Terms of service

1. The service

Attestia acts as a Vetting & Verification Authority. It checks your business and the assets you list (brands, telephone numbers and ranges, sender IDs, messaging agents, apps and the network APIs they use), and, when it verifies them, issues signed tokens and a Verification Score that operators, messaging platforms and network API providers ("relying parties") can check before they carry your calls, messages or API requests. Each relying party decides for itself what score it requires.

A verification is valid for 12 months from its approval and is renewed with a yearly re-verification. Apps, assets and network APIs approved later are valid for 12 months from their own approval and are renewed together with your business.

2. Your part

• Give correct and complete information, and keep it up to date in the portal; tell us without delay if something changes, such as a signatory, a number or a brand.
• Only list assets you own or are authorised to use, and only apply for network APIs your apps need for the purpose you state.
• The person who signs the application must be entitled to sign for your business.
• Keep sign-in details, client secrets and private keys safe; tell us at once if they may have been compromised, and revoke them in the portal.
• Use tokens and API access only for your own verified apps and assets, and not to mislead anyone about who is calling, messaging or calling an API.
• Do not upload identity documents, personal identity numbers or other personal data that the application does not ask for.

3. Checks

You accept that Attestia checks your application with business registries, trademark offices, credit reference agencies and verification providers, and may ask your signatory and contact person to confirm by email or phone. Paid checks are charged only where your price list says so. The sources are listed on the service providers page.

4. Decisions, suspension and revocation

An Attestia analyst decides on each application, with or without conditions, and may ask for more information. Attestia may suspend or revoke a verification, a token or an app's access, and tell relying parties, if information turns out to be wrong, an asset is no longer yours, a key or secret is compromised, fees remain unpaid after the grace period, or the service is misused. Where possible we tell you first and give you a chance to put things right.

5. Fees

The fees are those shown in the portal and on the sign-up page for your country, or agreed with you: a one-time Vetting & Verification fee, a monthly subscription, a yearly renewal fee and prices per API Verification Token. Fees are invoiced monthly, plus VAT where it applies, and are payable as stated on the invoice. Fees already paid are not refunded if an application is rejected or withdrawn. Price changes apply to new charges and are announced in advance.

6. Data protection

Each of us is an independent controller of the personal data it handles. Attestia handles personal data as set out in its privacy notice, which forms part of these terms. In particular, Attestia:

• uses the personal data in your application only to provide and secure the service, to keep the verification record and to meet legal obligations;
• keeps it in the EU, and transfers data outside the EU only on a legal basis set out in the privacy notice;
• keeps it confidential, protects it with appropriate technical and organisational measures, and has its service providers do the same under written agreements;
• keeps it only as long as the privacy notice says;
• tells you without undue delay of a personal data breach that affects the people you named, and helps you answer their questions.

You confirm that you may share the personal data you give us, and you show the people you name in the application (your signatory, contact person and users) our privacy notice. If Attestia ever processes personal data on your behalf and on your instructions for a service, the parties agree separate data processing terms under Article 28 GDPR for that service.

7. Publication

Your token and score go to relying parties that connect to Attestia. Publication to Trust Registries is separate and needs your permission under the publication terms, unless your agreement says otherwise.

8. Liability

Attestia verifies with care, but relies on the sources it checks and on what you tell it, and does not guarantee that a verified business will not misuse its calls, messages or APIs. Neither party is liable for indirect or consequential loss, such as lost profit or revenue. Each party's total liability under these terms in a calendar year is limited to the fees you paid in the 12 months before the event. These limits do not apply to wilful misconduct, gross negligence, or where the law does not allow them.

9. Term and ending

These terms apply from your submission until your account is closed. You can end them at any time by closing your account through your enterprise admin; the monthly subscription ends at the end of that month. Attestia can end them with 30 days' notice, or at once for a serious breach. On ending, tokens are revoked, relying parties and any Trust Registry are told, and records are kept as the privacy notice says.

10. Changes

We may change these terms by publishing a new version on this page. We tell your enterprise admin at least 30 days before a change that is to your disadvantage takes effect, and the portal asks for the new version to be accepted at your next submission or renewal.

11. Law and disputes

Finnish law applies, without its conflict of laws rules. Disputes are settled by arbitration under the Arbitration Rules of the Finland Arbitration Institute (FAI), with one arbitrator, in Helsinki, in English. Either party may still seek interim measures from a competent court.

Contact: OOMZEE Oy, Korkeakoulunkatu 7, 33720 Tampere, Finland; privacy questions privacy@captila.com.