Effective September 6, 2026. DNA Technology, Toronto, Ontario, Canada.
These terms cover the IAM X-ray software. They add to theDNA Technology terms of service, which govern your account, orders, subscriptions, renewals, refunds and sales representatives on the DNA Technology marketplace. Where the two disagree about the software itself, these terms apply. Where they disagree about anything else, the DNA Technology terms of service apply.
IAM X-ray is made and licensed by DNA Technology, an information technology company based in Toronto, Ontario, Canada ("DNA Technology", "we", "us"). "You" means the person or organisation that holds the DNA Technology account the software is signed in with. If you sign in on behalf of an organisation, you confirm you may bind it to these terms.
"The software" means the IAM X-ray application for Windows, its command line, its local web console, its updates, and the licence service it talks to. "Scan data" means anything the software reads from your directories, cloud tenants and hosts, and everything it derives from that: findings, reports, snapshots, dossiers, audit records.
By downloading, installing, signing in to or using the software you accept these terms. If you do not accept them, do not use the software.
Licences and trials for IAM X-ray are bought and held on a DNA Technology account at dnatechnology.ca. The account is the licence holder. Whoever can sign in to the account can use its seats, move them and release them. Keep the account secure and tell us at once if you think someone else has access to it.
The software signs in by showing you a short code and asking you to confirm it in your browser while signed in to your DNA Technology account. Only confirm a code that the software in front of you is showing.
A licence is sold per seat. One seat is one device. When you sign in on a device, the software binds a seat to that device and keeps a signed activation token there. The number of devices signed in at the same time may not exceed the number of seats on your licence.
Do not share activation tokens, copy them between machines, or try to run more devices than you have seats. The seat count on our service is the control, and we may release or revoke seats that were obtained this way.
You may start one free trial per DNA Technology account. The trial lasts 15 days, needs no card, and ends by itself. During the trial every feature of both modules is available, so you are evaluating the product you would buy and not a reduced version of it. When the trial ends the software returns to the sign in screen until you buy a licence. The trial is provided as is, for evaluation, and may be changed or withdrawn at any time.
Subject to these terms and to payment, DNA Technology grants you a non exclusive, non transferable licence to install and use the software on as many devices as you have seats, for your own internal use or, if you are a consultant or service provider, for work you perform for your clients. You may make copies for backup.
You may not, and may not let anyone else:
The software is licensed, not sold. Anything these terms do not grant you is reserved.
In automatic delivery the software contacts the DNA Technology licence service when you sign in, when you move or release a seat, and once per billing period to collect a fresh licence file. In manual delivery it makes no outbound connection. When it does contact us, it sends:
The software never sends scan data to us. No directory content, no findings, no reports, no snapshots, no credentials. The software has no usage telemetry and no crash reporting to us.
When you run iamxray update, the software downloads the update manifest and the new build from our download site. When you turn on the optional breached password check, the software sends the first five characters of each password hash to the Have I Been Pwned range service, which is how that service works; it is off by default.
Our privacy page explains how we handle this information.
Scan data is created and kept on the machine that runs the software, in the folders you choose. You own it and you are responsible for it: who can read the output, how long it is kept, and whether it may leave your organisation. Reports contain sensitive facts about your identity infrastructure. Treat them accordingly.
You are responsible for the credentials you give the software, for making sure they are read only unless you intend writes, and for having the authority to scan or change the systems you point it at.
The automation module (terminations, transfers, onboarding and Entra SSO applications) changes accounts, groups and applications in your directory and tenant. The software plans each run, shows you the plan, executes it only when you approve, records an audit trail and, where it can, offers a rollback. You decide what to approve and you are responsible for the result. Some actions cannot be reversed automatically, such as admin consent already granted, a provisioning job already started, or emails already sent; the software says so where it applies. Test in a non production environment first.
The software can update itself when you ask it to. It downloads a manifest signed with our release key, verifies the signature, downloads the new build, verifies its size and SHA-256 against the manifest, and only then replaces itself. A build that fails either check is never installed. Updates may add, change or remove features. We support the current release; if a fix requires an update we will ask you to update.
IAM X-ray finds and reports weaknesses that it knows how to look for, from the data it can read. It cannot see what it was not given access to, and it does not find everything. A clean report means the checks it ran found nothing, not that your environment is secure. The software is a tool for your own security work and does not replace a professional security assessment, a penetration test, legal advice or your own judgement. Do not rely on it as your only control.
The software connects, on your instruction and with your credentials, to services you control or subscribe to: Active Directory over LDAP, Microsoft Entra ID and Microsoft Graph, Google Cloud, hosts you list, and optionally Have I Been Pwned. Those services have their own terms and may change or limit what the software can read. We are not responsible for them. The software includes open source components; the legal notices page lists them.
DNA Technology and its licensors own the software, including its scanners, risk model, report designs, documentation and trademarks. These terms give you a licence to use it, not ownership. Feedback you give us about the software may be used by us without obligation to you.
The software may be subject to Canadian export and sanctions laws and to those of other countries. You confirm that you are not located in, and will not use or export the software to or for the benefit of, a country, entity or person to which Canada or the country you operate from prohibits it, and that you are not on a Canadian, United Nations, United States or European Union sanctions list.
Your licence lasts as long as your subscription or licence term on the marketplace is active. When it ends, is cancelled, or a payment fails and is not cured, the software returns to the sign in screen at its next licence check. Your scan data stays where it is; the software stops unlocking until a licence is active again.
We may suspend or terminate your licence if you materially breach these terms, for example by defeating the licence checks, distributing the software or using it against systems you are not authorised to access. Where reasonable we will tell you first and give you a chance to fix the problem. Sections 7, 10, 12, 15 and 16 survive termination.
The software is provided "as is" and "as available". To the extent permitted by law, DNA Technology disclaims all warranties, express or implied, including fitness for a particular purpose, merchantability, non infringement and any warranty that the software will find every weakness or run without interruption or error.
To the extent permitted by law, DNA Technology is not liable for indirect, incidental, special, consequential or punitive damages, for loss of data, profits, revenue or business, or for the consequences of actions you or others take based on the software's output or through its automation. Our total liability to you for all claims relating to the software in any 12 month period is limited to the amount you paid us for the software in that period.
Nothing in this section limits liability that cannot be limited by law, including for fraud, gross negligence or wilful misconduct, or rights you have as a consumer under section 16.
These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there. Any dispute that cannot be settled between us will be brought in the courts located in Toronto, Ontario, and you and we accept their jurisdiction.
If you are a consumer in Ontario, you have rights under the Consumer Protection Act, 2002 that these terms do not take away. If you are a consumer elsewhere, you may have similar rights under the laws of your home jurisdiction, and nothing here removes them.
We may update these terms when the software or the law changes. The date at the top says when the current version took effect. For a material change we will tell you through the software, the marketplace or email before it applies. Continuing to use the software after that date means you accept the new terms.
DNA Technology, Toronto, Ontario, Canada.
Legal: legal@dnatechnology.ca
Privacy: privacy@dnatechnology.ca
Security: security@dnatechnology.ca