Non-Disclosure Agreement
Version 1.0.0 · last reviewed 2026-09-19. Structure fixed by legal review; wording subject to final review before launch.
1. Parties and scope
This agreement is between the organisation using the service and the provider. It covers what each side learns through the service: the run inputs, the findings content and any non-public material exchanged during a dispute.
2. What is confidential
- Source code and artefacts submitted for a run. They are never stored; only their hashes remain in the evidence.
- Findings content, encrypted at rest with the organisation's key and readable only by the organisation.
- Dispute dossiers and any non-public material exchanged while a case is open.
3. What is not confidential
Everything published by design: the public Attestation and its signed JSON, the badge and the Trust page, the script catalogue with its specifications, excerpts and implementation hashes, and the fixed statement block.
4. Obligations of the provider
- No retention of source code after a run.
- Every access to evidence is logged and the log is kept 400 days.
- No disclosure of findings content to anyone outside the organisation.
- Full script source is disclosed only to identified subscribers and each disclosure is logged.
5. Obligations of the customer
No redistribution of full script source obtained through disclosure.
Final text pending legal review.
6. Duration
Final text pending legal review.
7. Legal hold
A dispute at level dispute or legal-threat keeps the related evidence under legal hold until the case is closed.
8. Governing law and forum
Governing law: Spain. Forum: the courts of the city of the provider's registered office (Spain). Enterprise customers in the United States may opt for arbitration seated in Madrid, conducted in English.
Remedies and carve-outs
Remedies for breach and carve-outs for disclosures required by a legal order: final text pending legal review.