This Verifier Supplement is incorporated into the Proof General Terms (“General Terms”). Capitalized terms not otherwise defined have the meanings given in the General Terms, the Proof Glossary, or the Order Form.
- Applicability. This Verifier Supplement applies to any User that acts as a Verifier. If Verifier does not accept this Verifier Supplement, Verifier may not request or receive Claims.
- Enrollment and Acceptance.
2.1 Enrollment. To request Claims, Verifier must enroll through the process Proof makes available, which may include registering a client identifier, a public key, and an email address on a domain Verifier controls, and completing any domain, business, or other verification Proof requires. Proof may decline or revoke any enrollment.
2.2 Acceptance by an Individual. Enrollment is complete only when an individual authorized to act for Verifier affirmatively accepts the General Terms and this Verifier Supplement through the acceptance step Proof presents on the Platform. Acceptance by an automated agent or other software is not sufficient. Proof will not enable Verifier to receive Claims in a production environment until that acceptance is complete. Once accepted, the General Terms and this Verifier Supplement apply to every request made under each client identifier and key Verifier registers. Proof may require an individual authorized to act for Verifier to accept an updated version of this Verifier Supplement before Verifier continues to request or receive Claims. This Section 2.2 modifies the General Terms by requiring acceptance by an individual and by allowing Proof to require acceptance of an updated version of this Verifier Supplement.
2.3 Authority and Control. The individual who accepts on Verifier’s behalf represents that they are authorized to bind Verifier. Verifier represents that it controls the domain, client identifier, email address, and keys it registers, and that the information it provides during enrollment is accurate and complete. Verifier will keep that information current.
2.4 Registered Keys. Verifier is responsible for all requests made or signed with the keys and client identifiers it registers, whether made by Verifier’s personnel, systems, or automated agents. Verifier will protect its private keys from unauthorized use, will notify Proof promptly at legal@proof.com if a key is compromised, and will rotate or revoke keys as Proof reasonably requires. Proof may revoke or disable any key or client identifier at any time.
2.5 Name and Brand. Verifier grants Proof a non-exclusive, royalty-free license to display Verifier’s name, logo, domain, and privacy-policy link, as provided during enrollment or in Verifier’s client metadata, to identify Verifier to End Users and in any trust list or registry Proof operates. Verifier will not state or imply that Proof sponsors, endorses, certifies, or has reviewed Verifier, its products, or its practices, except as Proof approves in writing. Verifier may identify Proof as a method it accepts for presenting Claims, consistent with any brand guidelines Proof provides.
2.6 Verification Levels. Proof may assign Verifier a level based on the verification completed during enrollment or afterward. Proof may make some Claims available only to Verifiers at or above a level, and may change Verifier’s level, the verification required for any level, or the Claims available at any level at any time. Verifier will provide the information Proof reasonably requests for that verification and will notify Proof if it changes.
- Requesting and Receiving Claims.
3.1 Requests. Verifier will:
(a) identify itself accurately in every request, using only client identifiers and keys it has registered;
(b) sign its requests where Proof requires signed requests;
(c) request Claims only through the scopes and methods Proof makes available, and describe accurately the Claims it seeks and, where Proof provides for it, the purpose of the request;
(d) request Claims only in connection with a transaction, account, or request for access that the End User has initiated with Verifier; and
(e) not disable, override, obscure, or interfere with any Proof consent screen, End User approval, or Standing Authorization limit, or use deceptive design to induce an End User’s approval.
3.2 Data Minimization. Verifier will request only the Claims reasonably necessary for the Permitted Purpose. Where a Claim that states only whether a condition is met meets Verifier’s need, Verifier will request that Claim rather than the underlying data.
3.3 Validation. Verifier is responsible for validating each presentation it receives, including its signature, nonce, expiration, revocation status, and any transaction binding, using Proof’s then-current published root certificates and keys.
3.4 Agents. Verifier is responsible for any software, including any automated agent, that it permits to access its endpoints or to act for it, including through any trust list Verifier configures. A transaction, account, or request for access that an Authorized Agent initiates with Verifier on an End User’s behalf is treated as initiated by the End User. Proof does not control, and is not responsible for, any third-party agent, application, or wallet.
3.5 Monitoring. Verifier will not interfere with Proof’s monitoring or testing of its requests for Claims.
3.6 Authentication Levels. Proof may offer different levels at which an End User is authenticated before a presentation, and may describe them in Proof’s documentation. Verifier selects the level it requires for each request. Proof may make some Claims available only at or above a level, and may change the levels, their descriptions, or the Claims available at any level at any time. If Verifier selects a level that does not require the End User to authenticate to Proof at the time of the presentation, Proof will present Claims on the instruction of a connected Authorized Agent or application without confirming that the End User is present or is the person giving the instruction, and Verifier accepts that a presentation at that level represents only what Section 6.1 states. Verifier is solely responsible for selecting a level appropriate to its use of the Claims.
- Use of Claims.
4.1 Acceptable Use Supplement. Claims are Results Data. The Acceptable Use Supplement applies to Verifier’s receipt and use of Claims.
4.2 Permitted Purpose. Verifier may use Claims solely to (a) confirm the End User’s identity or the attributes stated in the Claim for the transaction, account, or access the End User requested from Verifier; (b) detect and prevent fraud and unauthorized access relating to that transaction, account, or request; (c) comply with laws applicable to Verifier; and (d) keep records of the verification as required by law or reasonably necessary for Verifier’s audit needs (together, the “Permitted Purpose”).
4.3 Additional Restrictions. Verifier will not:
(a) sell, rent, license, or otherwise disclose Claims for monetary or other valuable consideration, or use or disclose Claims for targeted or cross-context behavioral advertising or for marketing;
(b) combine Claims with other data to build a profile of, or a database about, any End User beyond what the Permitted Purpose requires;
(c) use Claims to track or correlate an End User across Verifiers, websites, or services, or attempt to re-identify an End User from a Claim designed not to reveal underlying data;
(d) use Claims to discriminate unlawfully, including on the basis of citizenship, immigration status, national origin, age, or any other characteristic protected by law;
(e) forward, re-present, or otherwise provide a Claim, or the presentation containing it, to any third party as evidence of an End User’s identity or attributes, except as paragraph (f) permits, or rely on a Claim that Verifier did not receive through the Platform;
(f) disclose Claims to any third party, except (i) to service providers acting solely on Verifier’s behalf under written obligations at least as protective as this Section 4, (ii) as required by law, or (iii) with the End User’s express consent;
(g) use Claims to train or improve any machine-learning or artificial-intelligence model, other than a fraud-prevention model used solely for the Permitted Purpose; or
(h) request or use Claims on behalf of, or for the benefit of, any third party.
4.4 Nationality Claims. Verifier will request a Claim about an End User’s nationality or citizenship only where applicable law requires or expressly permits Verifier to consider that information for the transaction, account, or request for access at issue. Verifier will not use that Claim to determine eligibility for employment and will not use it in violation of any law prohibiting discrimination based on citizenship, immigration status, or national origin.
4.5 Retention and Deletion. Verifier will retain Claims only as long as reasonably necessary for the Permitted Purpose, and no longer than the period it disclosed to the End User, unless applicable law requires longer retention. Verifier will then securely delete them. Verifier may keep a record that a verification occurred without retaining the Claim itself.
4.6 Security and Incidents. Verifier will protect Claims with administrative, technical, and physical safeguards appropriate to their sensitivity and no less protective than prevailing industry standards. Verifier will notify Proof at legal@proof.com without undue delay, and in any event within forty-eight (48) hours after becoming aware, of any unauthorized access to or acquisition, use, or disclosure of Claims in Verifier’s possession or control, and will reasonably cooperate with Proof’s investigation. Notice under this Section 4.6 satisfies any notice obligation for the same incident under the Acceptable Use Supplement.
4.7 Notices. Verifier is responsible for providing all notices and obtaining all consents applicable law requires for Verifier’s own collection, use, and retention of Claims, and will not represent that Proof is responsible for Verifier’s privacy practices. Verifier represents that it has a lawful basis under applicable law to request, receive, and use each Claim. Verifier will maintain a publicly available privacy policy that describes its collection, use, and retention of Claims, and will tell End Users, at or before the time it requests Claims, whether it retains Claims and for how long.
- Data Protection. Verifier will protect Claims in accordance with its own privacy and data protection policies as well as with applicable laws and regulations.
- Nature of Claims.
6.1 What a Claim Represents. A Claim represents only that (a) Proof performed the identity verification from which the Claim is derived, as of the time and to the extent stated in the presentation, and (b) Proof received approval for the presentation at the authentication level Verifier selected, as recorded by Proof. Where that level did not require the End User to authenticate to Proof, Proof does not represent that the End User gave the approval. Proof makes no other representation about a Claim. Identity verification is a risk-assessment measure and not a guarantee of any person’s identity or of the absence of fraud. Proof makes no representation about an End User’s legal authority or intent, or that a Claim remains accurate after the time it states.
6.2 Verifier’s Decisions. Verifier is solely responsible for its decisions and actions in reliance on Claims, for the authentication level it selects, and for determining whether any Claim at that level satisfies Verifier’s legal obligations, including any customer identification, know-your-customer, anti-money-laundering, or age-verification requirement, and including where the presentation was made through an Authorized Agent, at a level that did not require End User authentication, or under a Standing Authorization. A Claim does not by itself satisfy any such obligation.
6.3 Status. A Claim may be revoked, suspended, or superseded after it is presented. Proof has no obligation to notify Verifier of any change except through the status mechanisms Proof makes available.
6.4 No Liability for Reliance. Proof has no liability to Verifier for a presentation approved by a person other than the End User at a level that did not require the End User to authenticate to Proof, or for Verifier’s reliance on it.
- Fees. Proof may make Claims available without charge. Unless otherwise stated in an Order Form, Proof may begin charging for Claims, or change any Fees, at any time for future requests, including by quoting Fees at the time of a request. If Proof quotes a Fee in response to a request, Proof will present Claims for that request only after Verifier pays the quoted Fee, and Verifier’s payment is its agreement to that Fee. Introductory or promotional pricing may end at any time. Fees will be payable through the methods Proof specifies, which may include payments under the x402 protocol. Payments made in digital assets, such as stablecoins, are final once confirmed on the applicable network and cannot be reversed. Verifier is responsible for any network or transaction fees, for the accuracy of any payment address or instruction it uses, and for complying with any laws that apply to its use of digital assets. Regardless of whether there is a Fee, Verifier agrees that access to Claims is provided in consideration of the mutual covenants in the Agreement, including its disclaimers and limitations of liability. Paying Fees for Claims does not by itself make Verifier a Subscriber.
- Indemnification. Verifier’s indemnification obligations under the Agreement extend to third-party claims, including claims by an End User or a governmental authority and any fines, resulting from Verifier’s decisions or actions in reliance on any Claim.
- Suspension and Termination. Proof may immediately suspend or end Verifier’s ability to request or receive Claims, disable any client identifier or key, or remove Verifier from any trust list or registry Proof operates, if Proof reasonably believes Verifier has breached this Verifier Supplement or that continued access may harm End Users, Proof, or others. Proof may stop presenting Claims to Verifier at any time for any other reason. On termination, Verifier will stop requesting Claims and will delete Claims it holds except as Section 4.5 permits. Sections 4, 5, 6, and 8 survive termination.