Application of terms.
These terms apply to everyone who uses Modfolio Connect (the "Service"). Using the Service is deemed agreement to these terms; if you do not agree, please discontinue using the Service.
Matters concerning personal data processing are governed by the separately provided Privacy Policy, and matters concerning cookie use by the Cookie Policy.
Definition of terms.
- Service — the universal Identity issuer that provides OIDC/OAuth 2.1-based SSO to modfolio ecosystem apps.
- User — a natural person who holds a Service account and signs in.
- Client app — a sibling app that receives delegated authentication through the Connect SDK.
- Organization (org) — a tenant that manages multiple users. It has domains, policies, and roles.
- Agent — an automated LLM/MCP tool that performs tasks under a user's delegation.
- Token — the ID token, access token, and refresh token issued as a result of authentication.
- Company — Modfolio, the registered Korean business that provides the Service (business registration number 637-65-00835; the representative is named in the Korean version).
Account sign-up and management.
- Users must provide an accurate email and name; any disadvantage caused by inaccurate information is the user's responsibility.
- The user is responsible for keeping account credentials (password, passkey, TOTP) confidential.
- One account per person is the principle. Operating multiple accounts is possible by joining a separate organization.
- Users can change their account information directly at /profile.
Permitted ways to use.
Users may use the Service within the following scope.
- Signing in to modfolio ecosystem apps with an account in your own name
- Issuing, refreshing, and revoking OIDC standard tokens
- Performing your role within your own organization (org)
- Issuing Agent tokens (MCP) limited to your own delegation
- Accessing, exporting, and deleting your own data (§10, Privacy Policy §10)
Prohibited conduct.
The following conduct is grounds for immediate account suspension or termination.
- Unauthorized use or theft of another person's account
- Logging in or issuing tokens more than 60 times per minute with automated scripts (however, normal use within the SDK rate limit is allowed)
- Intentional attacks on the service infrastructure (scanning, DDoS, fuzz testing, privilege-bypass attempts, etc.)
- Transferring, selling, or redistributing tokens, sessions, or credentials to third parties
- Registering or operating a client app for purposes contrary to law or these terms
- Attempting privilege bypass or escalation through the Agent delegation chain
MCP Agent delegation conditions.
Users may explicitly delegate their authentication authority to an automated Agent (LLM/MCP tool, etc.). The following conditions apply to delegation.
- Delegation is limited to a maximum of 3 levels (delegation chain depth).
- The actions of a delegated Agent are the responsibility of the delegating user — except where the company intentionally displayed something that deceived the delegator.
- Delegation chains can be revoked immediately via chainId.
- Agent tokens are subject to the same security requirements as regular user tokens.
Service availability (SLA).
The company operates with the following availability levels as a target. These are best-effort operational metrics, not a binding SLA under these terms; a binding SLA may be set in a separate enterprise contract.
- Authentication issuance (/oauth/authorize, /oauth/token): 99.9% monthly
- Admin dashboard (account.modfolio.io): 99.5% monthly
- Scheduled maintenance is announced on the status page (status.modfolio.io) at least 7 days in advance.
- Emergency security patches may be applied without prior notice, in which case we notify afterward.
Refund or service-credit policies for missing the availability target are set in a separate enterprise contract. They do not apply to self-serve users.
Fees and payment.
Basic authentication features for individual users are free. Organization-level enterprise features (SCIM, SAML, dedicated SLA, etc.) are provided for a fee by separate arrangement.
- Prices and billing cycles are set in a separate pricing page or contract.
- Payments are processed via modfolio-pay or a separate payment channel.
- Under E-Commerce Act §6, payment and billing records are retained for 5 years.
Intellectual property rights.
- All source code, designs, logos, and documents of the Service are the property of the company or the license holder.
- The copyright in data that a user inputs or uploads to the Service belongs to the user. The company uses it only within the scope necessary to operate the Service.
- The @modfolio/connect-sdk package is distributed under a separate license (see the GitHub Packages guide).
- Reverse engineering, disassembly, and attempts to extract source code are prohibited to the extent permitted by applicable law.
Account termination.
Users may delete their account directly at any time via /profile > Danger Zone. Upon deletion, the following are processed immediately.
- Immediate revocation of all active sessions + propagation to all clients via SSF/CAEP events
- Cascade deletion within 30 days — personal data, sessions, credentials, delegation chains
- Items under a legal retention obligation (audit logs, payment records) remain after anonymization (Privacy Policy §06)
The company may suspend or terminate an account, with prior notice or immediately, upon the following grounds.
- Violation of the §05 prohibited conduct
- Violation of law or a request from a law-enforcement agency
- Conduct that infringes the safety or rights of other users
Disclaimer of warranties.
The Service is provided "as is". The company disclaims implied warranties such as fitness for a particular purpose and non-infringement. However, mandatory laws applicable to users (such as consumer protection law) take precedence.
Limitation of liability.
The company's liability for damages is limited as follows, to the extent permitted by applicable law.
- Limited to direct damages caused by the company's willful misconduct or gross negligence
- Indirect damages, consequential damages, lost profits, and the like are not compensated
- For paid enterprise contracts, the limit set in the separate contract applies
- Force majeure events such as natural disasters, war, terrorism, power outages, carrier failures, and CF infrastructure failures are exempt
Governing law and dispute resolution.
- Interpretation of these terms and disputes are governed by the laws of the Republic of Korea.
- In the event of a dispute, both parties shall first seek resolution through consultation.
- If consultation is not possible, the Seoul Central District Court shall be the exclusive court of first instance.
- If the user is a resident of the EU/EEA, the mandatory provisions of that region's consumer protection law take precedence.
Version change history.
- v1.0 (2026-05-27) — KO baseline draft. Pending external legal review.
- v1.1 (2026-10-01) — The definition of "Company" now names the registered business. Pending external legal review.
Changes to the terms that are unfavorable to users are announced by email/banner 30 days before the effective date, with a period for objecting. If you object, the account is terminated and refunded.