesser of 1% per month or the maximum rate permitted by law.
6.4 Taxes. Prices exclude taxes (VAT, sales tax, withholding) and processor fees, which are the Client's responsibility.
7. Intellectual property
Didit (and its licensors) retain all rights in the Services and Documentation. The Client retains all rights in Client Data. The Client grants Didit a worldwide, non-exclusive, royalty-free license to process Client Data solely to provide and improve the Services in accordance with the DPA. Feedback the Client provides may be freely used by Didit.
8. Confidentiality
Each Party will protect the other Party's Confidential Information with at least the same degree of care it uses to protect its own (and never less than reasonable care), and will use it solely to perform this MSA. Confidentiality survives for five (5) years from termination, or longer for trade secrets.
9. Data protection
Processing of personal data on behalf of the Client is governed by the DPA. The DPA addresses lawful basis, sub-processors, international transfers, security measures, breach notification (without undue delay and in any event within forty-eight (48) hours of Didit confirming a Personal Data Breach affecting Client Data), audit rights, and deletion / return of data. The DPA also governs Didit's processing of anonymized or pseudonymized data for model training and fraud-detection purposes as Independent Controller, including the opt-out path (delete the underlying record via the API or the Business Console, or email privacy@didit.me).
10. Warranties and disclaimer
Didit warrants that the Services will be provided in a professional manner and substantially in accordance with the Documentation. Except for the warranties expressly stated in this MSA, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE", and Didit disclaims all implied warranties (merchantability, fitness for a particular purpose, non-infringement) to the maximum extent permitted by law. Didit does not warrant the truth of any identity claim or the absence of fraud; verification results support, but do not replace, the Client's decision-making, and the Client remains solely responsible for its decisions. Availability commitments are made exclusively in the SLA, whose service credits are the sole and exclusive remedy for availability failures.
11. Limitation of liability
To the maximum extent permitted by law, each Party's total cumulative liability under this MSA shall not exceed the amount of fees actually paid by the Client to Didit in the twelve (12) months preceding the event giving rise to the claim (the "General Cap"). Neither Party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or goodwill. Liability arising from breach of Section 8 (Confidentiality) or of the DPA, including claims related to Personal Data Breaches, is capped at two (2) times the General Cap. The caps do not apply to (a) fraud, gross negligence, or willful misconduct, (b) the Client's payment obligations, (c) the Client's indemnification obligations under Section 12.2, or (d) liability that cannot be limited under applicable law. Service credits issued under the SLA form part of, and do not increase, Didit's total liability under the General Cap.
12. Indemnification
12.1 Didit indemnifies the Client against third-party claims that the Services, as provided by Didit and used in accordance with this MSA, infringe a patent, copyright, trademark, or trade secret of the third party. The indemnity does not apply to claims arising from (a) the Client's use of the Services in combination with non-Didit software, hardware, or data; (b) modification of the Services by a non-Didit party; (c) use of outdated versions where a non-infringing version was available; or (d) third-party data feeds or content made available through the Services, in respect of which Didit will use commercially reasonable efforts to assist the Client in obtaining equivalent rights or substitutes. If the Services become the subject of such a claim, Didit may, at its option and expense, procure the right for the Client to continue using them, modify or replace them with substantially equivalent functionality, or terminate the affected Services and refund the unused purchased Credits attributable to them (per Section 6.1). This Section 12.1 states the Client's sole and exclusive remedy for third-party IP claims.
12.2 The Client indemnifies Didit against claims arising from (a) breach of Section 5, (b) End-User or third-party claims related to the Client's collection or processing of personal data (including missing notices or consents) or its decisions based on Verification results, (c) Client Data infringing third-party rights, and (d) Client use of the Services in breach of applicable law.
13. Insurance
Didit maintains commercial general liability, professional liability (errors and omissions), and cyber-liability insurance with reputable insurers, in amounts and on terms appropriate to its operations. Certificates of insurance are available on request under NDA.
14. Compliance with sanctions and export controls
The Client represents that neither it nor its Authorized Users are subject to sanctions or embargoes imposed by the European Union, the United States, the United Kingdom, or other competent authorities, and that the Services will not be used for any purpose prohibited by sanctions or export-control laws.
15. Publicity
The Client agrees that Didit may use the Client's name and logo in Didit's marketing materials and customer list, unless the Client opts out in writing in the Order Form or by later written notice; on revocation, Didit removes the Client's name and logo from then-current Didit-controlled surfaces within fifteen (15) business days.
16. General provisions
16.1 Force majeure. Neither Party is liable for delay caused by events beyond its reasonable control. If a force majeure event affecting Didit's performance continues for more than thirty (30) consecutive days, either Party may terminate the affected Order Form and Didit refunds the unused purchased prepaid Credits.
16.2 Modifications. Didit may modify this MSA on thirty (30) days' notice; the Client may terminate before the effective date if it does not agree. For Order Forms with a committed term, the version of the MSA in force at signature applies for that committed term unless the Parties agree otherwise.
16.3 Assignment. The Client may not assign without Didit's prior written consent; Didit may assign to an affiliate or in connection with a merger or sale of assets.
16.4 Severability. Invalid provisions are limited to the minimum extent necessary; the rest of the MSA remains in force.
16.5 No waiver. Failure to enforce any right is not a waiver of that right.
16.6 Governing law and jurisdiction. As described in Section 1, the governing law and exclusive jurisdiction depend on the Client's place of establishment:
- EU / EEA / UK / Switzerland Clients contract with Didit Identity Spain, S.L.; the MSA is governed by the laws of Spain and the courts of Barcelona, Spain have exclusive jurisdiction.
- US / Canada / Latin America / Asia-Pacific / Middle East and other Clients contract with Didit Identity, Inc.; the MSA is governed by the laws of the State of Delaware, USA, and the state and federal courts located in New Castle County, Delaware have exclusive jurisdiction.
Nothing in this Section deprives a consumer of the mandatory protections of the law of the country of its habitual residence. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
16.7 Entire agreement. This MSA, together with the applicable Order Form, DPA, SLA, and any policy expressly incorporated, constitutes the entire agreement between the Parties on the subject matter and supersedes all prior or contemporaneous communications.
16.8 Independent contractors. The Parties are independent contractors. This MSA does not create a partnership, joint venture, employment, franchise, or agency relationship.
16.9 Notices. Notices are valid when (a) delivered personally, (b) sent by registered mail with return receipt, (c) sent by email with confirmation of receipt, or (d) for general notices from Didit, posted in the Business Console or on the Website.
16.10 Survival. Sections 7, 8, 10, 11, 12, 13, 14, 15, 16, and any payment obligation accrued before termination survive termination of this MSA.
17. Contact
- Legal / contracts: legal@didit.me
- General: hello@didit.me
- Privacy: privacy@didit.me
- Security and trust pack (NDA): security@didit.me