Terms of service and sale

1. Supplier and scope

Kinane Labs Ltd is the legal supplier and operates the SetupPasskeys product and website. These terms apply to an order only when the order incorporates them, and apply to use of the public website as stated here. Merely viewing a guide, generating a branding preview or submitting an enquiry does not place an order, accept a price or authorise paid work. Current supplier information is published on the Contact and business information page.

SetupPasskeys may invite a selected organisation to an early-access pilot. The enquiry takes no payment and does not guarantee selection. Any pilot requires separate written scope and terms and is not a public checkout order; public checkout remains unavailable.

The public guide is general information, not a managed deployment, tenant integration, legal opinion, audit, certification or guarantee of a security outcome. The paid services are designed principally for organisations and their authorised administrators. If you buy as a consumer, mandatory consumer protections continue to apply.

2. Hosted branded guide

The planned paid offer is an organisation-branded employee guide hosted by SetupPasskeys. Its written order must identify the intended audience and the passkey methods, providers, device types, platforms, software versions and sign-in situations that the customer has approved. SetupPasskeys manually configures that route matrix and the agreed branding, hosted address and employee-support route. The customer reviews and approves the result before employee use.

The standard guide presents instructions only for routes in that manually configured matrix. That standard guide does not connect to the customer tenant or Microsoft Graph. A public branding preview is a visual demonstration only: it does not authenticate a visitor, read Entra policy or groups, become the customer’s policy, create an enquiry or enable connected personalisation.

If the written order expressly includes connected personalisation, an authorised customer administrator may grant the stated read-only Microsoft permissions. SetupPasskeys may then read the tenant’s Passkey (FIDO2) profile configuration, ask whether a signed-in work account matches the target groups referenced by those profiles, and read reduced metadata about passkeys registered to that account. The service uses the result only to narrow the customer-approved route set and show account-level next steps. It does not return group lists, credential identifiers or raw Microsoft Graph responses to the employee’s browser.

Connected personalisation is read-only. It does not register, use or delete a passkey, change tenant configuration or enforce policy. A registered-method result is not proof that a credential exists on the device currently viewing the guide. The service does not evaluate Conditional Access, authentication strengths, device compliance, risk or every other control that may affect registration or sign-in. Microsoft Entra remains the enforcement point.

Administrator consent does not guarantee silent single sign-on. An active SetupPasskeys session may be used immediately; otherwise an identity-enabled direct guide may make one non-interactive Microsoft session attempt while the employee retains access to the applicable public branded guidance. If interaction is required, the attempt stops and the employee can choose an explicit Microsoft sign-in action; it will not automatically start an interactive login or loop.

Unless the written order expressly includes an access-control arrangement, the hosted guide address must be treated as accessible to anyone who receives it. The customer must not supply secrets, credentials, live enrolment QR codes, employee directory exports, special-category data or confidential incident material for publication. A team support route should be used instead of a named individual where practical.

The customer grants Kinane Labs Ltd a limited right to use the supplied names, logos, colours and content solely to prepare, review, host and support the ordered guide. The customer retains its rights in those materials and is responsible for having authority to provide them. Hosted-guide pricing, service period, review process, change allowance, support and any exit or export arrangements are those stated in the written quote or order; an enquiry form does not set them.

A connected order ends or degrades to unconnected guidance when the service period ends, the customer disconnects, Microsoft consent is revoked, the connection cannot be validated or the agreed retention period expires. Supplier may suspend personalisation where the live policy response is unavailable, incomplete, invalid or unsafe to apply. Continued availability of the free guide is not a promise of continued customer branding or connected access.

3. Legacy Rollout Kit

The unlinked, noindex Passkey Rollout Kit is a separate legacy one-time digital purchase. It contains the branded administrator playbooks, illustrated employee guides, communication drafts, customer licence, quick-start dashboard and integrity manifest listed in the product summary shown immediately before purchase. It is an implementation accelerator, not the hosted branded-guide service, a managed deployment, tenant integration, subscription, legal opinion, audit, certification or guarantee of a security outcome.

The buyer needs a modern browser capable of downloading ZIP, PDF, HTML, JSON and email-draft files. The materials are written for Microsoft Entra environments, but availability, labels, licensing and behaviour can vary by tenant, platform and software version.

4. Price, order and taxes

Hosted-guide pricing and payment terms are stated in the written quote or order. If legacy kit checkout is enabled, the total shown in Stripe Checkout immediately before that order is placed is the amount charged. Stripe collects the billing details and eligible tax identifiers needed for payment and applies tax according to the checkout configuration and information provided. The buyer is responsible for supplying accurate billing and tax information.

An order is accepted only as stated in the applicable written order or, for the legacy kit, when payment is confirmed and the purchase confirmation is issued. A submitted enquiry, failed or abandoned checkout does not create a paid licence or order. Promotional prices do not retrospectively change a completed order.

5. Legacy kit delivery and recovery

After confirmed payment, the buyer receives access to the complete ZIP and a private edit link with a recovery code. The link is a capability credential: anyone who holds it may be able to view and change that kit, so it must be protected and shared only with authorised people. The recovery code does not reveal the package by itself; it is used with the purchase email to resend the private link.

If payment succeeds but delivery does not, contact hello@setuppasskeys.com with the order email and Stripe receipt or invoice reference. Do not send card details.

6. Legacy kit customer licence

After confirmed payment, the purchasing organisation receives a non-exclusive, non-transferable licence to download, adapt where the supplied format permits, reproduce and internally distribute its generated package for that organisation’s own passkey deployment and continuing internal operations.

The organisation may give relevant materials to its employees and to contracted advisers or service providers acting for it, provided they use them only for that organisation and are subject to appropriate confidentiality and use restrictions.

The buyer must not:

• resell, sublicense or publicly redistribute the package or source templates;
• use one organisation’s purchase to generate kits for unrelated organisations;
• remove ownership notices to present SetupPasskeys source materials as its own product;
• use Microsoft, platform-provider or SetupPasskeys names or marks to imply sponsorship, approval or certification that does not exist; or
• use the service to store secrets, unlawful material or special-category data.

7. Ownership

Kinane Labs Ltd retains rights in the original SetupPasskeys templates, layouts, software and content. The customer retains rights in its own names, logos, data and customer-created adaptations. Microsoft and other third-party names, interfaces and marks remain the property of their respective owners.

8. Legacy kit refund promise and cancellation rights

If the kit is not right for you, email hello@setuppasskeys.com within 14 days of purchase for a refund. A reason is not required. This contractual promise is additional to, and does not replace, any statutory right to cancel, reject non-conforming digital content, receive a price reduction or obtain another remedy.

Where consumer cancellation rules apply, the legally required pre-contract information and confirmation must be provided on a durable medium. Nothing in these terms treats a consumer as having waived a cancellation right unless the legally required express consent and acknowledgement were actually obtained.

9. Legacy kit template updates

The underlying templates may be revised when Microsoft or platform interfaces change. A buyer may use its private edit link to regenerate the then-current package while the edit service remains available. No perpetual hosting period, update frequency or backward-compatible file layout is promised. Buyers should retain their downloaded copy.

10. Customer responsibilities

Before a production rollout, the buyer is responsible for reviewing and testing all hosted-guide and legacy-kit guidance against its current tenant, licensing, profiles, policies, devices, applications, accessibility requirements, employment processes and applicable law. In particular, the customer must supply an accurate approved-route matrix, must not use the hosted guide to infer or replace tenant policy, must maintain tested emergency access, recovery, change-control and rollback arrangements, and must not place live credentials, PINs, Temporary Access Pass values, tokens or enrolment QR codes in either service.

For connected personalisation, the customer is also responsible for having authority to connect the stated Microsoft tenant, granting only the agreed permissions, identifying the intended employee population, choosing the lawful basis and giving required notices, keeping the approved route mapping accurate, testing the result against its complete policy stack, and revoking access when it is no longer required. Microsoft administrator consent is an application-authorisation control; it does not by itself determine the customer’s data-protection lawful basis.

11. Data protection

Personal data is handled as described in the Privacy notice. Where Kinane Labs Ltd acts as a processor through the SetupPasskeys service for personal data placed in a hosted guide, processed through ordered connected personalisation or placed in legacy kit content, the Data Processing Addendum describes the offered processor terms and the process for execution. The public template is not executed merely by viewing it.

12. Availability and disclaimers

Reasonable care is used to maintain the service and materials, but internet services and third-party interfaces can be unavailable or change without notice. Except for terms implied by law that cannot be excluded, no promise is made that a hosted guide or legacy kit is error-free, suitable for every environment or sufficient by itself to achieve compliance or prevent every attack.

13. Liability

Nothing excludes or limits liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, breach of data-protection obligations where it cannot lawfully be limited, or any other liability or statutory remedy that cannot be excluded or limited.

For a business buyer, and to the extent permitted by law, aggregate liability arising from the affected order is limited to the amount paid for that order, and neither party is liable for indirect or consequential loss. This paragraph does not apply where such a limitation would be unfair, unreasonable or otherwise unenforceable.

14. Suspension and termination

Access may be suspended where reasonably necessary to address fraud, unlawful use, attacks on the service or a material breach of the licence. Where practical, the buyer will be told the reason and given a reasonable opportunity to resolve it. Clauses that by their nature should continue—including ownership, confidentiality, accrued payment obligations and lawful limitations—survive termination.

15. Governing law and disputes

These terms are governed by Irish law. That choice does not deprive a consumer of mandatory protections available under the law of the country in which the consumer habitually resides. Please first raise a complaint through hello@setuppasskeys.com so it can be investigated.

16. Changes to these terms

The version accepted for a completed order continues to govern that order. Material changes are dated on this page and apply prospectively unless the buyer expressly agrees otherwise or a change is required by law.