Privacy Policy Acceptance
The privacy policy acceptance is tracked per user. Each person accepts the privacy policy for themselves, and each person is re-prompted when a new version of the privacy policy is published. EULA acceptance is unchanged and remains organization-level.
What Changed
EULA
Accepted once per organization
Unchanged
Privacy Policy
Accepted once per organization
Accepted once per user
New user joins an organization
Never prompted
Prompted to accept
A new privacy policy version is published
One user accepted for everyone
Every user is prompted individually
Acceptance follows the user, not the organization — if you belong to multiple organizations, you accept once and it applies everywhere. Nobody can accept on another user's behalf, including administrators.
In the UI
If you have an unaccepted policy when you sign in, Bindplane shows a consent page before you reach the application. It lists what needs accepting with links to read each policy, and a single Accept covers everything outstanding.
The privacy policy must be accepted before an account is usable. If you consented on the sign-up form, that counts and you are not asked again; accounts created through SSO or invitation flows that did not capture consent are prompted at first sign-in.
For the API and Automation
Whether your automation is affected depends on how it authenticates. The per-user check only applies to requests tied to an individual user.
Newer API keys created without a user
No
Legacy user-bound API keys
Yes — gated on the user who created the key
Basic auth / direct user credentials
Yes
The organization-level EULA check applies to all of these, exactly as before.
Affected requests are rejected with HTTP status 453 until that user accepts:
Handle 453 as "consent required" rather than as a generic failure. To clear it, call PUT /v1/accept-policies while authenticated as that user, or move the integration to a scoped API key so no user acceptance is involved.
Two cases are easy to miss. A legacy API key is gated on whoever created it, even if that person no longer uses Bindplane. A service account that only ever calls the API will start returning 453 when a new privacy policy is published, because an administrator can no longer accept on its behalf.
Self-hosted deployments started with --accept-eula (or BINDPLANE_ACCEPT_EULA=true) bypass the EULA and privacy policy entirely. This is unchanged.
Upgrading
Each user inherits their organization's existing acceptance, so nobody is re-prompted at upgrade time. The next prompt comes when a new version of the privacy policy is published, and from then on each user accepts for themselves.
Related Pages
Last updated
Was this helpful?