Terms of Use: Gate IdP

These Terms of Use govern access to and use of Gate IdP, the identity and authentication service of AM25, S.A.S. de C.V. (hereinafter, “AM25”), used by AM25 personnel, clients, and users within their organizations to access integrated applications.

Users must comply with these terms and AM25’s access and security instructions. These terms do not replace the terms of use of integrated applications or modify proposals, contracts, or other specific agreements applicable to each service.

Accounts and Authorized Access

Gate IdP accounts are created exclusively by an AM25 administrator. Public account registration is not offered. Each user must use only the account assigned to them and only for authorized purposes within the scope of their relationship with AM25 or the organization to which they belong.

Users must provide accurate identity information and notify AM25 of changes or errors requiring attention. Impersonating others, using another person’s account, or sharing credentials to allow third-party access is not permitted.

Authentication and Integrated Applications

Gate IdP uses passwords and one-time passwords (OTP) and is built on OAuth 2.0 and OpenID Connect (OIDC). Users must follow the authentication mechanisms enabled for their accounts.

Gate IdP provides identity and authentication. Each integrated application applies its own roles and permissions. Having an account or signing in to Gate IdP does not in itself grant access to all applications, organizations, features, or resources. Users must comply with each application’s terms and access restrictions.

Credentials, Sessions, and Recovery

Users must protect their passwords, OTP codes, and recovery links, avoid disclosing them, and sign out when using shared devices or when they no longer have control of a device. Recovery links and codes must be used only to recover the corresponding account.

Gate IdP may send transactional password recovery emails. If a user detects an unrecognized sign-in, receives a recovery request they did not initiate, or suspects that their credentials have been compromised, they must notify AM25 through its usual support channels.

Prohibited Uses and Service Protection

Attempting to access accounts or resources without authorization, bypassing authentication mechanisms or access restrictions, obtaining third-party credentials, conducting brute-force attacks, or interfering with the security or operation of the service is not permitted. Security testing involving these activities requires prior authorization from AM25.

Gate IdP uses session cookies and temporarily retains security records to protect accounts and prevent unauthorized access. AM25 may restrict or suspend access when necessary to address a security incident, unauthorized use, or the loss of an account’s authorization.

Administration and Termination of Access

Account administration, including modification, deactivation, and deletion, is handled exclusively by an AM25 administrator. Requests requiring administrative intervention must be directed to AM25; self-service account deletion is not offered.

Deactivating or deleting an account may prevent the user from authenticating again with integrated applications. It does not in itself imply the deletion of information retained by those applications or replace the termination, retention, or deletion procedures established for each service.

Personal Data and Privacy

The processing of identity information, sessions, security records, and data used for password recovery is described in the Gate IdP Privacy Policy and is governed by AM25’s Data Protection Policy. The processing of information received by integrated applications is governed by each application’s respective policies.

Support and Service Changes

Support requests concerning accounts or authentication must be directed to AM25 through its usual support channels. Issues concerning an application’s permissions or features must be addressed in accordance with that application’s procedures.

AM25 may update Gate IdP and these terms to reflect changes in its operation, security mechanisms, or applicable conditions. These updates do not in themselves replace or modify specific agreements applicable to integrated applications.