Product Terms

1. Definitions

• Package. A signed Buyer Review Pack assembled from authorized customer-supplied records for one eligible request.
• Manifest. A machine-readable list of every artifact and its content hash.
• Receipt. A signed issuer receipt binding the package manifest hash.
• Parties. These terms are between Rabie-Abdollah Macbahi, doing business as Services AttestLayer ('AttestLayer'), and the customer. Services AttestLayer is the registered business name of Rabie-Abdollah Macbahi, a sole proprietor registered in Québec (NEQ 2282022963), 360 Saint-Jacques Street, Suite G101, Montréal, QC H2Y 1P5.
• Reviewer. An authorized customer, client-side, procurement-side, or third-party recipient that reviews or verifies the package.
• Review slot. Capacity for the first successful generation of one separate eligible client request.

2. Eligible / Not eligible

Eligible / Not eligible. The operational result of the scope checks on the material you submit. "Not eligible" means the material didn't meet the selected scope's rules. It says nothing about whether your company is secure or compliant. Package verification results are separate and are shown as "Package integrity verified" or "Not verified".

3. Timing

Workflow timing begins after an eligible order is confirmed and complete intake passes validation. Completion depends on request scope, record quality, customer review, and any required correction. A displayed target is an operational target, not a guaranteed deadline unless a signed agreement expressly says otherwise.

4. Reruns

Reruns belong to the same request reference and never use a review slot. For Essentials, Full, Full 150, Full 300, Three-Pack and Five-Pack: One rerun included within your order window; you upload the files again for the rerun. Further reruns cost US$450 each, up to 3 paid reruns per request, bought from the Client Console when needed. For Integrity Check, Integrity 150 and Integrity 300: One rerun included within your order window; you upload the files again for the rerun. No paid rerun is offered. The reruns for each offer are shown in the fee table in the Terms of Service.

5. Reviewer verification boundary

A reviewer can verify package integrity, manifest hashes, receipt signature, key discovery, and package metadata. A reviewer cannot infer compliance, certification, audit completion, client approval, or completeness of the underlying records from AttestLayer verification alone.

6. Customer responsibilities

Customer responsibilities. The customer is responsible for ensuring that supplied records are accurate, authorized for sharing, complete for the selected scope, free of unnecessary sensitive data, and not misleading. The customer must not upload secrets, production credentials, private keys, access tokens, payment card data, health records, unauthorized third-party data, or material it is not permitted to share.

7. Warranty disclaimer

Warranty disclaimer. The services, packages, Registry materials, verifier tools, sample kits, documentation, and public surfaces are provided on an "as is" and "as available" basis unless a signed agreement states otherwise. AttestLayer does not warrant that a package will satisfy any client, auditor, regulator, insurer, procurement team, security team, or reviewer.

8. Limitation of liability

Limitation of liability. To the maximum extent permitted by law, AttestLayer will not be liable for indirect, incidental, special, consequential, punitive, exemplary, lost-profit, lost-revenue, lost-data, business-interruption, procurement-loss, buyer-rejection, regulator-action, or loss-of-goodwill damages. Unless a signed agreement states otherwise, AttestLayer's total aggregate liability for a claim is limited to the fees paid by the customer for the affected order.

9. Confidentiality

Confidentiality. AttestLayer treats non-public supplied records, draft packages, and support communications as confidential customer materials, except where disclosure is required to provide the service, comply with law, operate verification or Registry functions requested by the customer, or as otherwise permitted by an accepted agreement.

10. Suspension

Suspension. AttestLayer may suspend access, processing, package issuance, verification support, or Registry-related functions if use appears fraudulent, abusive, unlawful, unsafe, unauthorized, unpaid, or inconsistent with AttestLayer's record-only boundary, acceptable-use rules, or security requirements.

11. No emergency reliance

No emergency reliance. AttestLayer packets, registry records, APIs, verifier tools, and support channels are not emergency services and must not be used as the sole control for safety-critical, medical, financial-settlement-finality, life-safety, or legally mandatory real-time decisions.

12. Support and SLA targets

Support and output targets are operational targets, not financial service-level guarantees, unless a signed agreement expressly provides service credits or remedies. See Support Policy.

13. Refund and billing

Refund eligibility depends on the selected offer, accepted order, Product Terms, whether processing started, whether output was issued, whether review capacity was consumed, and whether a specific platform-failure or duplicate-payment condition applies. A confirmed failed generation consumes no review slot. Completed package work, issued output, expired or used capacity, and matters outside AttestLayer's control are generally non-refundable unless the Refunds and Billing Policy, a signed agreement, mandatory law, or a written AttestLayer exception states otherwise. See Refunds & Billing.

14. Order of precedence

Order of precedence. The policy versions identified in an accepted order govern that paid order; later website publication does not change those accepted versions. A separately signed agreement, DPA, order form, statement of work, or written amendment signed by AttestLayer controls only where it expressly identifies the affected term and order. If there is no such signed override, the checkout terms, product terms, applicable addenda, and public terms identified at acceptance govern the purchase or use.

15. Governing law

These terms are governed by the laws of the Province of Quebec and the federal laws of Canada that apply there. The courts of the judicial district of Montréal, Quebec, have exclusive jurisdiction, unless applicable law requires otherwise or a signed agreement says otherwise.

16. Verified Evidence Package (archived offer)

This offer is retired and has not been sold since 15 October 2026; an order bought under it keeps these terms. The Verified Evidence Package packages, indexes and signs the files you provide. AttestLayer does not draft, check, or make any statement about the accuracy, completeness or suitability of their content. Verification proves only that the files have not changed since the package was issued.

17. Standard Answer Set (archived offer)

This offer is retired and has not been sold since 15 October 2026; an order bought under it keeps these terms. The Standard Answer Set reports what your submitted records state, measured against AttestLayer's standard buyer questionnaire. It is not an audit, certification, score, or opinion on your security program, and it is intended for your internal use only. It does not produce any file for a client.