Terms of use.
What a Satsignal proof does and does not establish, what the service is and isn’t, and what you’re responsible for — in plain language. The scope wording on the trust FAQ and inside the verifier is authoritative for what a proof means; this page is the formal restatement and uses the same words on purpose.
DRAFT v0.1 — prepared 2026-06-11, pending counsel review. Every section below is a complete working draft, published so customers and procurement reviewers can see the intended terms before a lawyer finalizes them. This draft has not been reviewed by counsel, it may change, and where it conflicts with a signed agreement between you and Satsignal LLC, the signed agreement controls. Square-bracketed items are open points for counsel. Questions: hello@satsignal.cloud.
A tamper-evidence and timing service.
Satsignal anchors a SHA-256 fingerprint of your input — a
file, an agent run, a policy snapshot, a manifest, or arbitrary
bytes — to the public Bitcoin SV chain, and returns a
verifiable proof: an .mbnt bundle you keep. The
on-chain entry (the anchor) cannot be edited, deleted, or
backdated by Satsignal or anyone else. The service is operated by
Satsignal LLC as an independent service.
Early access. The hosted service is in an early-access phase: the free tier is open for evaluation, paid self-serve checkout is not yet enabled, and production customers are onboarded directly as design partners — see pricing. These terms apply to free and early-access use; a design-partner or other signed agreement supplements them and controls where it differs.
Beta and preview features. Early-access use and any features labeled beta or preview may be changed, suspended, or withdrawn at any time, and may not carry the same availability, support, or feature stability as a generally available service. They are provided for evaluation; don’t rely on the hosted early-access surface for production-critical use except under a signed design-partner or other written agreement. Security practices apply the same to free and early-access use as to any other (see the security page) — early access is not a reason we’d cut security corners. If you send us feedback or suggestions, you grant Satsignal a non-exclusive, royalty-free license to use them to improve the service, with no obligation to you. [Counsel to review the beta and feedback-license terms.]
Tamper-evidence and timing. Not authorship or fact.
A valid proof establishes that whoever submitted the anchor knew this exact fingerprint — of an agent commitment, a policy snapshot, a manifest leaf, or an ordinary file — by the timestamp of its on-chain transaction. It does not, by itself, prove who produced the payload, that the content predates the anchor, what its claims mean, or that any underlying event actually happened. For those questions you still need surrounding documentation, witnesses, or counsel. Satsignal is tamper-evidence and timing, not authentication of intent or fact.
Scope of the service.
Satsignal is not a legal notary, an e-signature service, a certificate authority, a qualified-trust or identity service, or a custodian of your data. It is not legal, financial, or compliance advice, and not a substitute for counsel. A proof is evidence about a fingerprint and a time; whether that evidence is sufficient for any particular legal, regulatory, or commercial purpose is a judgement you (and, where appropriate, your advisers) make — not a determination Satsignal makes for you.
You don’t have to trust Satsignal to verify.
The verifier is a single static HTML file you can save, audit,
and run offline. It re-hashes the item, walks the manifest path if
needed, and checks the transaction against any public Bitcoin SV
block explorer you choose — the chain check never goes through
Satsignal. A bundle keeps verifying with or without us. Two
Satsignal-hosted conveniences remain: /lookup_hash
(resolving a fingerprint to a bundle id and txid) for proofs you
never downloaded — keep your bundle and that dependency
disappears — and the PDF text-extraction library the verifier
loads on demand when re-deriving a PDF’s content
fingerprint.
Anchors are public and irreversible.
An anchor is written to a public blockchain and is permanent for
as long as that chain operates; the .mbnt bundle you
download verifies offline against it, independent of Satsignal. In
Standard
mode the anchored fingerprint is a value anyone holding the same
payload can match against. In Sealed mode (Mirror or Blind) the
on-chain value is a salted commitment that does not expose a
matchable fingerprint. Deleting a server-side bundle, if offered,
never removes or alters the on-chain anchor — that is the
point of the service. Choose the mode that fits the sensitivity of
the material before you anchor it. See the
privacy page for what does and
doesn’t leave your device.
Keep the parts that make a proof checkable.
A proof commits to a fingerprint, not to your bytes. To re-verify later you must keep the bundle and the original item together; for sealed manifests you must also keep the master salt and each revealed row’s canonical bytes. Lose them and the corresponding proof can no longer be reproduced — Satsignal cannot recover them for you. You are responsible for having the right to anchor what you submit, and for not anchoring unlawful content. Choosing Standard versus Sealed for sensitive material is your decision: a Standard-mode anchor is hash-discoverable — anyone holding the same payload, or its SHA-256, can confirm a matching proof exists — so use Sealed mode for personal, sensitive, or low-entropy payloads whose existence is itself sensitive. You are also responsible for keeping your account credentials and API keys confidential; anchors submitted with your keys count against your plan and are treated as yours.
Verification is always free.
Verifying a proof is free and never requires an account. Anchoring includes a free allowance of 100 anchors per calendar month; paid plans (Starter, Pro, Scale) lift the cap — see pricing. Quotas and anti-abuse rate limits exist to keep the service available to everyone.
- Fees and taxes (draft)
- Paid-plan fees are stated in USD and are exclusive of taxes; you are responsible for any sales, use, or similar taxes that apply to your purchase, and we are responsible for taxes on our income. While self-serve checkout is not enabled, paid use is invoiced directly under a signed agreement (NET 30 unless that agreement says otherwise).
- Refunds and plan changes (draft)
- Fees already paid are non-refundable except where these terms or applicable law require otherwise. If a verified service failure on our side prevents you from anchoring, we will credit or refund the affected period in good faith. Plan upgrades take effect immediately; downgrades take effect at the next billing cycle. Anchors already broadcast are never rolled back by a plan change — they are on a public chain.
- Suspension for abuse or non-payment (draft)
- We may suspend new anchoring for a workspace that exceeds its plan, violates the acceptable-use section below, or has an unpaid invoice more than 30 days past due — after notice where practical. Suspension blocks new proofs only: existing proofs keep verifying, your downloaded bundles are untouched, and the on-chain anchors are unaffected.
What you may not do with the service.
You may not use Satsignal to:
- Anchor content you have no right to anchor — including fingerprints or commitments derived from data you hold unlawfully, or third-party data you are not authorized to process. The anchor itself carries no content, but creating it is still your act.
- Further an unlawful purpose — including fraud, market manipulation, evidence fabrication (e.g. anchoring a doctored record to lend it false credibility), or violating sanctions or export-control law.
- Misrepresent what a proof establishes — you may not present a Satsignal proof as proof of authorship, of identity, of regulatory approval, or of the truth of a document’s contents. Section 02 is the entire claim.
- Abuse the platform — probing or circumventing authentication, rate limits, or quotas; reselling or embedding access except as the embedding & resale rider permits; submitting payloads crafted to attack downstream verifiers or AI agents that read proofs.
- Anchor fingerprints of prohibited material — where the existence of the anchor itself would further the harm (for example, content whose possession is illegal). We cannot inspect your files — by design we never receive them — so enforcement relies on reports and on the conduct we can see.
Export controls and sanctions. You represent that you are not located in, organized under the laws of, or ordinarily resident in any comprehensively sanctioned or embargoed jurisdiction, that you are not on any applicable denied- or restricted-party list, and that you will not use, export, or re-export the service in violation of applicable export-control or sanctions law. [Counsel to review the export and sanctions representation.]
The hosted surface is best-effort; the proof is built to outlive it.
Current service status and any availability commitments are published on the status page, which is the single place those numbers live; this page deliberately does not duplicate them. During early access the hosted anchoring surface is provided on a best-effort basis; design-partner agreements may add specific availability commitments in writing.
By design, an outage of the hosted surface does not invalidate
anything you already hold: a downloaded .mbnt bundle
verifies against the public chain with no Satsignal service in the
loop (section 04). Planned maintenance and incidents are
posted to the status page.
What we promise, and what we disclaim.
What we warrant. We warrant that we operate the service with reasonable skill and care, and that a proof we issue is generated by the published, documented process — the bundle format and verification procedure are open specifications you can audit.
What we disclaim. Except as expressly stated, the service and all proofs are provided “as is” and “as available”, without warranties of any kind, express or implied — including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the service will be uninterrupted or error-free; that the Bitcoin SV network, its miners, or third-party explorers (none of which we control) will behave in any particular way; or that a proof will be admissible or sufficient for any particular legal, regulatory, or commercial purpose (section 03).
Caps and carve-outs.
Cap. To the maximum extent permitted by law, the total aggregate liability of each party arising out of or relating to the service is limited to the fees you paid to Satsignal in the twelve months preceding the event giving rise to the claim (for free-tier use, [USD 100 — counsel to confirm a free-tier cap]).
Excluded damages. Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill — even if advised of the possibility. Losing the original file or bundle that a proof depends on (section 06) is in this excluded class.
Carve-outs. The cap and exclusions above do not apply to: (a) your payment obligations; (b) a party’s gross negligence, fraud, or willful misconduct; (c) your breach of section 08 (acceptable use); (d) either party’s indemnity obligations under section 12; or (e) liability that cannot be limited under applicable law.
Who covers what.
By you. You will defend and indemnify Satsignal LLC against third-party claims arising from the content and fingerprints you submit, your breach of section 08, or your use of proofs in violation of these terms — including claims that material you anchored, or your act of anchoring it, violates law or third-party rights.
By us. We will defend and indemnify you against third-party claims that the hosted service, as provided by us and used as documented, directly infringes that third party’s intellectual-property rights — excluding claims arising from your content, from combinations we did not supply, or from use after we notified you to stop. If such a claim looks likely, we may modify the service to be non-infringing or, failing that, terminate the affected service and refund prepaid unused fees.
Proofs outlive the agreement. That is the product.
Term. These terms apply from your first use of the service and continue until terminated. You may stop using the service and close your account at any time (hello@satsignal.cloud). We may terminate for material breach that goes uncured for 30 days after notice, immediately for serious acceptable-use violations, or on 90 days’ notice if we wind the hosted service down.
What survives — by design. Termination ends
access to the hosted surface: new anchoring, the dashboard, and
hosted bundle downloads. (Deleting your records also ends
/lookup_hash resolvability of your proofs —
the endpoint itself is public.) It does
not — and cannot — revoke what was already
delivered: every .mbnt bundle you downloaded remains
independently verifiable against the public chain for as long as
that chain operates, and
every on-chain anchor remains in place. No future state of
Satsignal LLC — termination, acquisition, or shutdown
— can quietly invalidate a proof you already hold. This is
the deliberate difference from verification services that stop
vouching for you when the subscription stops.
Data on termination. On account closure we delete your account records and remaining server-side bundles as described in the data-processing addendum and the privacy page. The on-chain anchor — a content-free commitment — is permanent and is not deleted by anyone, including us (section 05). Sections 02, 03, 10, 11, 12, and 16 survive termination.
Your content stays yours. The open parts stay open.
You retain all rights to your files, data, and the fingerprints
derived from them; you grant Satsignal only the narrow license
needed to operate the service — to process what you submit,
store what the data-processing addendum
says we store, and broadcast the content-free anchor transaction.
Satsignal LLC retains all rights in the service, the site,
and the Satsignal name and mark; trademark use in an embedded or
resold context is governed by the
embedding & resale rider. The
.mbnt bundle format and the in-browser verifier are
open and auditable so that verification never depends on our
permission.
The DPA and the embedding & resale rider.
- Data processing
- A complete draft data-processing addendum (DPA) is published — roles, the exact data inventory, retention windows per mode, subprocessor categories, and the deletion-vs-permanent-anchor clause. Like this page, it is a draft pending counsel review; procurement teams that need a signed DPA should write to hello@satsignal.cloud.
- Embedding & resale
- Offering Satsignal anchoring inside your own product is covered by the draft embedding & resale rider: available to paying customers, sealed-mode embedding by default, attribution and white-label options.
Order of precedence (intended). Where these documents conflict, the intended order — for counsel to confirm and make operative — is: a signed order form or design-partner agreement first, then the DPA on data protection, then these terms (including their acceptable-use section), then any product-specific terms such as the embedding & resale rider, then the privacy notice. [Counsel to confirm the order of precedence.]
Who operates the service, and which law applies.
The service is operated by Satsignal LLC, an Iowa limited liability company. Governing law: the law of the State of Iowa, the company’s state of formation, without regard to its conflict-of-laws rules. Disputes: the parties will first try in good faith to resolve any dispute informally by email; formal forum selection, any arbitration clause, class-action waivers, and small-claims carve-outs are [open — counsel to draft]. Nothing on this page limits or waives any right you have under applicable law.
How this page changes.
We’ll update this page as the terms develop — in particular when counsel review completes and the draft banner comes down. The version note at the top reflects the current state; a material change will get a brief note describing what changed, and for paid customers we will give at least 30 days’ notice before a materially adverse change takes effect. The tamper-evidence-and-timing scope statement in section 02 is held stable on purpose and will not be quietly broadened. Questions, corrections, or anything else: hello@satsignal.cloud.