Terms of Service

These Terms of Service (the "Terms") are a contract between Sanning Inc., a Delaware corporation ("Sanning", "we", "us"), and the organization that uses the Services ("Customer", "you"). They govern your use of the Sanning console, APIs, SDKs, verify page and documentation (the "Services").

The main points:

• The Services are for businesses only.
• Your SDK hashes each Event on your systems. Sanning receives a signed Envelope and some Sent fields, never the Event itself or its content (section 4).
• You choose your Sent fields. Do not put secrets or sensitive personal data in them (section 5.3).
• Sanning publishes Stamps to a public record. A Stamp is permanent: nobody, including Sanning, can delete or change it (section 5.5).
• A record shows that an Envelope existed by a time and was signed by a key. It does not show that what your Agent did was true, correct or lawful (section 9).
• You can leave at any time and take your data with you, at no charge (section 16).
• Our liability is limited (section 13), and disputes go to arbitration (section 18).

1.1. Business use only. You use the Services for your trade, business or profession, and not as a consumer. If you accept these Terms for an organization, you confirm that you have the authority to bind it.

1.2. How you accept. You accept these Terms when you sign an Order Form that refers to them, when you click to accept them, or when you use the Services.

1.3. Order of precedence. If two documents conflict, the first in this list applies: (a) an Order Form, including any terms that it adds because financial or other regulation requires them; (b) a data processing agreement between you and Sanning; (c) these Terms, which include the Acceptable Use Policy; (d) the Documentation.

2.1. "Account" means your organization's account in the Services, with its Users, API keys and settings.

2.2. "Agent" means an AI agent or other software that you run and that produces Events.

2.3. "API key" means a credential that we issue to you to call the Services. Each API key carries the permissions that you give it.

2.4. "Customer Data" means your Account data, the Envelopes and Sent fields that you send us, and the usage data that the Services make when you use them. Customer Data does not include Events.

2.5. "Documentation" means the documentation at docs.sanning.io.

2.6. "Envelope" means the signed wrapper over the hash of one Event, which your SDK sends to Sanning. An Envelope holds the hash, a signature, the public key of the Signing key, the time of signing, the environment it was signed for, its format version, an id, and where the Event is stored in your Log store.

2.7. "Event" means the data that an Agent produces, such as a step, a decision or a hand-off, including its content. Events stay on your systems.

2.8. "Kernel" means Sanning's verifier, which anyone can run to check a Pack without Sanning.

2.9. "Live" means the part of the Services that holds your real evidence and publishes Stamps to the public record.

2.10. "Log store" means your own storage for your Events, such as a bucket or a folder that you control. Sanning does not read it.

2.11. "Order Form" means a document that you and Sanning sign that names your plan, fees and term.

2.12. "Pack" means the file that you build from your Log store and the Services and give to a third party, so that it can verify your records.

2.13. "Sandbox" means the part of the Services for trying Sanning, as section 4.4 describes.

2.14. "Sent fields" means the fields that your SDK copies from an Event and sends in clear beside its Envelope, so that you can find and group your records, such as the event type, the Agent's id, a case id, run and conversation ids, and the outcome status. Our Privacy Policy lists them.

2.15. "Signing key" means an Ed25519 key that you enroll for an Agent and that signs its Envelopes.

2.16. "Stamp" means the record that seals all of one organization's Envelopes for one interval, which Sanning publishes to the public record. It holds Merkle roots, blinded references for the organization and its Agents, counts, and the times of the interval.

2.17. "User" means a person to whom you give access to your Account.

3.1. Account. You give us accurate information and keep it up to date. You are responsible for your Users and for everything done in your Account.

3.2. API keys. Keep your API keys secret. If you think that a key is compromised, revoke it and tell us at security@sanning.io.

3.3. Signing keys. You make and keep the seed of each Signing key. Sanning never receives a seed, and we cannot recover a seed that you lose. You are responsible for the security of your seeds and of the systems that use them.

3.4. Protective action. We can rate-limit, suspend or revoke a credential that we reasonably think is compromised or misused, as section 15 describes. If an API key appears in a public place, for example a public code repository, we can revoke it automatically.

4.1. What the Services do. The Services receive your Envelopes, list them with their Sent fields, seal them into Stamps at the end of each interval, publish the Stamps to the public record, and help you build Packs that anyone can verify.

4.2. What Sanning receives. Sanning receives your Envelopes, your Sent fields, your Account data and usage data (for example, request counts, sizes, times and IP addresses). Sanning does not receive an Event itself or its content, except through a feature described in section 4.3, and never receives your seeds. From the times and links in Envelopes and Sent fields, Sanning can see the shape of a run, such as how long steps took, how operations ended and, where both sides of a hand-off use Sanning, which Signing key sent a message to which. Anyone can verify a Pack with the Kernel, offline, without Sanning.

4.3. Features that send more data. Some features, when we offer them, send more of an Event to Sanning, up to its full content. We turn such a feature on for your organization only at your written request. The Documentation says what each feature sends, and added terms can apply to it.

4.4. Sandbox and trials. The Sandbox is for trying Sanning. It uses a simulated witness, publishes nothing to the public record, and is not billed. A Sandbox Pack is not evidence, and the Kernel reports it as Sandbox. We delete Sandbox records after 30 days. The Sandbox and any trial are versions for testing and evaluation for a limited period, so section 16.4 does not apply to them.

4.5. Previews. Features that we mark as preview, beta or experimental can change or end at any time, and we provide them as is.

4.6. Changes to the Services. We can change the Services. If a change materially reduces a paid Service during its term, we tell you in advance.

4.7. Support. We give support by email at support@sanning.io. Support levels and any service level are as stated in your Order Form, if any.

4.8. Where the Services run. We run the Services on infrastructure in the United States, under US law. Our Privacy Policy lists our providers.

5.1. Ownership. You own your Events and your Customer Data. Sanning claims no ownership of them.

5.2. Your license to Sanning. You give Sanning a worldwide, non-exclusive, royalty-free license to host, copy, process, list and show your Customer Data, and to include your Envelopes in Stamps and publish those Stamps, only as necessary to provide, secure, support and improve the Services, to meter and bill, and to comply with law. The license to published Stamps lasts for as long as they stay on the public record.

5.3. Sent fields and the Envelope. You choose your Sent fields, and you are responsible for them. Do not put passwords, keys or other secrets, payment card data, government identification numbers, health data or other special categories of personal data in a Sent field. If a Sent field identifies a person, for example a case id that is a customer number, you confirm that you have a lawful basis to send it to us and that you have told the person as the law requires. If you ask, we clear a stored Sent field within one month. Clearing it does not change the Envelope or the Stamp. Never put personal data in the location field of an Envelope: it is part of what your Signing key signs, so we cannot clear it. The SDK writes an opaque location unless you change it.

5.4. Your responsibility for what you record. You are responsible for your Agents, your Events and what you record, and for having the rights that you need to record it.

5.5. Stamps are permanent and public. You understand and accept that:

• (a) a Stamp that Sanning publishes to the public record is public and permanent, and nobody, including Sanning, can delete, change or recall it;
• (b) a Stamp does not hold your Events, your Envelopes, your Sent fields or your organization's name, but it does show, under blinded references that stay the same from Stamp to Stamp, when your organization recorded, how many Agents sent records and how many records each sent, so a person who holds one of your Packs can find your other Stamps; and
• (c) this permanence is what makes your evidence checkable by others, and it continues after these Terms end.

5.6. Keep your Log store. Your Log store holds your Events. Sanning cannot rebuild an Event that you lose. If you lose your Log store, your Envelopes and Stamps remain, but the content behind them is gone. You are responsible for your own copies and backups.

5.7. Retention. We keep your Envelopes and Sent fields while your Account is open. Section 16.4 says what happens when these Terms end.

5.8. Aggregated data. We can make and use aggregated statistics about the use of the Services, for example volumes and performance, if they do not identify you or any person.

5.9. Personal data. To the extent that Customer Data contains personal data that you control, Sanning processes it for you as a processor, on your instructions as these Terms set them. If the law requires a data processing agreement, for example the EU or UK GDPR, ask us at privacy@sanning.io, and we will put one in place before you send us that personal data. Our Privacy Policy describes the personal data that Sanning controls.

5.10. Requests from governments. If a government or court asks us for your Customer Data, we tell you before we comply, unless the law forbids it, and we disclose only what the law requires.

5.11. Security. We use reasonable technical and organizational measures to protect Customer Data. Our Privacy Policy describes the main ones. Sanning does not hold a SOC 2, ISO 27001 or other security certification, and we state a certification only after we get it.

6.1. You must follow the Acceptable Use Policy, which is part of these Terms. If you break it, we can suspend or end your access, as sections 15 and 16 describe.

7.1. Fees. You pay the fees in your Order Form. We can give access at no charge, for example the Sandbox or a trial. Access at no charge is as is, and we can limit, change or end it at any time.

7.2. Usage-based fees. If your Order Form has usage-based fees, the metering of the Services is the record of your usage, unless it has a clear error.

7.3. Payment. You pay each invoice within 30 days of its date, or by card through Stripe, as your Order Form says. Stripe's terms apply to card payments.

7.4. Renewal and cancellation. If your Order Form says that it renews, it renews for the same period unless either party cancels before the end of the current period. Fees already paid are not refunded, except as these Terms or the law say.

7.5. Taxes. Fees do not include taxes. You pay all sales, use, value added and similar taxes on the fees, except taxes on Sanning's income.

7.6. Late payment. If you do not pay on time, we can charge interest at the lower of 1.5% a month and the highest rate that the law allows, and, after notice, suspend the Services, as section 15 describes.

7.7. Billing disputes. Tell us in writing about a billing dispute within 30 days of the invoice or charge. You pay the amounts that you do not dispute.

7.8. Price changes. We can change our prices for future periods. A change to the price of a paid plan takes effect at your next renewal, and we tell you at least 30 days before.

8.1. Providers. The Services use other companies, such as hosting, email and payment providers. Our Privacy Policy lists them.

8.2. The public record. Sanning publishes Stamps to Arweave, a public, permanent network that Sanning does not own or control. We do not control, and make no promise about, the network's availability, fees, operation or future.

8.3. Changing the public record. We can add or change the public network that we publish Stamps to. We tell you before a change that materially affects you. Stamps already published stay where they are.

9.1. Independent verification. Anyone can verify a Pack with the Kernel, offline, without Sanning, and without an account.

9.2. What it shows, and what it does not. A verified record shows that an Envelope with a given hash was signed by a given Signing key and existed by the time of its Stamp, when the Stamp is checked against the public record. It does not:

• (a) show that an Event, or what an Agent did, was true, correct, complete, lawful or authentic, because Sanning never receives the Event;
• (b) show who controlled a Signing key, beyond the cryptographic facts;
• (c) show that a Pack holds every record of a run, except as far as the Pack's own declaration says; or
• (d) act as a legal attestation, certification, audit opinion, notarization or legal advice.

9.3. Sent fields are not checked. Your SDK sends a copy of the Sent fields beside the Envelope. That copy is not signed, and Sanning does not check it against your Event. Anyone with your API key can send Sent fields.

9.4. Your evaluation. You, and anyone who relies on a record, decide what weight to give it.

10.1. Sanning's property. Sanning and its licensors own the Services and all related software, designs and know-how. These Terms give you only the rights that they state.

10.2. SDK and Kernel licenses. We let you use the SDKs to use the Services, as the Documentation describes. Where an SDK, the Kernel or another component comes with an open-source license, that license governs it, and it wins over these Terms for that component.

10.3. Restrictions. You must not: (a) copy or modify the Services except as these Terms or an open-source license allow; (b) reverse engineer the Services, except as far as the law allows despite this restriction; (c) resell the Services or provide them to others, unless we agree in writing; (d) get around metering, rate limits, permissions or security controls, except security research that follows the Acceptable Use Policy; or (e) remove our notices.

10.4. Our name. "Sanning" and our logos are our trademarks. You can use our name only to identify Sanning as your provider, unless we agree otherwise in writing.

10.5. Feedback. If you give us suggestions or feedback, we can use them without any duty to you.

11.1. "Confidential Information" means non-public information that one party gives to the other and that is marked confidential or that a reasonable person would understand to be confidential. It does not include information that is or becomes public without fault of the receiver, that the receiver already knew, that the receiver develops independently, or that the receiver gets lawfully from a third party.

11.2. The receiver uses Confidential Information only to perform these Terms and protects it with at least reasonable care. The receiver can disclose it when the law requires, after giving notice where the law allows.

11.3. Published Stamps are public and are not Confidential Information.

12.1. Each party confirms that it has the authority to enter into these Terms.

12.2. EXCEPT AS THESE TERMS EXPRESSLY STATE, THE SERVICES, THE SDKS, THE KERNEL AND THE DOCUMENTATION ARE PROVIDED "AS IS" AND "AS AVAILABLE". SANNING DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT.

12.3. WITHOUT LIMITING SECTION 12.2, SANNING DOES NOT WARRANT THAT: (A) THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE; (B) ANY PUBLIC NETWORK WILL STAY AVAILABLE OR KEEP STAMPS RETRIEVABLE; OR (C) A VERIFICATION RESULT SHOWS THAT ANY EVENT WAS TRUE.

12.4. Sanning does not promise that the Services meet any law, regulation or standard that applies to you. You decide whether the Services suit your needs, and you remain responsible for your own duties under laws such as the EU AI Act.

13.1. TO THE FULLEST EXTENT THAT THE LAW ALLOWS, NEITHER PARTY IS LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA OR GOODWILL, OR BUSINESS INTERRUPTION, ARISING FROM THESE TERMS OR THE SERVICES, EVEN IF TOLD OF THE POSSIBILITY.

13.2. TO THE FULLEST EXTENT THAT THE LAW ALLOWS, EACH PARTY'S TOTAL LIABILITY ARISING FROM THESE TERMS OR THE SERVICES IS LIMITED TO THE GREATER OF (A) THE FEES THAT YOU PAID SANNING IN THE 12 MONTHS BEFORE THE EVENT THAT GAVE RISE TO THE CLAIM AND (B) US$100.

13.3. WITHOUT LIMITING THE REST OF THIS SECTION, SANNING IS NOT LIABLE FOR: (A) THE PERMANENCE OF PUBLISHED STAMPS; (B) A SENT FIELD OR AN ENVELOPE LOCATION THAT YOU SENT IN BREACH OF SECTION 5.3; (C) THE OPERATION OF ANY PUBLIC NETWORK OR OTHER THIRD-PARTY SERVICE; OR (D) ANYONE'S RELIANCE ON A VERIFICATION RESULT AS TO THE TRUTH OF AN EVENT.

13.4. Sections 13.1 and 13.2 do not limit: (a) your duty to pay fees; (b) your duties under section 14; (c) a breach of section 11; or (d) liability for gross negligence, fraud or willful misconduct, or any other liability that the law does not let a contract limit.

13.5. These limits are an essential part of the bargain between the parties, and they apply even if a remedy fails of its essential purpose.

14.1. You defend Sanning and its officers, directors, employees and agents against any third-party claim arising from: (a) your Agents, your Events or your Sent fields; (b) your breach of these Terms or the Acceptable Use Policy; or (c) your breach of law or of a third party's rights. You pay the damages, costs and reasonable legal fees that result.

14.2. Sanning gives an indemnity to you only if an Order Form says so.

14.3. The party that claims an indemnity tells the other party promptly, lets it control the defense, and helps it as reasonably necessary. The defending party does not settle a claim in a way that puts a duty or an admission on the other party without its written consent.

15.1. We can suspend or limit the Services or a credential, in whole or in part, if: (a) you have not paid fees that are due, after notice; (b) we reasonably think that you are breaking these Terms, the Acceptable Use Policy or the law; (c) it is necessary to protect the Services, other customers or third parties; or (d) the law requires it.

15.2. Where we can, we tell you before we suspend, give our reasons, and give you a chance to fix the problem. We restore access when the reason ends. A suspension does not change Stamps already published.

16.1. Term. These Terms start when you accept them and continue until they end as this section says. An Order Form can set a minimum term.

16.2. Ending by you. You can end these Terms at any time with written notice to legal@sanning.io. The notice takes effect at the time that you give in it, which can be up to two months after we receive it. Fees for a minimum term in an Order Form stay payable, unless the Order Form or the law says otherwise.

16.3. Ending by Sanning. We can end these Terms: (a) if you materially breach them and do not fix the breach within 30 days of our notice; (b) at once, if you seriously breach the Acceptable Use Policy or the law; (c) for non-payment, after the notice in section 7.6; or (d) for any reason, with 60 days' notice, in which case we refund any fees that you paid in advance for the period after the end.

16.4. Moving to another provider, and your data at the end.

• (a) What you can take. You can export, in a machine-readable format: the list of your records, with each Envelope and its Sent fields; your Agents and their Signing keys' public keys; your Users; and your usage records. You can export the list of your records through the API, signed in with a console session. For the rest, or if you prefer, ask us at support@sanning.io and we send you the export within 14 days. Your Events are already in your Log store.
• (b) What stays with us. Our own operational data is not exportable: our security and audit logs, our metering internals, our keys and secrets, and our source code.
• (c) When. From the day either party gives notice to end these Terms until 30 days after they end (the "retrieval period"), you can export your data. If you tell us that you are moving to another provider or to your own systems, we help you during a transition period of up to 30 days after your notice period, keep the Services running for you, keep your data secure, and tell you about any risk to the move that we know of. If we cannot do this in 30 days, we tell you within 14 working days and agree a longer period with you.
• (d) No charge. We do not charge for export, transition help or deletion.
• (e) After the retrieval period. We delete your Users' account data and clear your Sent fields. We keep your Envelopes, which hold no Event content, unless you ask us to delete them, and then we delete them. We keep billing records, security records and acceptance records as the law requires and as our Privacy Policy says. Published Stamps stay on the public record.
• (f) Your Packs still verify. Packs that you already gave to others still verify after these Terms end, because the Kernel does not use Sanning's copy of anything.

16.5. Survival. Sections 2, 5.2, 5.3, 5.5, 5.6, 5.9, 7 (for amounts due), 9, 10, 11, 12, 13, 14, 16.4, 16.5 and 17 to 21 continue after these Terms end.

17.1. We can change these Terms. We publish the new version with a new version date. For a material change, we tell you by email or in the console at least 30 days before it takes effect, except where the law or a security need requires a faster change.

17.2. If you do not accept a change, you can end these Terms before it takes effect, and we refund any fees that you paid in advance for the period after the end. If you continue to use the Services after the change takes effect, you accept it.

18.1. Governing law. The laws of the State of Delaware govern these Terms, without regard to conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods does not apply.

18.2. Arbitration. Any dispute arising from these Terms or the Services is resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before one arbitrator, seated in New Jersey and in English. Judgment on the award can be entered in any court with jurisdiction. Either party can bring a claim in a small-claims court instead, if the claim qualifies.

18.3. No class actions. Each party brings claims only in its own name, and not as a member of a class, collective or representative action. Each party waives any right to a jury trial.

18.4. Court relief. Either party can ask a court for an injunction or other urgent relief to protect its intellectual property or Confidential Information. For this, the parties accept the jurisdiction of the state and federal courts in New Jersey.

18.5. Time limit. A claim must be brought within one year after it arises, as far as the law allows.

19.1. You confirm that you are not in a country or region under comprehensive US sanctions, and that you are not on a US government list of restricted parties. You will not use the Services in breach of export-control or sanctions laws.

20.1. We send notices to the email address on your Account or in the console. You send legal notices to legal@sanning.io, and formal legal notices also by post to Sanning Inc., 500 Paterson Plank Rd #32854, Union City, NJ 07087, USA.

20.2. Other contacts: security@sanning.io for security issues, privacy@sanning.io for privacy, and support@sanning.io for support.

20.3. Point of contact for authorities and users in the EU. For the EU Digital Services Act, our single point of contact for authorities and for users is legal@sanning.io. A person reads every message. You can write to us in English.

21.1. Force majeure. Neither party is liable for a delay or failure, other than a payment failure, caused by events outside its reasonable control, including failures of the internet, utilities, public networks or other third-party services.

21.2. Assignment. You can assign these Terms only with our written consent, except to a successor in a merger, acquisition or sale of most of your assets that takes on these Terms. We can assign these Terms to an affiliate or a successor.

21.3. Relationship. The parties are independent contractors. There are no third-party beneficiaries, except the persons that section 14 protects.

21.4. Entire agreement. These Terms, with any Order Form, data processing agreement and the Acceptable Use Policy, are the entire agreement between the parties about the Services.

21.5. Severability and waiver. If a court finds part of these Terms unenforceable, that part is changed as little as necessary and the rest stays in effect. A waiver is effective only in writing, and not using a right is not a waiver of it.

21.6. Interpretation. Headings are for convenience. "Including" means "including without limitation". These Terms are in English, and the English version governs.