Terms

What these terms cover

These terms apply to this public website, to workspace tenants provided as a hosted service, and to the employment attestation service. Where you have a signed order form or master agreement, that document takes precedence over anything on this page.

This website is informational. Nothing published here constitutes an offer, a warranty, or a service commitment on its own.

Performance targets are not commitments

The engineering targets published on this site, including the strike latency and revocation figures, are design objectives. They are published so that they can be examined and argued with by a technical audience.

They become contractual service commitments only when they appear on a signed order form, with the measurement method and the remedy for a miss defined there. Treat any figure on this website as a design target until then.

Acceptable use

Workspaces are isolated at the database schema level. The following are prohibited regardless of technical means.

• Attempting to reach another tenant's data, or probing tenant isolation without a written testing agreement.
• Presenting a legacy cleartext reader configuration as though it were an encrypted secure channel deployment.
• Extracting, copying, or attempting to reconstruct biometric templates, or conducting model inversion research against a live customer site.
• Using the attestation service to build or infer a staff list, or caching an attestation beyond the lifetime of the token it was issued with.
• Reselling or sublicensing access to a workspace or to the attestation service without written agreement.
• Automated scraping of this website beyond ordinary search engine indexing.

Attestation and relying parties

A relying party receiving an employment attestation may rely on it and cache it for the lifetime of the token it was issued with, and no longer. An attestation reflects status at the moment of issue, and status can change.

Attestations answer only the specific claims requested. Attempting to aggregate responses in order to enumerate an organisation's staff is a prohibited use and may result in the relying party's access being withdrawn.

Your responsibilities

As controller of the data in your workspace, you are responsible for the lawful basis on which you process it, for the notices you give the people whose data it is, and for the access decisions your administrators configure.

Where the system requires two administrators to approve a reduction in a control, that requirement exists for your protection. Circumventing it organisationally, for example by sharing credentials so that one person can act as two, removes a safeguard you are relying on.

Availability and support

Support routes, response targets, and availability commitments are set out in your order form. Public guidance on where to raise which kind of issue is on the support page.

Edge nodes are designed to continue enforcing the last verified policy during loss of connectivity. That behaviour is a design property of the product, not a substitute for an availability commitment.

Liability and governing law

Warranties, limitations of liability, indemnities, and the governing law and jurisdiction are as stated in your signed agreement. Where no signed agreement exists, use of this website is provided as is, without warranty, to the extent permitted by applicable law.

Changes to these terms

We may update this page. The revision date at the top reflects the current version. Material changes affecting an existing customer are handled through the change process in that customer's agreement rather than by editing this page.

Contacting us

Legal and contractual questions go through the contact form (other). Data protection questions use the privacy topic. Suspected vulnerabilities use the security topic.