Verifier Terms

1. Who these terms are for#

An Agined receipt is meant to be shown to other people: a counterparty, an auditor, a court, a regulator or the public. These terms apply to anyone who verifies a receipt or relies on one (a "verifier") without being party to our Terms of Service for that receipt. Customers are bound by the Terms of Service for their own receipts; when a customer verifies someone else's receipt, these terms apply to that too.

You do not need an account, a key or our permission to verify a receipt. By relying on a receipt you accept these terms.

In plain language: a valid receipt proves that Agined signed these exact fields at this time. It does not prove that what the fields describe is true, lawful or complete. Check the signature yourself before you rely on it.

2. What a valid receipt lets you rely on#

A receipt is valid when its signature verifies against the Agined public key it names in signatureKeyId, taken from our published key set, as described in Verifying receipts. For a valid receipt you can rely on these things:

1. Integrity. The signed fields are exactly the fields Agined signed. Nobody, including Agined, has changed them since.
2. Origin. Agined signed them, with a key for the workspace's data region that is held as an encrypted secret and used only by our receipt service.
3. Time. issuedAt is the time on Agined's servers when the receipt was signed. No third-party timestamp authority is involved; the Receipt Practice Statement explains the time source.
4. What Agined did or saw. Some tools record what Agined itself did or observed, such as the status code a destination returned to a relayed call. Others record facts the customer supplied, such as the hash of a document; for those, the receipt proves only that the customer stated them to us at that time. The Receipt Practice Statement lists which tool is which.

3. What a receipt does not prove#

A receipt does not prove, and you must not treat it as proving:

• that the content behind a hash exists anywhere, is authentic, is lawful, or is what anyone says it is. A hash proves only that matching bytes existed when the receipt was issued;
• who the customer is, beyond what the receipt itself contains. Agined does not verify customers' identities, and a receipt is not an identity document;
• that a destination, an AI model or any other third party behaved correctly, only what Agined observed of it;
• that a receipt issued with the free test key is a production attestation. Test receipts carry "environment": "test" inside the signed bytes;
• that nothing happened where there is no receipt, or that no other receipt exists. There is no public log of issued receipts;
• anything about events before or after the time it states; or
• legal advice, an audit, a certification or an endorsement by Agined of any product, content or person.

4. What you should do before relying on a receipt#

Verify the signature yourself, with our published keys or an independent implementation, rather than trusting a copy of a verification result. Get the public key through a channel you trust and pin it, and check the Key management page for any notice that a key was compromised. Read the fields: what the receipt says it attests, whether its tool observes or records reported facts, and whether it was issued with the test key. A receipt that has been redacted no longer verifies. Decide for yourself how much weight it deserves for your purpose.

5. Our commitment to verifiers#

We publish every public key we use to sign production receipts, keep retired keys published so older receipts keep verifying, and publish a notice of any key compromise, as the Key management page describes.

If you believe a receipt that verifies was not issued by us, or that its fields do not match what our systems recorded, tell us at security@agined.com with the receipt. Where we still hold our copy of the receipt, we tell you whether our records agree with it. If we find that a receipt verifies although we did not issue it, we treat that as a security incident and publish what we found.

6. Disclaimer and limitation of liability#

Apart from the commitments in section 5, receipts, our keys, the /verify page and our verification libraries are provided to verifiers as is, without any warranty, express or implied, including of merchantability, fitness for a particular purpose and non-infringement. Agined has no contract with you about any customer's use of the Service and is not responsible for a customer's conduct or for decisions you make on the basis of a receipt.

To the fullest extent the law allows, Avonao, Inc. and its officers and contractors are not liable to a verifier for any loss arising from verifying or relying on a receipt, whatever the legal theory. Nothing in these terms limits liability that cannot be limited by law, such as liability for fraud, for intentional misconduct or gross negligence, or for death or personal injury caused by negligence, or the mandatory rights of a consumer.

7. Personal data in receipts#

A receipt you receive can contain personal data, such as a destination URL that identifies a person or a commit author's name and email address. If you keep or use it, you are responsible for doing so lawfully. A person named in a receipt can exercise their rights against us as our Privacy Policy describes.

8. Governing law#

These terms are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-law rules. If you are a consumer, this does not remove the protection of mandatory law where you live, including your right to bring a claim in the courts of your country of residence.

9. Changes and contact#

We may update these terms and change the date at the top. The terms that apply to a receipt are the ones in force when you rely on it. Earlier versions are available on request. Questions: support@agined.com. Security concerns about a receipt or a key: security@agined.com.