This is a print-friendly report. Click Print and choose “Save as PDF” in the destination dropdown to download.

SaaSGuard Risk Report

Stytch

stytch.com

Generated May 4, 2026

Grade C

Score: 64 / 100

Executive summary

We analyzed Stytch’s Terms of Service across 8 risk dimensions and found 13 flagged clauses across 5 categories.

Flagged clauses by category

Auto-renewal traps (1)

  • Severity 3 · notable

    If you fail to pay the Fees and remedy such failure within fifteen (15) days of the date Twilio provides you with written notice of the same, then Twilio may (i) assess and you will pay a late fee of the lesser of 1.5% per month or the maximum amount allowable by law and (ii) suspend the provision of the Services to all of your accounts until the Fees due are paid in full. You are prohibited from creating new accounts until the Fees due are paid in full.

    If you don't pay your bill, Twilio can charge you a late fee and suspend your service until you pay up.

    You risk losing access to critical services if you miss a payment and don't fix it within 15 days.

Data residency (2)

  • Severity 3 · notable

    If you are domiciled or registered in: Any country within the European Economic Area or its regions or territories, the United Kingdom, Switzerland, Andorra, Vatican City, Monaco, or Turkey Twilio Ireland Limited, a company registered in the Republic of Ireland, whose registered address is 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland

    If you are within the EEA, UK, Switzerland, etc., Twilio Ireland Limited is your contracting entity.

    This determines which Twilio entity you have a contract with and where your data is primarily processed.

    Matches Irish DPC v. Meta Platforms Ireland — settled for $1300M (2023)

  • Severity 3 · notable

    If you are domiciled or registered in: Any country outside of the European Economic Area and its regions and territories, the United Kingdom, Switzerland, Andorra, Vatican City, Monaco, and Turkey, other than Mexico, Brazil, and Japan Twilio entity entering into this Agreement: Twilio Inc., a Delaware corporation, with a place of business at 101 Spear Street, 5th Floor, San Francisco, California, 94105, United States of America

    If you are outside the EEA, UK, Switzerland, etc., Twilio Inc. is your contracting entity.

    This determines which Twilio entity you have a contract with and where your data is primarily processed.

    Matches Irish DPC v. Meta Platforms Ireland — settled for $1300M (2023)

Termination friction (5)

  • Severity 3 · notable

    If Twilio terminates this Agreement because of your material breach, then Twilio will also close your accounts.

    If Twilio terminates this Agreement because of your material breach, then Twilio will also close your accounts.

    A serious violation of the contract terms can lead to immediate loss of access to your accounts.

    Matches Bungie / Destiny 2 Account Termination Litigation (2023)

  • Severity 3 · notable

    If you breach your payment obligations to the Fulfillment Reseller and fail to cure such breach within the time period specified in the Fulfillment Agreement, the Fulfillment Reseller or Twilio may suspend the provision of the Services to you upon written notice.

    If you fail to pay your Fulfillment Reseller and don't fix it within the specified time, Twilio or the reseller can suspend your service.

    You risk losing access to services if you have payment issues with your reseller.

    Matches PayPal Account Hold / Freeze Class Action — settled for $4M (2021)

  • Severity 3 · notable

    Either party may terminate this Agreement for convenience by providing the other party with at least thirty (30) days prior written notice. Notwithstanding the preceding sentence, if there are any Order Form(s) in effect, this Agreement will not terminate until all such Order Form(s) have expired or have been terminated in accordance with the terms therein.

    Either party can end this agreement with 30 days written notice, but only after any active order forms have expired or been terminated.

    You need to wait for existing orders to finish before you can cancel the entire agreement for convenience.

    Matches FTC v. Match Group (Match.com) (2019)

  • Severity 3 · notable

    If Twilio terminates this Agreement because of your material breach, then Twilio will also close your accounts.

    If you materially breach the agreement, Twilio can terminate your service and close your accounts.

    A serious violation of the contract terms can lead to immediate loss of access to your accounts.

    Matches Bungie / Destiny 2 Account Termination Litigation (2023)

  • Severity 3 · notable

    Either party may terminate this Agreement (including all Order Form(s) and Services that are in effect) in the event the other party commits any material breach of this Agreement and fails to remedy such breach within fifteen (15) days of the date of written notice of such breach. For the avoidance of doubt, a breach of the Twilio Acceptable Use Policy will be considered a material breach of this Agreement.

    Either party can terminate the agreement if the other commits a material breach and doesn't fix it within 15 days of notice.

    A significant contract violation can lead to the termination of services if not resolved promptly.

    Matches PayPal Account Hold / Freeze Class Action — settled for $4M (2021)

Liability caps (2)

  • Severity 4 · material

    IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES HAVE ANY LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT FOR ANY LOST PROFITS, REVENUES, GOODWILL, OR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, COVER, LOST DATA, BUSINESS INTERRUPTION, OR PUNITIVE DAMAGES, WHETHER AN ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF A PARTY OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR IF A PARTY’S OR ITS AFFILIATES’ REMEDY OTHERWISE FAILS OF ITS ESSENTIAL PURPOSE. THE FOREGOING DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW.

    Twilio and its affiliates are not liable for any lost profits, indirect, special, incidental, consequential, or punitive damages.

    You cannot recover damages for business losses or other indirect costs if Twilio's service causes you harm.

    Matches Capital One Data Breach Class Action — settled for $190M (2022)

  • Severity 3 · notable

    IN NO EVENT WILL THE AGGREGATE LIABILITY OF EITHER PARTY TOGETHER WITH ALL OF ITS AFFILIATES ARISING OUT OF OR RELATED TO THIS AGREEMENT EXCEED THE AMOUNTS PAID OR PAYABLE BY YOU AND YOUR AFFILIATES HEREUNDER FOR THE SERVICES GIVING RISE TO THE LIABILITY DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE FIRST INCIDENT OUT OF WHICH THE LIABILITY AROSE. THE FOREGOING LIMITATION WILL APPLY WHETHER AN ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF LIABILITY.

    Twilio's total liability for any issue related to this agreement is capped at the amount you paid them in the 12 months before the issue arose.

    If Twilio's service causes a major problem, your compensation is limited to what you've already paid them.

    Matches Capital One Data Breach Class Action — settled for $190M (2022)

Right to silently change terms (3)

  • Severity 4 · material

    Twilio may update the terms of this Agreement from time to time. Twilio will provide you with written notice of any material updates at least thirty (30) days prior to the date the updated version of this Agreement is effective, unless such material updates result from changes in laws, regulations, or requirements from telecommunications providers. The current, up to date version of this Agreement will be available at https://www.twilio.com/legal/tos. Notices for material updates to the terms of this Agreement will be given in accordance with Section 9.5 (Notices). Following such notice, your continued use of the Services on or after the date the updated version of this Agreement is effective and binding, as indicated at the top of this Agreement, constitutes your acceptance of the updated version of this Agreement. The updated version of this Agreement supersedes all prior versions. If you do not agree to the updated version of this Agreement, you must stop using the Services immediately.

    Twilio can change these terms with 30 days notice, and continuing to use their service means you agree to the new terms.

    You could agree to one set of terms today and a totally different set next week with no warning.

    Matches Italian DPA (Garante) v. WhatsApp — settled for $6M (2022)

  • Severity 4 · material

    Twilio may, for any reason or no reason, remove you from the applicable Partner Program, or your access to the applicable Partner Program account portal, upon thirty (30) days prior written notice to you.

    Twilio can remove you from a Partner Program or revoke your access with 30 days notice.

    Your ability to participate in partner programs can be terminated with relatively short notice.

  • Severity 4 · material

    These terms might change. We will let you know at least 30 days before we make any significant changes that impact you or your use of our services, unless we are unable to because of changes in laws, regulations, or carrier requirements. The updated version of these terms will be posted on this page. If you keep using our services after these terms have changed and gone into effect, that means you have accepted those changes and they are legally binding on you. If you do not agree with the changed terms, you must stop using our services immediately.

    Stytch can change these terms with 30 days notice, and continuing to use their service means you agree to the new terms.

    You could agree to one set of terms today and a totally different set next week with no warning.

    Matches Italian DPA (Garante) v. WhatsApp — settled for $6M (2022)

Methodology

SaaSGuard uses an automated pipeline: a daily Playwright crawler captures each vendor’s public Terms of Service, Privacy Policy, and DPA. Google’s Gemini 2.5 Flash classifies each clause into one of 8 risk categories with a severity score (1–5). Clauses are cross-referenced against a curated database of real lawsuits and FTC actions via embedding-based similarity matching. Grades are computed from per-category max severity; full source code is available on request.

Built for educational and informational purposes. Not legal advice. Always have your own counsel review SaaS contracts before signing.

View live page →