Terms of Service

Effective date: October 1, 2026.

Print or save as PDF

In short

• These Terms cover everything we run under triauth.org and its subdomains: this website, the hosted Triauth Authenticator at auth.triauth.org, and every other service we offer there.
• If you self-host our software, these Terms do not apply to your instance. Your copy is governed by its license, and you are the provider of your instance to its users.
• Your authentication key lives in your browser and your identity lives in the DNS. We hold neither, so we cannot recover them. Enroll more than one device, and keep control of your domain.
• The services provided by us are offered as they are and as available. We may change them or shut them down.
• To the maximum extent the law allows, we are not liable for any loss arising from or in connection with the services. If you are a consumer, nothing here takes away the rights your local law guarantees you.
• This summary is for convenience only, and the full text below is what applies.

1. Who we are and what these Terms cover

1.1 Provider. The services described in these Terms are provided under the Triauth project. In these Terms, "we", "us" and "our" mean the person or entity that operates the Triauth project and is your contracting party under these Terms, as identified in Section 24. The person or entity operating the Triauth project may change as described in Section 23.4.

1.2 Scope. These Terms of Service (the "Terms") govern your access to and use of all websites, web applications, APIs, documentation, developer tools, sandboxes and other online services that we make available: (a) under the domain triauth.org and any of its subdomains, for example www.triauth.org, auth.triauth.org and play.triauth.org; (b) under any other domain that we operate and that links to or refers to these Terms; and (c) under your own hostname, where you point it at our infrastructure as described in Section 5.8 (together, the "Services").

1.3 Service-Specific Terms. A Service may be subject to additional terms, plans or policies that we publish for it and that expressly state that they supplement these Terms ("Service-Specific Terms"). They form part of these Terms and prevail over them in case of conflict, for that Service only. Our privacy policy, available at www.triauth.org/legal/privacy (the "Privacy Policy"), explains how personal data is handled.

1.4 What these Terms do not cover. These Terms do not govern: (a) software that we publish under a separate license, such as Triauth Authenticator (Elastic License 2.0) or the triauth client libraries (Apache License 2.0), when you download, copy, modify, build, run or distribute it yourself, which is governed by that license; (b) instances of such software hosted by you or by anyone other than us ("Self-hosted Instances"); and (c) any website, application or service operated by a third party, even if it uses the Protocol, links to the Services, or is listed on the Website. See Sections 10 and 11.

2. Definitions

In these Terms, the terms below have the meanings given to them here. Terms defined in bold elsewhere in these Terms have the meaning given to them there. Words in the singular include the plural and vice versa.

• "Protocol" means the triauth protocol, the evolving technical specification that we publish on the Website and in other materials.
• "Website" means the websites at triauth.org and www.triauth.org.
• "Hosted Authenticator" means the instance of the Triauth Authenticator application that we host and operate at auth.triauth.org, or at any other address we designate, which lets you manage Identifiers and Keys in your web browser and approve requests from Relying Parties.
• "Hosted Services" means every Service other than the Website, including the Hosted Authenticator, the playground and sandboxes.
• "Software" means the Triauth Authenticator computer program, the triauth client libraries and any other software that we publish under a separate license.
• "Relying Party" means any website, application or service, whether operated by you or by a third party, that uses the Protocol to authenticate users or perform any other Protocol-related operations.
• "Identifier" means a triauth personal identifier in the form username@domain.
• "Identity Records" means the DNS records that publish information about an Identifier or a domain, including public keys and endpoint configuration.
• "Keys" means the cryptographic keys generated and stored on your device through the Hosted Authenticator, including keys held by platform authenticators or hardware security keys.
• "Lookup Code" means a code used under the Protocol's private mode to derive the location of Identity Records.
• "Domain Administrator" means the person or entity that controls the DNS zone of the domain part of an Identifier.
• "Consumer" means a natural person who uses the Services for purposes outside their trade, business, craft or profession, and any other person to whom applicable law extends consumer protection, to the extent of that protection.
• "Business User" means anyone who is not a Consumer, including anyone who uses the Services on behalf of a company, organization or other entity.
• "you" means the person using the Services and, if you use them on behalf of an entity, that entity as well.
• "Affiliate" means any entity that controls, is controlled by, or is under common control with us.

3. Agreement, contract, and how to end it

3.1 Acceptance. You agree to these Terms by accessing or using the Services, by ticking a box or clicking a button that refers to them, or by configuring a domain to use a Hosted Service, for example by publishing a DNS record, such as a TXT or CNAME record, that points to auth.triauth.org. If you do not agree, do not use the Services. If you use the Services on behalf of an entity, you represent that you are authorized to bind it.

3.2 Contract. These Terms form a contract for the provision of services by electronic means, within the meaning of the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means, between you and us. The contract is concluded when you first use a Service and continues for an indefinite period, for as long as you use the Services.

3.3 Ending the contract. You may end the contract at any time, with immediate effect and free of charge, by ceasing to use the Services. If you wish, you can also remove any DNS records under your control that point to the Hosted Services, and the data that the Hosted Authenticator stores in your browser, through the application or your browser settings. We may suspend the Services or end the contract as described in Section 13.

3.4 Availability of these Terms. These Terms are available free of charge at https://www.triauth.org/legal/terms, before and during your use of the Services, in a form that lets you download, save and print them. Earlier versions are available on request.

3.5 Language. These Terms are drafted in English. We may provide translations. If a translation conflicts with the English version, the English version prevails, unless the mandatory law of your country requires otherwise.

4. Who may use the Services

4.1 Age. You must be at least 16 years old to use the Services. If you are between 13 and 16, you may use the Services only if your parent or legal guardian has reviewed and agreed to these Terms on your behalf, supervises your use, and accepts responsibility for it. The Services are not directed to children under 13, and children under 13 may not use them.

4.2 Capacity and eligibility. You must have the legal capacity to enter into this contract, and you must not be barred from using the Services under any applicable law, including the sanctions and export control laws described in Section 23.6.

4.3 Organizations and Domain Administrators. Identifiers under a domain are ultimately controlled by that domain's Domain Administrator, who can publish, change or remove Identity Records and endpoint configuration at any time. If you use an Identifier under a domain that you do not control, you accept that the Domain Administrator can revoke or take over it, and that we have no role in your relationship with them. If you are a Domain Administrator, you are responsible for the Identifiers you issue and for the persons who use them, and you must not issue Identifiers that infringe the rights of others, mislead, or impersonate.

5. The Services

5.1 The Website. The Website provides information about the Protocol, documentation, guides, and other materials. Its contents are provided for general information only. They are not legal, security or other professional advice, and they may be incomplete, outdated or wrong (see Section 14). Links to external websites are covered by Section 10.3.

5.2 The Hosted Authenticator. The Hosted Authenticator is the reference installation and instance of Triauth Authenticator that we host for your convenience, including under the auth.triauth.org domain. Triauth Authenticator is a client-side web application, and we operate no user accounts for it. We do not receive, store or back up your Keys, Lookup Codes, private profile, or the identities and Relying Parties you use, and we cannot reset, recover, transfer or revoke any of them. Its features may change at any time.

5.3 Playground and developer tools. We may offer a playground, sandboxes, demo Relying Parties or other developer tools that let you try the Protocol. They are for testing only. Do not use them with any real data that should remain secret or depend on them in your production environment. Expect any data in them to be deleted at any time without notice.

5.4 Future Services. We may add further Services under these Terms. Unless Service-Specific Terms say otherwise, these Terms apply to each such Service from the moment we make it available.

5.5 Pre-release Services. Services that we label alpha, beta, preview or similar ("Pre-release Services") may change substantially, lose data, or be withdrawn subject to Section 13.4. They are provided for early access and evaluation. By using a Pre-release Service you expressly acknowledge these limitations, use it at your own risk, and agree to keep an independent way to access anything that depends on it.

5.6 Price. The Services are provided free of charge unless Service-Specific Terms for a Service provide otherwise. You bear your own costs of internet access, devices, and domain registration. If we introduce paid Services or plans, their price and conditions will be set out in Service-Specific Terms, and nothing will be charged without your prior, express agreement.

5.7 Not a trust service, identity provider or identity verification. We are not a certification authority, trust service provider, identity provider or identity verification service. The Services do not verify your legal identity, name, age or any other attribute. Authentication under the Protocol does not establish who was in control of the device that approved a request. Signatures, authentications, attestations, stamps and pings as named in the Protocol, or produced with the Hosted Authenticator, or any other Service, are not qualified electronic signatures, seals or time stamps within the meaning of Regulation (EU) No 910/2014 (eIDAS), as amended, or of any comparable law. We make no representation about their legal effect, which depends on applicable law and on whether the Relying Party accepts them. The Services are not designed to satisfy industry-specific regulatory requirements (such as HIPAA, PCI DSS or eIDAS assurance levels), and you must not use them where such compliance is required.

5.8 Custom hostnames. If a Hosted Service allows you to point your own domain at our infrastructure (for example, with a DNS CNAME record), the application when provided by us under such domain remains a Hosted Service. You authorize us to serve the Service and to obtain TLS certificates for that domain. You remain responsible for the domain, its registration and DNS configuration, including any records needed for certificate issuance, and for not using the same hostname for any other purpose, because the security of the Keys enrolled under it depends on that.

5.9 Support. We do not promise any support, maintenance, updates or bug fixes. We may offer community support through GitHub issues or email at our discretion.

6. Technical requirements and what happens on your device

6.1 Requirements. To use the Services you need: a device with a current version of a modern web browser that supports JavaScript, the Web Crypto API, IndexedDB and local storage, and, for biometric or hardware-key sign-in, the WebAuthn API with a compatible platform or hardware authenticator; an internet connection; and, to set up an Identifier, the ability to publish DNS TXT records for a domain that you own or control. The Hosted Authenticator must be used directly at the address from which we serve it, and it cannot be embedded in other pages.

6.2 Data stored on your device. Some Services may store data on your device. In particular, the Hosted Authenticator may store on your device, in your browser's storage for its origin: your Identifiers, Keys and their metadata, your private profile, preferences, a cached copy of its files so that it can work in offline mode, and other data the application needs to work. You can remove such data at any time through your browser settings, but removing it may break the functionality of such Service. In particular, clearing the data stored by the Hosted Authenticator deletes the Keys held there, and you will no longer be able to sign in from that device until you set it up again.

6.3 Third-party infrastructure. The Services depend on infrastructure and services that we do not control, including your browser and operating system, hosting and content delivery providers, the Domain Name System, and public DNS-over-HTTPS resolvers. Their availability, behavior and terms may affect the Services.

7. Your responsibilities

7.1 Your domain. Your Identifier depends on your domain. You are solely responsible for registering, renewing and securing your domain; for the DNS records you publish, including their accuracy and for enabling DNSSEC where available; for choosing your registrar and DNS provider; and for controlling who else can change your zone. If your domain expires, is transferred, hijacked or misconfigured, your Identifier and every sign-in that depends on it may stop working or fall under someone else's control, and we cannot help.

7.2 Your devices and Keys. You are solely responsible for the security of the devices and browsers on which you use the Hosted Authenticator, including locking them, keeping them free of malware, keeping the browser up to date, and controlling who can use them. Anyone who can use your device or browser profile may be able to approve requests as you.

7.3 Backups and continuity. We hold no copy of your Keys, so you must take your own precautions against losing access. In particular, you should enroll more than one device, keep an alternative way to reach any Relying Party account that matters to you, and pay attention to warnings that the application shows about browser storage. Browsers may delete stored data, for example after a period of inactivity or to free space, and we have no way to prevent or reverse that.

7.4 Switching endpoints. Keys are bound by design to the web origin from which the Hosted Authenticator is served, so that they cannot be used from anywhere else. If you move your Identifier to another authentication endpoint, for example a Self-hosted Instance, or if we discontinue or relocate the Hosted Authenticator, you will need to enroll your devices again with the new endpoint and update your Identity Records.

7.5 Reviewing requests. You are responsible for reviewing every request before you approve it, including the address of the Relying Party shown, and for your relationship with each Relying Party.

7.6 Compliance and delegated use. You must use the Services in compliance with applicable law and these Terms, and you are responsible for anyone you allow to use the Services on your behalf.

8. Understanding the risks

Using services provided over the internet involves risks. Particular risks of using the Services include: phishing and social engineering aimed at making you approve a request you did not intend to; malware, browser extensions or other software on your device that may read, alter or misuse data, including Keys; loss, theft or failure of a device; loss of stored data through browser storage eviction, browser resets, operating system reinstalls or user error; loss of a Lookup Code; DNS attacks such as spoofing, cache poisoning or hijacking, especially for domains without DNSSEC; domain expiry, transfer or takeover; unavailability or misbehavior of third-party infrastructure; and defects in the Protocol, the Services or the Software. By using the Services you accept these risks.

9. Acceptable use

You must not, and must not allow or help anyone else to:

• (a) use the Services in violation of any applicable law, or for any unlawful, fraudulent or harmful purpose, including impersonating any person or entity, or using an Identifier or domain that misleads others about who you are;
• (b) provide, transmit or publish unlawful content through the Services, or use them to store or convey anything that infringes the rights of others;
• (c) probe, scan or test the vulnerability of the Services, or breach or circumvent any security or authentication measure, except with our express prior written permission;
• (d) interfere with or disrupt the Services or the infrastructure they run on, including through excessive or automated requests, denial-of-service attacks, or the introduction of malware;
• (e) access the Services by any means other than the interfaces we provide, or scrape, crawl or copy the Services or their content in bulk, except as the Website's robots exclusion file permits;
• (f) embed, frame, proxy or re-serve the Hosted Services under another origin, or present them as your own product or service;
• (g) use the Services to provide the Software to third parties as a hosted or managed service, or otherwise in violation of the license of the Software;
• (h) remove, obscure or alter any notice of ownership, license or attribution;
• (i) use the Services for any activity in which their failure could lead to death, personal injury, or severe physical or environmental damage, including medical, life-support, nuclear, aviation, transport-control, weapons or similar systems ("High-Risk Use");
• (j) use the Services in violation of the sanctions or export control laws described in Section 23.6.

We may investigate suspected violations, take any measure we consider appropriate, and cooperate with authorities.

10. Third parties: Relying Parties, providers and listings

10.1 Relying Parties. The Hosted Authenticator lets you interact with Relying Parties that we do not operate or control. We are not a party to your relationship with them. We do not vet them, and we are not responsible for their identity, security, content, practices or availability, for what they do with the results of authentications, signatures, attestations or any other Protocol or Service operation, or for any account you hold with them. Showing a Relying Party's address, name or icon in the Hosted Authenticator does not mean that we endorse or have verified it.

10.2 Verification providers and other third-party services. A Relying Party may ask you to complete steps with third-party providers, for example to obtain an attestation. Those providers, and any other third-party service, website or software that you use with the Services, are governed by their own terms and privacy policies, for which we take no responsibility.

10.3 Directory listings and links. The "Where can I use it?" directory and other links on the Website are provided for convenience only. A listing or link does not mean that we endorse, control or have any relationship with the listed or linked service, or that it works with the Services. We do not monitor, verify or scan external websites, we are not responsible for their content, accuracy, security or practices, and you follow links to them at your own risk. We may add or remove listings and links at our discretion.

11. Building on triauth: developers, Relying Parties and self-hosting

11.1 Software licenses. If you download, build, fork, run or distribute the Software, including a Self-hosted Instance of Triauth Authenticator or the client libraries, the applicable license governs, and these Terms do not change it. In particular, the Elastic License 2.0 does not allow providing Triauth Authenticator to third parties as a hosted or managed service. If you operate a Self-hosted Instance, you are its provider towards its users, and you alone are responsible for its terms, privacy notice, security, availability and updates.

11.2 Relying Parties you operate. If you use the Protocol, the Software or the Hosted Services in a website, application or service that you operate, you are solely responsible for your implementation, including following the security guidance we publish; for verifying responses correctly; for the sessions and accounts you grant; for your users; for your compliance with applicable law, including data protection law, under which you act as an independent controller; and for any harm caused by your service. You must not state or imply that we operate, sponsor, endorse or guarantee your service, or that we bear any responsibility for it.

11.3 Hosted Services as a dependency. If you rely on a Hosted Service in your own product, for example by loading any asset files from it, linking to it, or directing your users to it, you accept that the Hosted Service may change, be limited or be discontinued, that it comes with no service level, and that you are responsible for maintaining a way to migrate away from it if needed.

11.4 Compatibility statements. Any conformance, compatibility or "works with triauth" statement you make is your own, unless we have granted you a written trademark license.

11.5 Listings, features and programs. We may feature Relying Parties, integrations, libraries and other projects on the Website, in news posts and in other materials, and we may run promotional, partner, referral or similar programs from time to time. Announcements inviting you to be listed or to take part are invitations, not offers. We decide at our discretion whether, how and for how long to feature anything, we may edit or remove a listing or post at any time, and no fee, compensation or other obligation arises unless Service-Specific Terms say so. If you submit material for a listing or feature, you grant us a non-exclusive, worldwide, royalty-free, transferable and sublicensable license to use your name, marks, logos, screenshots, descriptions and other submitted material to feature and promote your project and the Protocol on the Website, in news posts and in our other materials, in all fields of exploitation known at the time of submission, including reproduction, adaptation for layout, distribution and making available to the public. You can ask us at any time to stop featuring your project, and we will remove the listing within a reasonable time. For material that we have already published, including news posts and archives, the license continues and cannot be terminated. You represent that you have the rights needed to grant this license, that the information you provide is accurate and not misleading, and that your integration works as described, and you will tell us if that changes. A listing or feature is not an endorsement, certification or partnership, and you must not present it as one. Any program that we run is governed by its own rules, which are Service-Specific Terms.

12. Intellectual property

12.1 Our rights. All our intellectual property rights in the Services, the Website content, the Software, the documentation, the Protocol specification and all related materials, are reserved, except as expressly stated in these Terms or in the license that accompanies the Software or a document.

12.2 Your license to use the Services. Subject to these Terms, we grant you a limited, revocable, non-exclusive, non-transferable and non-sublicensable right to access and use the Services for their intended purpose, and to copy the documentation for your own reference. This right ends when these Terms or your use of the Services end.

12.3 Implementing the Protocol. These Terms do not restrict you from integrating the Protocol into a website, application or service that you operate, using the Software under its license or your own code, subject to Section 11. No license under any patent, trademark or other intellectual property right of ours is granted by implication, estoppel or otherwise, including through your use of the Services. Any license to our patents is granted only as set out in the license files that accompany the Software, or in a separate written agreement.

12.4 Trademarks. "triauth", the ⠕ mark, the "⠕ Sign in with triauth" button, and our logos are our trademarks, and may be registered in certain jurisdictions. You may use the word "triauth", and the "⠕ Sign in with triauth" button unaltered, to state truthfully that your service supports the Protocol. You must not use our marks in a way that suggests affiliation, sponsorship or endorsement, as part of your own product, company or domain name, or in a way that damages them. Any other use requires our prior written permission.

12.5 Feedback. If you send us feedback, bug reports, suggestions or ideas, you grant us a non-exclusive, perpetual, irrevocable, worldwide, royalty-free, transferable and sublicensable license to use them for any purpose, in all fields of exploitation known at the time you send them, including reproduction, storage, modification and the creation of derivative works, distribution, public communication and making available to the public, without any obligation to you.

12.6 Data you provide. You retain all rights in any data or content that you submit to a Hosted Service. To the extent a Hosted Service stores or processes such data or content, you grant us, our Affiliates, and our and their successors and assigns a non-exclusive, worldwide, royalty-free license to reproduce, store, modify, transmit, display, make available and otherwise process it, in all fields of exploitation known at the time you submit it, solely as needed to provide, secure, maintain and improve the Services and to comply with law, for as long as you use the Service and for a reasonable period afterwards for backups. You represent that you have the rights needed to grant this license. This does not concern Keys or other data that stays on your device, which we never receive. Personal data is governed by the Privacy Policy.

12.7 Third-party components. The Software and the Services may include third-party components under their own licenses, listed in the notices that accompany them.

12.8 Copyright complaints. If you believe that content on the Services infringes your copyright, email legal@triauth.org with the information needed to identify the material and your rights.

13. Changes to the Services, suspension and discontinuation

13.1 Continuous change. The Services are under active development. We may change them at any time, including by adding, modifying or removing features; changing the Protocol; changing technical requirements; changing addresses, for example by moving the Hosted Authenticator to another hostname; or changing third-party providers. Where a change materially reduces the functionality of a Hosted Service that you use, we will try to inform you in advance through the Website or the Service, but changes required for security, legal or technical reasons, or by events beyond our control, may take effect immediately.

13.2 No commitment to availability. We provide the Services on a best-effort basis, without any service level commitment. The Services may be unavailable, slow or degraded because of maintenance, updates, capacity limits, failures of third-party infrastructure, attacks, or any other reason, with or without notice.

13.3 Suspension and restrictions. We may suspend, restrict, rate-limit or block access to the Services, in whole or in part, for you, for a domain, for a network or for everyone, with immediate effect and without prior notice, where we consider it reasonably necessary, in particular: (a) if you breach these Terms or applicable law, or we reasonably suspect that you do; (b) to protect the security, integrity or availability of the Services, other users or third parties; (c) to comply with a legal requirement, court order or request of an authority; (d) where traffic is abusive, automated or excessive; or (e) where continuing would expose us to liability. We will lift the measure when its cause has been resolved, where feasible.

13.4 Discontinuation. We may discontinue any Service, or all of them, permanently, for important reasons, including: economic or business reasons, including the cost of running a Service; technical, security or legal reasons; changes in law or in third-party services we rely on; or a decision to end or reorganize the Triauth project. We will announce the discontinuation of a Hosted Service at least 30 days in advance on the Website or in the Service concerned, except where shorter or no notice is unavoidable, for example for security or legal reasons or because of events beyond our control, in which case we will give as much notice as the circumstances allow. After discontinuation the Service can no longer be used, and, as described in Section 7.4, Keys bound to a discontinued Hosted Authenticator origin will no longer be usable.

13.5 Your remedies. You are not entitled to any compensation for changes, unavailability, suspension or discontinuation, other than any right that mandatory law gives you as a Consumer. Your remedy is to stop using the Service and, if you wish, to move to a Self-hosted Instance or another provider.

13.6 Termination for breach. We may terminate the contract with you with immediate effect if you materially breach these Terms and, where a remedy is possible and notice is practicable, do not remedy the breach within a reasonable time after notice, or if the law requires us to. Provisions that by their nature should survive, including Sections 11.5, 12, 14, 15, 16, 19, 20, 21 and 23, survive termination.

14. Disclaimer of warranties

14.1 THE SERVICES, THE WEBSITE, THE PROTOCOL, THE SOFTWARE AS MADE AVAILABLE THROUGH THE SERVICES, AND ALL RELATED CONTENT AND MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITH ALL FAULTS, AND WITHOUT WARRANTY OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM ALL WARRANTIES, CONDITIONS, REPRESENTATIONS AND GUARANTEES, WHETHER EXPRESS, IMPLIED, STATUTORY OR ARISING FROM COURSE OF DEALING OR USAGE OF TRADE, INCLUDING ANY WARRANTY OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AVAILABILITY OR SECURITY, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED, TIMELY, ERROR-FREE OR FREE OF HARMFUL COMPONENTS.

14.2 In particular, and without limiting Section 14.1: computer software, networking, cryptography and security are complex and evolving fields, and we make no representation or warranty that the Protocol, the Services or the Software are secure, correct, complete or resistant to any attack; that any authentication, signature, attestation, stamp, or other result obtained through the use of the Protocol, the Services, or the Software is genuine, valid, timely or has any legal effect; that DNS data is accurate or has not been tampered with; that any Relying Party is who it claims to be; that data stored on your device will persist; that the Services will meet your requirements or be available at any time or place; or that any information on the Website is accurate, complete or current. The Services are not designed or intended for High-Risk Use. Any statement about security properties describes design goals, not a guarantee.

14.3 No advice or information, whether oral or written, obtained from us or through the Services, including documentation, READMEs, release notes and marketing materials, creates any warranty that is not expressly stated in these Terms.

14.4 Nothing in this Section limits any warranty or right that applicable law does not allow to be limited, including the rights of Consumers described in Section 20.

15. Limitation of liability

15.1 Exclusion of certain damages. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL WE, OUR AFFILIATES, OUR AND THEIR SUCCESSORS AND ASSIGNS, OR OUR AND THEIR RESPECTIVE OWNERS, OFFICERS, EMPLOYEES, CONTRACTORS, AGENTS, SUPPLIERS AND LICENSORS (TOGETHER, THE "TRIAUTH PARTIES") BE LIABLE TO YOU OR TO ANYONE ELSE, UNDER ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, WARRANTY, STATUTE OR OTHERWISE, FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES; FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, OPPORTUNITY OR ANTICIPATED SAVINGS; FOR ANY LOSS OR CORRUPTION OF DATA; FOR ANY LOSS OF USE, OR LOSS OF OR INABILITY TO ACCESS ANY IDENTIFIER, KEY, LOOKUP CODE, DEVICE, DOMAIN OR THIRD-PARTY ACCOUNT; FOR ANY UNAUTHORIZED ACCESS TO OR USE OF ANY ACCOUNT OR DATA; FOR THE COST OF SUBSTITUTE SERVICES; OR FOR ANY DAMAGE ARISING FROM ANY RELYING PARTY, DOMAIN ADMINISTRATOR, THIRD-PARTY SERVICE OR THIRD-PARTY CONDUCT, OR FROM ANY HIGH-RISK USE, IN EACH CASE ARISING OUT OF OR IN CONNECTION WITH THE SERVICES, THE PROTOCOL, THE SOFTWARE OR THESE TERMS, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

15.2 Cap. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF THE TRIAUTH PARTIES FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE SERVICES, THE PROTOCOL, THE SOFTWARE OR THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US FOR THE SERVICE GIVING RISE TO THE CLAIM DURING THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY, AND (B) ONE HUNDRED EUROS (EUR 100).

15.3 Basis of the bargain. You acknowledge that the exclusions and limitations in Sections 13, 14, 15 and 16 are a fundamental basis of our offering the Services at all, that they allocate risk between us fairly in view of the price, and that we would not provide the Services without them.

15.4 Exceptions. Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under applicable law, including liability for damage caused intentionally, for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, for gross negligence where applicable law does not allow it to be excluded, or any liability towards Consumers that mandatory law imposes. In those cases, the exclusions and limitations apply to the fullest extent that the law allows.

15.5 Consumers. If you are a Consumer, Sections 15.1 and 15.2 limit our liability for non-performance or improper performance of the contract only to the extent that the mandatory law of your country of habitual residence allows. Subject to mandatory law, we are not liable for any loss that was not a foreseeable consequence of our breach when the contract was concluded, or that results from your breach of these Terms, from your failure to follow Section 7, or from the acts or omissions of third parties.

16. Indemnification

If you are a Business User, you will defend, indemnify and hold harmless the Triauth Parties from and against all claims, demands, proceedings, losses, damages, liabilities, costs and expenses, including reasonable legal fees, arising out of or relating to: (a) your use of the Services; (b) any website, application, service, Self-hosted Instance or implementation of the Protocol that you operate or distribute; (c) any Identifier you issue or domain you administer; (d) your content or data; (e) your breach of these Terms or of applicable law; or (f) any dispute between you and a Relying Party, Domain Administrator, user or other third party. We may assume the defense and control of any matter subject to indemnification, at your expense, and you will not settle any claim in a way that imposes obligations on us without our written consent. If you are a Consumer, this Section applies only to the extent permitted by the mandatory law of your country of habitual residence, and never beyond your liability under general law for damage caused by your unlawful conduct.

17. Security research and vulnerability disclosure

If you discover a vulnerability in the Protocol, the Services or the Software, please report it to security@triauth.org, as described in the security policy published in our source code repositories at github.com/triauth. We appreciate every report. We do not currently operate a paid bug-bounty program. Asking you to report vulnerabilities is not, by itself, permission to test the Services for them. The Services are shared infrastructure that other people rely on, so penetration testing, stress or load testing, attempts to breach or circumvent security measures, and any other security testing of the Services require our express prior written permission.

18. Privacy

Our Privacy Policy describes what data we, and the third parties we rely on, process when you use the Services, and what rights you have. If you are a Domain Administrator or operate a Relying Party, you are an independent controller of the personal data you process, including the data you publish in DNS. Information published in Identity Records is public by nature. Do not publish data in DNS that you do not want to be public.

19. Complaints

19.1 How to complain. You may submit a complaint about the Services by email to support@triauth.org or by post to our address in Section 24. Please describe what the complaint concerns, what happened and when, which Service and which domain or Identifier it involves, and how we can contact you.

19.2 Our response. We will respond to a Consumer complaint within 14 days of receiving it. If we need more information to consider it, we will ask you for it without delay.

20. Consumers

20.1 Mandatory rights. If you are a Consumer, you benefit from the mandatory consumer protection provisions of the law of the country in which you habitually reside. Nothing in these Terms limits those rights. Any provision of these Terms that would limit them does not apply to you to that extent, and the rest of these Terms remain in force.

20.2 Right of withdrawal. As required by applicable law, if you are a Consumer, you may withdraw from the contract within 14 days of concluding it, without giving any reason, by sending us an unequivocal statement, for example an email to support@triauth.org. You may use the following model, but you do not have to: "I hereby withdraw from the contract for the provision of the following service: [name of the Service]. Contract concluded on: [date]. Name: [name]. Address: [address]. Date: [date]." You may also end the contract at any time under Section 3.3.

20.3 Out-of-court dispute resolution. Consumers in the European Union may use out-of-court complaint and redress mechanisms. In Poland, the Office of Competition and Consumer Protection publishes the available bodies at www.uokik.gov.pl. Unless the law requires otherwise, we do not undertake in advance to take part in proceedings before a particular out-of-court body; we decide case by case, and we will state our position in our response to your complaint.

21. Governing law and disputes

21.1 Governing law. These Terms, and any dispute or claim, contractual or non-contractual, arising out of or in connection with them, the Services, the Protocol or the Software, are governed by the laws of the Republic of Poland, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. If you are a Consumer, this choice does not deprive you of the protection of the mandatory provisions of the law of your country of habitual residence (Section 20.1).

21.2 Courts. Any dispute is subject to the exclusive jurisdiction of the Polish common courts having jurisdiction over the registered office of the entity named in Section 24, except where a mandatory jurisdiction rule that cannot be excluded provides otherwise, including a Consumer's right under such a rule to bring proceedings before, or to be sued only before, the courts of the Consumer's own country. We may bring claims for infringement of our intellectual property rights before any court of competent jurisdiction.

21.3 Informal resolution first. Before starting proceedings, a Business User must, and a Consumer is encouraged to, contact us at legal@triauth.org and give us 30 days to try to resolve the matter.

21.4 Injunctive relief. Notwithstanding Section 21.2, we may seek injunctive or other urgent relief in any court of competent jurisdiction to protect our intellectual property rights or the security of the Services.

21.5 Users in the United States. If you reside in the United States, the following also applies to the fullest extent permitted by law. (a) Jury trial waiver. YOU AND WE EACH WAIVE ANY RIGHT TO A JURY TRIAL in any proceeding arising out of or relating to these Terms or the Services. (b) Class action waiver. YOU AND WE EACH AGREE THAT ANY PROCEEDING WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, CONSOLIDATED, COLLECTIVE OR REPRESENTATIVE ACTION, and each of us waives the right to participate in one. If this waiver is held unenforceable for a particular claim, that claim will be severed and will proceed individually in court, and the remainder of this Section stays in force. (c) Forum. You agree that the forum selection in Section 21.2 applies to you and that it is reasonable given that we are established in Poland. (d) New Jersey residents. Sections 14, 15 and 16 are intended to be only as broad and inclusive as the law of the State of New Jersey permits, and nothing in them limits any liability that cannot be limited under that law, including liability for gross negligence or willful misconduct and liability under the New Jersey Consumer Fraud Act, Products Liability Act, Punitive Damages Act and Uniform Commercial Code; the waivers in this Section 21.5 apply to you to the extent that New Jersey law permits. (e) California residents. Under California Civil Code Section 1789.3, you may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210. The Services are provided by the entity named in Section 24 and are free of charge unless Service-Specific Terms provide otherwise; complaints may be sent to support@triauth.org.

22. Changes to these Terms

22.1 Reasons. We may amend these Terms for important reasons, including: a change in applicable law or in its interpretation, or a decision of a court or authority; a change to the Services, including new, changed or removed features, or new Services; a change in technical requirements or in the third-party services we rely on; a change to our business, organization or identification data, a transfer of the Services to a successor under Section 23.4, the migration of the Services to a successor's platform, or the replacement of these Terms with a successor's terms; security reasons; the correction of errors, ambiguities or omissions; and changes that do not reduce your rights.

22.2 Notice. We will publish the amended Terms at https://www.triauth.org/legal/terms with a new effective date. Changes that materially affect your rights or obligations will be announced at least 14 days before they take effect, on the Website or in the Hosted Service concerned, and by email if we have your address and you have subscribed to such updates. Changes required by law or for security reasons, and changes that only add features or that benefit you, may take effect immediately.

22.3 Your options. If you do not agree with a change, stop using the Services before it takes effect (Section 3.3). Continued use after the effective date means that you accept the amended Terms. For a Consumer, an amendment does not affect rights acquired before it takes effect.

23. General provisions

23.1 Entire agreement. These Terms, together with the Privacy Policy and any Service-Specific Terms, are the entire agreement between you and us regarding the Services and supersede any earlier agreement about them. They do not affect the licenses of the Software.

23.2 Severability. If any provision of these Terms is held invalid or unenforceable, it will be enforced to the maximum extent permissible, and the remaining provisions remain in full force.

23.3 No waiver. Our failure to enforce any provision is not a waiver of it.

23.4 Assignment and successors. We may transfer our rights and obligations under these Terms, in whole or in part, to an Affiliate, or to a successor in connection with a merger, reorganization, change of control, or a sale or transfer of all or substantially all of the assets of the Triauth project or of the Services, provided that your rights under these Terms are not reduced. You consent in advance to any such transfer. We will inform you of it as described in Section 22.2, and you may end the contract at any time. These Terms bind and benefit the parties and their respective successors and permitted assigns. You may not assign or transfer these Terms without our written consent; any attempt to do so is void.

23.5 Force majeure. We are not liable for any failure or delay caused by events beyond our reasonable control, including natural disasters, war, terrorism, riots, epidemics, government action, labor disputes, failures of the internet, DNS, hosting or telecommunications providers, power outages, or attacks on the Services.

23.6 Export controls and sanctions. The Services and the Software may be subject to the export control and sanctions laws of the European Union, Poland, the United States and other jurisdictions, including laws governing cryptographic software. You represent that you are not located in, and are not a national or resident of, a country or territory subject to a comprehensive embargo; that you are not listed on any sanctions list, such as the consolidated list of the European Union or the Specially Designated Nationals list of the U.S. Office of Foreign Assets Control; and that you will not use or export the Services or the Software in violation of those laws.

23.7 Notices. Formal legal notices to us must be sent by registered mail or courier to our postal address in Section 24, with a courtesy copy by email to legal@triauth.org; an email alone is not a legal notice. This does not apply to complaints, withdrawal statements, data protection requests and other everyday communications, which you may send by email as described in these Terms. Notices to you may be given on the Website, in the Hosted Service concerned, or by email or post if you have provided an address.

23.8 Third parties. Except for the rights of the Triauth Parties under Sections 15 and 16, these Terms create no rights for third parties.

23.9 Relationship. Nothing in these Terms creates a partnership, joint venture, agency, employment or fiduciary relationship between you and us.

23.10 Interpretation. Headings are for convenience only. "Including" means "including without limitation". References to Sections are to sections of these Terms.

23.11 Electronic communications. You agree that we may communicate with you electronically, and that electronic communications satisfy any legal requirement that a communication be in writing, to the extent the law allows.

23.12 Location. We are established in Poland. We make no representation that the Services are appropriate or available for use in any particular location, and you are responsible for compliance with local laws where you use them.

24. Contact

The Triauth project is currently maintained by Shore Labs Zbigniew Zemła, registered in the Polish Central Register and Information on Economic Activity (CEIDG), with its registered office at ul. Poprzeczna 11, 40-654 Katowice, Poland, tax identification number (NIP) 6772286301, statistical number (REGON) 241404765. This is the provider of the Services and your contracting party under these Terms, and the address for postal notices. You can reach us by email at support@triauth.org.