API Terms

These composerID API Terms (this “Agreement”) govern use of the Service (defined below) provided by Deployed, a company based in London, United Kingdom (“Deployed”), to the customer and its users (“Customer” or “you”).

By accepting this Agreement, whether by creating a developer account, by using an API key or client credentials, or by otherwise accessing the Service, Customer agrees to its terms. If Customer and Deployed have signed a written agreement governing Customer’s access to and use of composerID, that signed agreement governs and supersedes this Agreement.

This Agreement is effective on the earlier of the date Customer accepts it and the date Customer first accesses or uses the Service (the “Start Date”). Deployed may modify this Agreement; a modification takes effect on the earlier of (i) 30 days after Deployed posts it and (ii) Customer’s continued use of the Service after posting. Material changes are noted in the changelog.

1. Definitions

Certain capitalised terms are defined below; others are defined in the body of this Agreement.

• “Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with a party.
• “Customer Data” means data submitted to the Service by or for Customer, including intent payloads, enrichment answers, passthrough bodies and webhook events, and the Intent Records, timelines and receipts the Service derives from them.
• “Destination” means a third-party system of record (a VMS, ATS, HRIS, ERP, contract-management, service-management or sourcing platform) into which the Service publishes on Customer’s instruction.
• “Documentation” means the documentation at composer.id/docs, including the API reference, the OpenAPI document and the published JSON Schemas.
• “Intent ID” means the identifier the Service mints for a decision and carries into every Destination record it creates.
• “Sandbox” means the reference implementation of the Service running over mock Destination tenants, whether hosted by Deployed or run by Customer from the published source.
• “Service” means the composerID API, the Sandbox, the developer portal, the Software and the Documentation, together with all modifications, updates and upgrades. composerID publishes decisions made by Triage into Destinations under one Intent ID; the Service does not include Triage itself or any Destination.
• “Software” means the software Deployed develops and maintains to provide the Service.
• “Usage Data” means analytics and performance information about use of the Service (request counts, latencies, error rates, endpoint mix). Usage Data is not Customer Data and does not contain personal data.
• “Users” means the individuals to whom Customer issues credentials to use the Service.

2. The Service

2.1 Account eligibility and registration

You represent and warrant that you are at least 18 years of age, that you have not previously been suspended or removed from the Service, and that you have authority to bind Customer. To access the Service you register for an account and provide accurate information about yourself, which you will keep accurate and up to date. Accounts and API keys are personal to the individual they are issued to. You are responsible for the confidentiality of your credentials and for all activity that occurs under them. If you believe a credential is no longer secure, notify Deployed immediately at jamie.gannaway@deployed.co and rotate it.

2.2 Right to access and use the Service

Deployed grants Customer a non-exclusive, non-transferable, revocable right during the Term to access and use the Service, solely in accordance with the Documentation and this Agreement, for the purpose of evaluating composerID and of building and operating integrations between Triage and Customer’s Destinations.

2.3 Restrictions

Customer will not, and will not permit any User or third party to:

1. access the Service in order to benchmark it, or to monitor its availability, security, performance or functionality, for a competitive purpose without Deployed’s written consent;
2. rent, lease, sub-license, resell or otherwise make the Service available to third parties, or use it to provide services to third parties on a service-bureau basis;
3. modify, create derivative works of, decompile, reverse engineer or attempt to obtain the source code of the Software, other than the source Deployed publishes under its own licence, which that licence governs;
4. circumvent or disable any security or technological feature of the Service, including authentication, scopes, rate limits and the developer gate, or use the Service in a way that Deployed reasonably believes threatens the security of Deployed’s or any Destination’s systems;
5. share an API key or client secret between individuals or organisations, or use another person’s credentials;
6. submit real personal data, real Destination credentials or confidential business information to the Sandbox, which is for test data only;
7. use the Service to conduct any fraudulent, malicious or illegal activity, or to publish into a Destination tenant that Customer is not authorised to write to;
8. probe, scan or attack a Destination through the Service, or use the passthrough endpoint for any purpose other than a Destination call anchored to an Intent ID; or
9. infringe any third party’s intellectual property or other rights.

Each of (a) to (i) is a “Prohibited Use”.

3. Deployed’s obligations

3.1 General

Deployed will provide the Service in conformance with, and subject to, this Agreement and the Documentation. The Sandbox is a reference implementation: it runs over mock Destination tenants, carries no service level and may be reset at any time, and Deployed makes no commitment as to its availability. Service levels for the production service, once live, are set in the written agreement under which Customer purchases Triage.

3.2 Support

Deployed will use commercially reasonable efforts to respond to Customer’s support requests about errors, bugs or other issues with the Service. Support requests go to jamie.gannaway@deployed.co. Support is included; there is no separate fee.

3.3 Changes to the Service

Deployed may update the Service and the Documentation. Changes that remove or alter a documented behaviour of a versioned API path are announced in the changelog before they take effect, with a deprecation period of at least 90 days for the production service. The Sandbox tracks the current contract and may change without notice.

4. Customer’s obligations

4.1 Compliance with laws

Customer will use the Service only in accordance with the Documentation and all applicable laws, including data protection, employment and export control laws. Customer will not export, re-export or use the Service in breach of the export control or sanctions laws of the United Kingdom or any other applicable jurisdiction. Deployed may suspend use of the Service that breaches this Section on written notice, which may be by email.

4.2 Destination platform terms

Customer is responsible for holding, and complying with, the licences, API terms and tenant permissions of each Destination it connects. Deployed does not grant, and cannot grant, any right to use a Destination. Where a Destination licenses API access separately, obtaining that licence is Customer’s responsibility; the Documentation flags where this is known to apply.

4.3 Authority over data

Customer represents that it has all rights, permissions and consents necessary to submit Customer Data to the Service and to have it published into the Destinations it selects, and that doing so does not breach any law or any agreement with a third party.

5. Data

5.1 Data licence

Customer grants Deployed a limited, non-exclusive licence during the Term to process Customer Data to provide and maintain the Service, to publish into the Destinations Customer instructs, to derive Usage Data, and as otherwise instructed by Customer in writing. Deployed will not use Customer Data for any other purpose and will not use it to train generalised artificial intelligence or machine-learning models.

5.2 What the Service stores and what it sends

The Service stores Intent Records, their append-only timelines and the publishing receipts returned by Destinations, so that a publish is idempotent and the audit trail is complete. A Destination receives only a valid request plus the Intent ID; diagnostic answers, scores and the Compliance File never leave composerID. Each platform page in the Documentation lists what crosses the boundary and what is never sent, and Deployed will keep those lists true.

5.3 Personal data

To the extent Customer Data includes personal data processed on Customer’s behalf, the Data Processing Agreement applies and is incorporated into this Agreement. Personal data about Users themselves (names, work email addresses) is handled as described in the Privacy Policy.

5.4 Security

Deployed maintains appropriate physical, technical and organisational safeguards to protect Customer Data, as described in Annex II of the Data Processing Agreement. Authentication uses per-person API keys or short-lived, scoped client-credentials tokens; inbound webhooks are signature-verified; Destination credentials are never supplied by callers.

6. Term, suspension and termination

6.1 Term

The “Term” of this Agreement starts on the Start Date and continues while Customer holds an active account or credential, unless terminated earlier: (a) by Customer at any time, by closing its account or notifying jamie.gannaway@deployed.co; or (b) by Deployed on 30 days’ written notice for convenience, or immediately on written notice if Customer commits a material breach that is incapable of remedy or is not remedied within 14 days of notice.

6.2 Suspension

Without limiting Section 6.1, if Customer breaches this Agreement, or if Deployed reasonably believes Customer’s use threatens the security or integrity of the Service or of a Destination, Deployed may immediately suspend access until the issue is remedied, following written notice to Customer, which may be by email.

6.3 Effect of termination

On termination or expiry, Customer’s rights under Section 2.2 end and Customer will stop using the Service. Within 30 days of a written request made at or after termination, Deployed will delete Customer Data in its possession, except for copies held in routine backups, which are deleted in the ordinary backup cycle, and records Deployed must retain by law. Sandbox data is deleted on reset regardless.

6.4 Survival

Sections 1, 5.2, 6.3, 6.4, 8, 9, 10.2, 11, 12 and 13 survive any termination or expiry of this Agreement.

7. Fees

Developer access and the Sandbox are provided without charge. composerID is sold with Triage and is not available as a separate purchase; fees for the production service are set in the written agreement under which Customer buys Triage, and that agreement governs invoicing, payment and taxes. Deployed may introduce fees or usage limits for the hosted Sandbox on 30 days’ notice.

8. Confidentiality

8.1 Confidential Information

Information of a confidential or proprietary nature disclosed by one party (the “Disclosing Party”) to the other (the “Receiving Party”) is the Disclosing Party’s “Confidential Information”. Deployed’s Confidential Information includes non-public aspects of the Service and information conveyed in support. Customer’s Confidential Information includes Customer Data. Confidential Information excludes information that: (a) the Receiving Party already knew without an obligation of confidentiality; (b) is or becomes public through no fault of the Receiving Party; (c) the Receiving Party rightfully receives from a third party without a confidentiality obligation; (d) is Feedback; or (e) the Receiving Party independently develops without using the Disclosing Party’s Confidential Information.

8.2 Obligations

Each party will use the other’s Confidential Information only to perform this Agreement, will not disclose it to any third party except as this Agreement permits, and will protect it with at least the care it uses for its own confidential information and no less than reasonable care. The Receiving Party may share Confidential Information with its employees, agents, advisers and Affiliates who need to know it and are bound by confidentiality obligations at least as protective as these.

8.3 Compelled disclosure

The Receiving Party may disclose Confidential Information where required by law, regulation or court order, provided that (where lawful) it gives the Disclosing Party prompt written notice so that the Disclosing Party can contest or limit the disclosure, discloses only what is legally required, and uses reasonable efforts to obtain confidential treatment for it.

9. Ownership

9.1 Deployed property

As between the parties, Deployed owns and retains all right, title and interest in and to the Service, the Software, the Documentation, Usage Data and Feedback. Except for the right granted in Section 2.2, this Agreement transfers no rights in them to Customer. Source code Deployed publishes carries its own licence, which governs its reuse.

9.2 Customer property

As between the parties, Customer owns and retains all right, title and interest in and to Customer Data. Records the Service creates inside a Destination belong to whoever owns that Destination tenant under its own terms. Except for the licence in Section 5.1, this Agreement transfers no rights in Customer Data to Deployed.

9.3 Feedback

Customer may give Deployed comments, suggestions or recommendations about the Service (“Feedback”). Deployed may use Feedback freely and without obligation to Customer, and Customer assigns to Deployed any rights it may have in Feedback. Feedback never includes Customer Data.

10. Representations and warranties; disclaimer

10.1 Mutual

Each party represents and warrants that it has validly entered into this Agreement and has the legal power to do so. Customer further represents and warrants that it has and will maintain the rights, permissions and consents described in Section 4.3, and that it will use the Service in compliance with applicable law and the terms of each Destination it connects.

10.2 Disclaimer

Except as expressly set out in this Agreement, the Service is provided “as is” to the fullest extent permitted by law. Deployed and its licensors exclude all other warranties, conditions and terms, express or implied, including any implied terms of satisfactory quality, fitness for a particular purpose and non-infringement. Deployed does not warrant that the Service will be error-free or uninterrupted, that it will maintain a connection to any particular Destination, that Destination documentation cited in the Documentation reflects that vendor’s current product, or that the Service will meet Customer’s requirements. The Sandbox in particular is provided for evaluation and testing only.

11. Indemnification

Customer will defend Deployed and its Affiliates, and their officers, directors, employees and agents (the “Deployed Indemnified Parties”), against any third-party claim, demand, suit or proceeding, and will indemnify the Deployed Indemnified Parties against any related losses, liabilities, damages, costs and expenses (including reasonable legal fees) finally awarded or agreed in settlement, to the extent arising from: (a) a Prohibited Use by Customer or a User; (b) Customer’s breach of Section 4 (Customer’s obligations); or (c) an allegation that Customer Data, or Deployed’s processing of it as instructed by Customer, infringes a third party’s rights or breaches applicable law. Deployed will notify Customer promptly of any such claim, give Customer control of its defence and settlement (provided no settlement admits fault or imposes obligations on Deployed without Deployed’s consent), and cooperate at Customer’s expense.

12. Limitation of liability

12.1 Nothing in this Agreement limits or excludes either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be limited or excluded under the law of England and Wales.

12.2 Subject to Section 12.1, neither party, nor its Affiliates, nor the officers, directors, employees, shareholders or representatives of any of them, will be liable to the other for any indirect, special, incidental or consequential loss or damage, or for any loss of profit, revenue, business, goodwill, data or anticipated savings, arising out of or in connection with this Agreement, however caused and whether in contract, tort (including negligence), breach of statutory duty or otherwise, even if the other party was told of the possibility.

12.3 Subject to Sections 12.1, 12.4 and 12.5, each party’s total aggregate liability arising out of or in connection with this Agreement, however arising, will not exceed the greater of (a) the fees paid by Customer to Deployed for the Service in the 12 months immediately preceding the event giving rise to the claim and (b) one hundred pounds sterling (£100). Where the Service is provided without charge, (b) applies.

12.4 “Excluded Claims” means claims arising from Deployed’s breach of Section 5.4 (Security). Deployed’s total aggregate liability for Excluded Claims will not exceed two times the amount in Section 12.3.

12.5 “Uncapped Claims” means claims arising from (a) either party’s breach of Section 8 (Confidentiality), other than a security breach which remains subject to Section 12.4; (b) Customer’s indemnification obligations under Section 11; or (c) a party’s gross negligence or wilful misconduct. Sections 12.3 and 12.4 do not apply to Uncapped Claims.

12.6 The existence of more than one claim does not enlarge the limits in this Section 12.

13. Miscellaneous

This Agreement, with the documents it incorporates, is the entire agreement between Customer and Deployed about its subject matter and supersedes all prior agreements and understandings about it. The parties are independent contractors; this Agreement creates no partnership, joint venture or agency. Failure to exercise a right is not a waiver of it. A person who is not a party has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term. Notices under this Agreement must be in writing and may be given by email: to Deployed at jamie.gannaway@deployed.co, and to Customer at the email address on its account. If any provision is found unenforceable it will be enforced to the maximum extent permissible and the rest of this Agreement will remain in force. Neither party may assign this Agreement without the other’s prior written consent, except to a successor in connection with a merger, acquisition or sale of all or substantially all of its assets, on written notice. Deployed may identify Customer as a composerID customer, by name and logo, only with Customer’s prior written consent.

This Agreement is governed by the laws of England and Wales, without regard to conflict-of-laws rules. If a dispute cannot be settled by the parties within 30 days of written notice of it from one party to the other, either party may refer it to mediation under the CEDR Model Mediation Procedure before commencing proceedings, save that either party may at any time seek injunctive or other equitable relief to protect its intellectual property or Confidential Information. Subject to that, the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement.