Terms of Service

1. What the Service does

Authentity reads the contactless chip embedded in passports and electronic identity cards. Your application relays the chip's responses to our servers, we perform the cryptographic protocols the chip requires, verify the chip's signature against the issuing country's certificates, and return the data the chip contains along with the result of those checks.

All cryptographic processing happens on our servers. Your application does not need to implement any of it.

2. What the Service does not do

This section matters more than any other. Please read it.

Authentity reports what a document's chip cryptographically attests: that the chip is genuine, that its contents have not been altered, and that it was signed by a certificate we can trace to the issuing authority. That is a statement about a document, not about a person.

• We do not confirm that the person presenting a document is its rightful holder. Matching a face to the chip photo, checking whether someone is alive and present, and any other identity assurance step is yours to perform.
• We do not determine whether a document has been reported lost, stolen or cancelled. We have no access to issuing authorities' revocation registers.
• We do not certify that a document is legally valid, or that its holder is entitled to any right, status, entry or service.
• A successful verification is evidence, not proof. You must not use the Service as the sole basis for a decision that has a legal or similarly significant effect on a person — such as denying entry, employment, credit or access to a service — without meaningful human review.

3. Your responsibilities when scanning documents

A person's identity document contains some of the most sensitive information they have, including a facial image, which is biometric data in most data protection regimes. You are responsible for the lawfulness of every scan you perform.

• You must have a valid lawful basis for reading each document, and where consent is that basis, you must obtain it freely, specifically and in an informed way before the scan.
• You must tell the document holder who you are, why you are reading their document, and that a processor performs the read on your behalf.
• You must not scan a document without the holder's knowledge, and must not use the Service for covert surveillance or profiling.
• You must comply with any national rules restricting who may read the chip in an identity document. In some countries this is limited to specific categories of organisation, and holding an Authentity account does not grant you that permission.
• You are responsible for whatever you do with the data we return to you, including how you store, share and delete it.

4. Data protection roles

For the personal data contained in the documents you scan, you are the controller and we act as your processor. We process that data only to carry out the verification you requested and for no purpose of our own.

For your account — the details of your organisation, your users and your billing — we are the controller. The Privacy Policy explains both roles and what we retain.

Where data protection law requires a written data processing agreement between us, our Data Processing Addendum applies and forms part of these terms. Ask us and we will provide it.

5. Accounts, API keys and security

You need an account to use the Service. Keep the details you give us accurate, and keep your credentials and API keys secret.

API keys authenticate as your organisation. Anything done with your key is treated as done by you, and you are responsible for the resulting charges. Keys belong on a server you control, never in a mobile app, browser bundle, public repository or anywhere else a third party could extract them.

Tell us promptly at privacy@authentity.io if you believe a key or account has been compromised. You can rotate or revoke keys yourself from the dashboard at any time.

6. Acceptable use

You agree not to:

• Use the Service unlawfully, or to violate anyone's rights, including their data protection and privacy rights.
• Scan documents you have no lawful basis or authority to read, including documents belonging to other people obtained without their knowledge.
• Attempt to defeat, probe or circumvent the Service's security, rate limits or usage metering, or access another customer's data.
• Reverse engineer, decompile or attempt to derive the source of the Service, except to the extent that restriction is unenforceable by law.
• Resell, sublicense or provide the Service to third parties as a standalone product without our written agreement. Embedding verification into your own product for your own customers is expected and permitted.
• Submit deliberately falsified or forged documents other than for legitimate testing of your own integration on the free or sandbox plan.
• Use the Service to build a competing identity verification product, or to train a model on data obtained through it.

7. Plans, usage and payment

Plans, prices and the monthly scan allowance included in each are shown on our pricing page and in your dashboard. Subscriptions are billed in advance and renew automatically for successive periods until cancelled.

Our order process is conducted by our online reseller Paddle.com. Paddle is the Merchant of Record for all our orders and handles all customer service enquiries relating to payments, refunds and chargebacks. Your purchase is also subject to Paddle's buyer terms.

Prices are exclusive of VAT, sales tax and similar charges unless stated otherwise; Paddle calculates and collects these where required. We may change prices for future billing periods with reasonable notice, and the change never applies to a period you have already paid for.

8. Usage limits

Each plan includes a monthly allowance of scans and a maximum number of API keys. Usage is metered in your dashboard in real time.

If you reach your allowance, further verification requests may be refused until the next billing period or until you upgrade. Requests are also subject to per-key rate limits, which exist to keep the Service stable for everyone.

9. Refunds and cancellation

Refunds and cancellation are governed by our Refund & Cancellation Policy, which forms part of these terms. In short: refunds may be requested within seven working days of a payment and are pro-rated to the part of your scan allowance you have not used; you may cancel at any time with no minimum term and no fee.

10. Availability and support

We work to keep the Service available and reliable, but no online service is available without interruption. Maintenance, third-party failures and events beyond our control can all cause downtime.

Formal uptime commitments apply only where a plan states a service level, or where we have signed a separate agreement with you. Free and sandbox plans carry no availability commitment and must not be used in production.

11. Intellectual property

We retain all rights in the Service, including our software, SDKs, documentation and brand. These terms grant you a limited, non-exclusive, non-transferable, revocable right to use the Service during your subscription, and nothing more.

You retain all rights in your own data and applications. We claim no ownership of the document data we process for you.

If you send us feedback or suggestions, we may use them to improve the Service without obligation or payment to you.

12. Confidentiality

Each of us may learn non-public information about the other. Both of us agree to protect it with at least reasonable care, use it only for the purposes of this agreement, and not disclose it except to people who need it and are bound by similar obligations, or where the law requires disclosure.

13. Warranties and disclaimers

We provide the Service with reasonable skill and care, and we warrant that we have the right to provide it to you.

Beyond that, and to the maximum extent the law allows, the Service is provided "as is". We do not warrant that it will be uninterrupted or error-free, that every document or issuing country will be supported, or that a verification result will be accurate in every case — chips can be damaged, issuing certificates can be missing or expired, and some documents are simply unreadable.

Nothing in these terms excludes liability that cannot lawfully be excluded, including for death or personal injury caused by negligence, or for fraud.

14. Limitation of liability

Neither of us is liable to the other for indirect or consequential loss, loss of profit, revenue, goodwill, business or anticipated savings, however arising.

Subject to the paragraph above and to clause 13, each party's total liability arising out of or in connection with these terms in any twelve-month period is limited to the total fees you paid us in that period.

We are not liable for any decision you take about a person on the basis of a verification result, nor for your failure to obtain a lawful basis for a scan. Those are matters within your control and clauses 2 and 3 set out the limits of what we provide.

15. Indemnity

You will indemnify us against claims, losses and reasonable costs arising from your use of the Service in breach of these terms, in particular claims brought by a document holder or a regulator concerning scans you performed without a lawful basis or the holder's knowledge.

16. Suspension and termination

You may stop using the Service and cancel at any time.

We may suspend or terminate access if you materially breach these terms, if payment fails and is not resolved, if your use threatens the security or stability of the Service, or if we are required to do so by law. Where circumstances allow, we will warn you first and give you a chance to put things right.

We may suspend immediately and without notice where we have a reasonable belief that scans are being performed unlawfully or without the document holder's knowledge.

On termination your right to use the Service ends. Clauses covering confidentiality, intellectual property, liability and indemnity survive.

17. Changes to these terms

We may update these terms. For material changes we will give reasonable notice by email or in the dashboard before they take effect. Continuing to use the Service after that means you accept the updated terms; if you do not, you may cancel, and the refund policy applies as normal.

18. General

These terms, together with the Privacy Policy and the Refund & Cancellation Policy, are the entire agreement between us regarding the Service.

You may not assign this agreement without our consent; we may assign it to a successor in connection with a merger or sale of the business.

If any provision is found unenforceable, the rest stays in force. Not enforcing a right is not a waiver of it.

These terms are governed by the laws of Algeria, and the courts of that jurisdiction have exclusive jurisdiction over disputes, save that either party may seek injunctive relief wherever necessary to protect its intellectual property or confidential information.

19. Contact

Questions about these terms or about billing: billing@authentity.io. Questions about data protection: privacy@authentity.io.