Additional Terms: Auth Pools

Effective Date: April 16, 2026
Cloud Provider: All (cloud-agnostic)
Document ID: QUOME-LEGAL-AUTHPOOLS-001

These Additional Terms govern your use of the Quome Auth Pools service ("Auth Pools"). These terms supplement the Terms of Service.

1. Service Description

Auth Pools enables you to create managed authentication pools for your applications' end users. Each pool provides user registration, login, password management, MFA, and OAuth/OIDC provider integration. Auth Pool user data is stored in your organization's data plane database.

2. End-User Data

2.1 Data Controller Status

You are the data controller for all end-user personal data stored in Auth Pools. Quome processes this data on your behalf as a data processor. You are responsible for:

(a) Providing appropriate privacy notices to your end users;

(b) Obtaining necessary consents for data processing;

(c) Responding to data subject access, deletion, and portability requests;

(d) Ensuring your use of Auth Pools complies with applicable privacy laws (GDPR, CCPA, etc.).

2.2 Data Residency

Auth Pool user data resides in your organization's data plane database within your cloud provider account. Quome's control plane stores only pool configuration metadata (pool name, provider settings, client configurations) — not end-user credentials or profile data.

3. Security Responsibilities

(a) You must configure appropriate password policies for your Auth Pools;

(b) You should enable MFA for pools handling sensitive applications;

(c) You are responsible for managing OAuth/OIDC provider configurations and client secrets;

(d) You must not store end-user passwords in plaintext — Auth Pools uses bcrypt hashing by default.

4. Termination Effects

Upon termination, Auth Pool user data remains in your data plane database. You retain full access to manage end-user accounts directly.