Identity Provider & OpenID Connect Notice

1. Protocol and standards compliance

Vorlaxen provides Identity Provider (IdP) services implementing OpenID Connect Core 1.0 and OAuth 2.0 (RFC 6749) specifications. The platform issues cryptographically signed JSON Web Tokens (JWTs), including ID Tokens and Access Tokens, and exposes standard discovery and key endpoints.

2. Vorlaxen responsibilities

Vorlaxen is responsible for operating its authentication endpoints, maintaining public key distribution (JWKS), enforcing documented scopes and user consent, safeguarding stored credentials and processing personal data in accordance with the Privacy Notice.

3. Relying-party responsibilities

• Register accurate redirect URIs and safeguard client secrets and cryptographic signing keys.
• Implement the Authorization Code flow with Proof Key for Code Exchange (PKCE, RFC 7636) and state/nonce validation.
• Rigorously validate issuer (iss), audience (aud), cryptographic signatures and token expiration times.
• Request only necessary scopes (openid, profile, email) and provide users with transparent privacy disclosures.
• Maintain secure local session management and promptly invalidate compromised credentials or tokens.
• Do not imply that Vorlaxen endorses, operates or guarantees third-party relying applications.

4. Third-party applications and limitation of liability

Relying parties independently control their applications, infrastructure, permissions and downstream data processing. To the maximum extent permitted by applicable law, Vorlaxen is not liable for third-party system failures, breaches or unlawful data processing.

5. Security and service levels

Vorlaxen maintains and audits authentication infrastructure using standard cryptographic controls and operational protocols. Standard service availability is governed by our operational policies unless an enterprise SLA is executed in writing.