Terms of Service

1. Purpose

These Terms of Service ("Terms") govern access to and use of Trust Layer, a certifying proxy for AI agent-to-agent transactions, available under Free, Pro, Enterprise, and Platform plans.

Trust Layer is infrastructure: it forwards requests to a target API and generates a cryptographic proof of the transaction. It is not a scanning, monitoring, or analytics SaaS.

By using the service, you agree to these Terms in full.

2. Provider

ArkForge
SIRET: 93208689500013
Email: [email protected]
Website: arkforge.tech

3. Service Description

Trust Layer operates in two steps:

1. Forward — The request is transmitted to the target API specified by the user. The response is captured and relayed.
2. Proof — A SHA-256 fingerprint is computed over the full transaction data. Three independent witnesses attest to the proof:

• Ed25519 — ArkForge's cryptographic signature (public key published)
• RFC 3161 TSA Pool — certified timestamp from a WebTrust-accredited pool (FreeTSA → DigiCert → Sectigo).
• Sigstore Rekor — entry in the Linux Foundation's public transparency log, independently auditable by anyone.

Generated proofs are immutable (write-once) and cannot be modified or deleted during their retention period.

4. Pricing

Free Plan

• 500 proofs/month
• 0 EUR — no credit card required
• 3 witnesses (Ed25519, RFC 3161 WebTrust TSA, Sigstore Rekor)
• Full triptych (L1 Digital Stamp, L2 Ghost Stamp, L3 Visual Stamp)

Pro Plan

• 5,000 proofs/month
• 29 EUR excl. VAT / month, billed monthly via Stripe
• All Free plan features
• Optional overage: 0.01 EUR excl. VAT per additional proof (opt-in, configurable cap)
• Dedicated email support

Enterprise Plan

• 50,000 proofs/month
• 149 EUR excl. VAT / month, billed monthly via Stripe
• Optional overage: 0.005 EUR excl. VAT per additional proof
• Data Processing Agreement (DPA) available on request
• Data Processing Agreement (DPA) available on request

Platform Plan

• 500,000 proofs/month
• 599 EUR excl. VAT / month, billed monthly via Stripe
• All Enterprise plan features
• Optional overage: 0.002 EUR excl. VAT per additional proof
• DigiCert timestamping (WebTrust-certified) — FreeTSA bypassed for higher reliability at scale
• API key prefix mcp_plat_

All prices are exclusive of applicable taxes. Prices may be modified with 30 days' notice.

4a. Quota Management and Consumption Responsibility

The monthly quota resets on the 1st day of each calendar month. You may consume your entire monthly quota at any time during the month, including within a few hours, with no throughput restriction imposed by ArkForge.

You are solely responsible for your rate of quota consumption. ArkForge cannot be held liable for premature quota exhaustion, in particular in the event of a misconfigured autonomous agent, infinite loop, or configuration error on your side.

ArkForge sends an email alert when 80% of the monthly quota has been consumed. This alert is provided for informational purposes only; it does not constitute a contractual obligation of result. You are encouraged to implement your own monitoring mechanisms.

Once the monthly quota is exhausted, requests are rejected with HTTP 429. No additional charge is applied unless you have explicitly opted in to overage billing.

5. API Keys and Agent Identity

Access is via API keys in the Authorization header. The X-Agent-Identity header is optional.

You are responsible for the security of your API keys and must not share them with unauthorized third parties.

6. Immutability and Data Retention

Proofs are write-once and cannot be modified or deleted during their retention period.

Retention periods:

• Proofs: 1 year from creation
• Server logs: 90 days
• Billing data: 10 years (statutory requirements)

You are encouraged to download and store your proofs locally. Each JSON proof is self-contained and verifiable independently of ArkForge.

7. Availability and Third-Party Witnesses

The RFC 3161 TSA pool and Sigstore Rekor are independent services operating on a best-effort basis. If one TSA server is unavailable, the next one is tried automatically. If all TSA servers fail, the proof remains valid via Ed25519 and Sigstore Rekor.

ArkForge cannot guarantee the permanent availability of third-party services.

7a. Evidential Value

Proofs generated by Trust Layer have technical evidential value: they cryptographically attest that a transaction occurred at a given time with specific content.

This technical evidential value does not automatically constitute a legally qualified proof.

• All plans: RFC 3161 timestamps are issued by WebTrust-accredited authorities (FreeTSA, DigiCert, or Sectigo — Platform uses DigiCert exclusively). These timestamps carry evidential weight in many jurisdictions but do not constitute a qualified timestamp under eIDAS (Article 42). Their admissibility in legal proceedings depends on applicable law and judicial discretion.

ArkForge does not provide legal advice. For use of proofs in contractual or litigation contexts, consult a qualified lawyer and contact [email protected] for a use-case assessment.

7b. Compliance Reports — Scope and Limitations

The /v1/compliance-report endpoint generates evidence-mapping reports that correlate cryptographic proof fields with the stated requirements of the selected compliance framework. Reports are produced automatically from proof metadata; they do not involve any human review, audit, or professional judgment by ArkForge.

These reports are informational tools, not compliance certifications. Specifically:

• EU AI Act and ISO/IEC 42001:2023 — Reports document alignment between your proof data and regulatory articles or management system clauses. They do not constitute a formal conformity assessment, certification, or attestation issued by a Notified Body, accredited certification body, or any competent authority under the EU AI Act or ISO certification schemes.
• NIST AI RMF 1.0 — Reports document alignment with NIST AI Risk Management Framework subcategories. They do not constitute a formal NIST assessment, endorsement, or validation. NIST does not certify organisations against the AI RMF.
• SOC 2 Readiness — Reports identify potential evidence relevant to AICPA Trust Service Criteria. They do not constitute a SOC 2 Type I or Type II audit opinion. A formal SOC 2 audit opinion requires an independent Certified Public Accountant (CPA) firm registered with and accredited by the American Institute of Certified Public Accountants (AICPA). No readiness report produced by ArkForge, regardless of its contents, may be presented as equivalent to, or a substitute for, a SOC 2 audit report.

ArkForge is not a compliance auditor, certification body, accredited conformity assessment body, or legal or regulatory advisor. The user is solely responsible for determining the applicability, sufficiency, and legal effect of compliance reports for their specific regulatory, contractual, or audit obligations. ArkForge expressly disclaims any liability arising from reliance on compliance reports for regulatory decisions, contractual representations, or legal proceedings.

For questions regarding the use of compliance reports in a specific regulatory context, consult a qualified compliance professional or legal advisor.

8. Liability and Limitation

ArkForge is subject to a best-efforts obligation. ArkForge certifies the existence of a transaction, not its validity or legality.

ArkForge is not liable for: the content of forwarded requests, the availability or performance of target APIs, results returned by target APIs, your use of generated proofs, temporary unavailability of third-party witnesses, or any indirect damages (including loss of profit, data loss, business interruption, commercial harm, or reputational damage).

ArkForge's direct liability is limited to amounts paid by you during the 12 months preceding the event giving rise to the claim. These limitations apply regardless of the nature of the claim.

9. User Obligations and Acceptable Use Policy (AUP)

You agree to use the service lawfully, not to tamper with proofs, not to circumvent quotas or security mechanisms, and to keep your API keys secure.

Acceptable use of the proxy: You warrant that you have the necessary rights and authorizations to call the target API through Trust Layer. You agree not to use the proxy to: call services without authorization, circumvent access controls, scan or attack third-party systems, or exfiltrate unauthorized data.

Violations may result in immediate suspension and reporting to competent authorities.

10. Intellectual Property

• Source code — MIT license (open source)
• Specification — CC BY 4.0 license
• Generated proofs — Belong to you. ArkForge claims no intellectual property rights over proofs generated at your request.

11. Data Protection and GDPR

Trust Layer is designed to minimize personal data collection: request and response bodies are not logged, SHA-256 fingerprints are not directly identifying personal data, and agent identity is optional.

Data processing: When personal data transits through the proxy, ArkForge acts as a Data Processor under Article 28 GDPR. You remain the Data Controller responsible for the lawfulness of transmitted data.

A Data Processing Agreement (DPA) compliant with Article 28 GDPR is available on request for Pro and Enterprise customers: [email protected]

See our Privacy Policy for details.

12. Termination

Paid plans are monthly subscriptions with no minimum commitment. You may cancel at any time from your Stripe customer portal; cancellation takes effect at the end of the current billing period.

Generated proofs remain accessible for 1 year. ArkForge may suspend access for Terms violations.

13. Governing Law and Disputes

These Terms are governed by French law. The parties will seek an amicable resolution before any legal proceedings.

Consumer mediation: CNPM, 27 avenue de la Libération, 42400 Saint-Chamond — cnpm-mediation-consommation.eu

EU Online Dispute Resolution: ec.europa.eu/consumers/odr

14. Right of Withdrawal

Under Article L.221-28 of the French Consumer Code, the right of withdrawal does not apply to digital services that have begun execution with the consumer's express agreement. By subscribing to a paid plan, you agree to immediate service commencement and expressly waive your 14-day right of withdrawal.

15. Force Majeure

ArkForge is not liable for failure to perform obligations due to force majeure events (hosting outage, cyberattack, natural disaster, governmental action, network outage). If the event persists beyond 90 days, either party may terminate without penalty.

16. Reputation Scores and Disputes

Trust Layer may include automated technical reputation scores for target APIs based on objective data. These scores are provided for informational purposes only based on an automated technical method and do not constitute a definitive judgment on any provider's quality.

17. Amendments

ArkForge may amend these Terms with 30 days' notice by email. Continued use of the service after amendments constitutes acceptance.

18. Severability

If any provision is found invalid, the remaining provisions continue in full force and effect.