Terms of Service — ZeroTrust

Version: 2026-10-01  ·  Effective: October 1, 2026  ·  Supersedes: none, this is the first published version

This document is versioned by its effective date. Every superseded version remains available at zerotrust.entrinsia.com/terms/<version> permanently. Changes are listed in the Revision History at the end.

These Terms of Service ("Terms") are a binding agreement between Entrinsia Inc. ("Entrinsia," "we," "us," or "our") and the person or entity accessing or using ZeroTrust (the "Customer," "you," or "your"). They govern your access to and use of ZeroTrust, including our website, API, JavaScript widget, dashboard, and related documentation (collectively, the "Service").

By creating an account, subscribing via AWS Marketplace, integrating the Service into your website or application, or otherwise using the Service, you agree to these Terms. If you are agreeing on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity. If you do not agree, do not use the Service.

Our collection and handling of personal data is described in our Privacy Policy. Our obligations to you as a processor of End User personal data are set out in our Data Processing Addendum, which is incorporated into these Terms by reference.

1. Definitions

• "End User" means an individual whose identity or age is verified through the Service as part of your website, app, or business process.
• "Verification Session" means one attempt by an End User to complete identity or age verification through the Service, as defined in Section 6.
• "Verification Result" means the data ZeroTrust returns to you following a Verification Session, for example a pass or fail result, an age-over-threshold confirmation, or other fields you have configured us to return.
• "Documentation" means our published technical documentation, integration guides, and API references, as updated from time to time.
• "Your Data" means data you submit to the Service in configuring or operating your account, such as domain registrations, configuration settings, and billing information. End User personal data is addressed separately in Section 9, the Privacy Policy, and the Data Processing Addendum.

2. The Service

ZeroTrust verifies a government-issued ID and confirms, through a live selfie, that the person submitting the ID is the person depicted on it and is physically present. Based on your configuration, ZeroTrust returns a Verification Result to you, which may be as simple as a pass or fail flag, or may include specific data fields extracted from the ID.

2.1 What ZeroTrust Is

A tool for real-time document authentication, liveness detection, and age and identity verification, supporting United States state driver's licences, state identification cards, and United States passports, as described in our Documentation. Where enabled for your account, ZeroTrust may also accept a mobile driver's licence or other digital identity credential presented from a device wallet, subject to these same Terms.

2.2 What ZeroTrust Is Not

• Not full "Know Your Customer" (KYC) compliance. ZeroTrust does not retain identity records in the manner required for banking, money transmission, cryptocurrency, or similarly regulated KYC obligations. In particular, we do not retain dates of birth, readable document numbers, or street addresses. If your business requires traditional KYC recordkeeping, the Service will not satisfy your regulatory requirements on its own. Contact us before relying on it for that purpose.
• Not legal advice, and not a compliance guarantee. Using the Service does not, by itself, guarantee compliance with any law applicable to your business, including age-verification statutes, privacy laws, or industry-specific regulations. See Section 8.
• Not infallible. Identity verification technology, including liveness detection and document authentication, is not 100% accurate. See Section 11.

3. Eligibility and Accounts

3.1 Business Use Only

The Service is intended for use by businesses and other organisations verifying their own End Users, not for personal, non-commercial use.

3.2 Account Registration

To use the Service, you must register an account, register the domains from which you will call the Service, and provide accurate account and billing information. You are responsible for maintaining the confidentiality of your account credentials and API keys, and for all activity that occurs under your account, whether or not authorised by you.

3.3 Notify Us of Unauthorized Use

You will notify us promptly at support@entrinsia.com if you become aware of any unauthorised access to or use of your account.

4. Fees and Payment

4.1 Pricing

The Service is billed on a per-Verification-Session basis at the rate published at zerotrust.entrinsia.com/#pricing at the time of your subscription, currently $0.60 per billable Verification Session, unless you have a separate signed agreement with different pricing. Pricing for usage exceeding 10,000 Verification Sessions per month is available by contacting us.

4.2 Billing Method

You may pay for the Service either (a) directly, with Entrinsia invoicing you or charging a payment method on file, generally on a monthly basis for the prior month's usage, or (b) through AWS Marketplace, in which case billing terms are also subject to your AWS Marketplace agreement. If there is a conflict between AWS Marketplace's billing terms and these Terms regarding payment mechanics, AWS Marketplace's terms govern billing mechanics, while these Terms continue to govern your use of the Service itself.

4.3 What You're Billed For

You are billed for each billable Verification Session initiated through your account, as defined in Section 6, regardless of whether the result is a pass, a fail, or an abandonment after capture has begun.

4.4 Free Verifications

New accounts receive a set number of free Verification Sessions, currently 50, as described at the time of sign-up. Free Verification Sessions are subject to these Terms in all other respects.

4.5 No Refunds

Fees for billable Verification Sessions are non-refundable, except as required by law, as provided in Sections 5.4, 6.6 and 16, or as we otherwise agree in writing.

4.6 Taxes

Fees are exclusive of applicable taxes. You are responsible for any sales, use, VAT, or similar taxes associated with your use of the Service, other than taxes on Entrinsia's net income.

4.7 Late Payment

Amounts not paid when due, for direct billing arrangements, may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law, and we may suspend the Service for non-payment after notice.

5. Term, Cancellation, and Suspension

5.1 Term

These Terms remain in effect for as long as you maintain an account or otherwise use the Service.

5.2 Cancellation

You may cancel your account at any time through your account settings, your AWS Marketplace subscription, or by contacting us. Cancellation takes effect at the end of the then-current billing period. There are no cancellation penalties, but fees already incurred remain payable.

5.3 Suspension

We may suspend or restrict your access to the Service, with notice where reasonably practicable, if (a) you fail to pay amounts due, (b) we reasonably believe your use of the Service violates Section 7 or poses a security risk, (c) we are required to do so to comply with law or a governmental request, or (d) continued provision of the Service to you would expose us to liability we reasonably consider unacceptable.

5.4 Termination

Either party may terminate these Terms for the other party's uncured material breach following thirty (30) days' written notice, or immediately if the other party becomes insolvent or ceases operating in the ordinary course. We may also terminate these Terms on thirty (30) days' notice for convenience, in which case we will refund any prepaid, unused fees for future service.

5.5 Effect of Termination

Upon termination, your right to access the Service ends, and any amounts owed to us become immediately due.

Within thirty (30) days after termination, Entrinsia will delete Your Data and any End User verification data associated with your account, except for (a) compliance records that remain within their retention period under the Privacy Policy, which we retain so that you or we can evidence that verifications occurred, and (b) records we are required by law to retain. On written request made before termination takes effect, we will provide you with an export of the compliance records associated with your account in a machine-readable format.

Sections that by their nature should survive termination, including Sections 4, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, and 19, will survive.

6. Verification Sessions

6.1 Definition

A Verification Session is a single attempt by one End User to complete verification through your account. It begins when the verification flow is opened and ends when it returns a pass or fail result, is abandoned, or expires.

6.2 When a Session Becomes Billable

A Verification Session becomes billable at the moment the Service first submits an image or video for processing. An End User who opens the verification flow and leaves without capturing anything does not create a billable Verification Session.

6.3 One Session

The following count as a single billable Verification Session:

• Repeated attempts by the same End User against the same transaction or order reference within sixty (60) minutes, where the repeat follows a failed capture, an unreadable image, or a network interruption;
• A verification begun on a desktop and completed on a phone through our device handoff.

6.4 Separate Sessions

The following count as separate billable Verification Sessions:

• Attempts against different transaction or order references;
• A further attempt by the same End User more than sixty (60) minutes after the previous attempt;
• A further attempt following a completed pass or fail result, where you permit the End User to try again.

6.5 Billed Regardless of Outcome

You are billed for each billable Verification Session whether it results in a pass, a fail, or an abandonment after capture has begun. A failed session has performed the Service's function by identifying a non-matching or fraudulent attempt.

6.6 Changes

We may change this Section on thirty (30) days' notice. If a change would increase the number of Verification Sessions billed for the same volume of End User activity, you may terminate without penalty before it takes effect, and the refund provision in Section 5.4 applies.

7. Acceptable Use

You will not, and will not permit any third party to:

• Use the Service for any unlawful purpose, or to facilitate fraud, discrimination, or harassment
• Use the Service to verify an individual without that individual's knowledge, where such knowledge is legally required, or in a manner inconsistent with the notice and consent obligations in Section 8
• Attempt to reverse-engineer, decompile, or extract the underlying models, algorithms, or biometric processing techniques used by the Service
• Attempt to circumvent, probe, or test the security of the Service other than through a good-faith, coordinated disclosure process
• Introduce malware, or interfere with or disrupt the integrity or performance of the Service
• Use the Service to build a directly competing product or service, or to benchmark the Service publicly without our prior written consent
• Exceed reasonable rate limits or attempt to bypass usage-based billing
• Misrepresent your identity, your business, or the domains from which you are authorised to call the Service

We may investigate and take appropriate action, including suspension under Section 5.3, for suspected violations of this Section.

8. Your Compliance Responsibilities

This section is important, and we want to be direct about it.

8.1 You Are Responsible for Your Own Compliance

You are solely responsible for determining whether, and how, your use of the Service satisfies any law, regulation, or industry requirement applicable to your business, including age-verification statutes such as California AB 1263 or similar laws in other states, general privacy laws such as the CCPA and the GDPR, and biometric privacy laws such as BIPA. Entrinsia is not a law firm, does not provide legal advice, and nothing in the Service, our Documentation, our marketing materials, or any communication from us should be construed as legal advice or a guarantee of compliance. You should consult your own legal counsel regarding your specific obligations.

8.2 Notice and Consent to End Users

ZeroTrust displays a biometric notice to every End User before it requests camera access, and requires the End User to accept that notice before any image or video is captured. The notice is described in Section 9.3 of our Privacy Policy. It covers the biometric processing that ZeroTrust itself performs. We retain a record of each acceptance, including the version of the notice shown and the time of acceptance, and we will make that record available to you on request for verifications run under your account.

That notice does not, and is not intended to, satisfy every notice or consent obligation that applies to you. You remain responsible for providing End Users with any notice, and obtaining any consent or written release, that applicable law requires of you. This includes any disclosure specific to your industry or jurisdiction, any disclosure required by the age-verification statute you are relying on, and any written release required of you as the party collecting biometric identifiers under a state biometric privacy statute.

If you are uncertain whether the notice built into ZeroTrust is sufficient for your circumstances, you should assume that it is not, and obtain your own.

8.3 Use of Verification Results

You are responsible for how you use, store, and act on Verification Results after we return them to you, including any further retention obligations that apply to your business once data is in your possession. Our own retention practices are described in the Privacy Policy and do not extend to data you separately store.

8.4 Age Thresholds and Document Types

You are responsible for configuring the correct age threshold and accepted document types for your use case, and for confirming that configuration meets your legal requirements.

9. Data Protection

9.1 Roles

With respect to End User verification data, Entrinsia acts as a processor and you act as the controller. We process that data only on your documented instructions, which for these purposes comprise these Terms, the Data Processing Addendum, and the configuration you set for your account.

9.2 Processing Addendum

Our obligations as a processor are set out in the Data Processing Addendum at zerotrust.entrinsia.com/dpa, which is incorporated into these Terms by reference. Where that Addendum and these Terms conflict in respect of the processing of personal data, the Addendum controls.

9.3 Privacy Policy

Our collection, use, retention, and deletion of data is described in our Privacy Policy. We may update that policy as described in it. We will not make a change that materially reduces the protections applying to End User data already collected under your account without giving you prior notice, and where such a change would materially reduce those protections going forward we will give you at least thirty (30) days' notice before it takes effect.

9.4 Breach Notification

We will notify you without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any personal data breach affecting End User data processed for you, and will provide the information you reasonably require in order to meet your own notification obligations.

10. Service Availability

10.1 Target Availability

We target 99.9% monthly uptime for the Service's API and widget, excluding scheduled maintenance, for which we will provide advance notice where practicable, and events outside our reasonable control (see Section 18). We will notify affected Customers of significant service disruptions by email or through the Service. This target is an operational goal, not a binding service-level guarantee, unless you have a separate signed agreement that includes a specific SLA with associated remedies.

10.2 Fallback Behavior

You are responsible for configuring appropriate fallback behaviour in your own application for periods when the Service is unavailable, for example queuing verifications, routing to manual review, or otherwise handling End Users appropriately, consistent with your own compliance obligations under Section 8.

10.3 Security and Compliance Documentation

Upon reasonable written request, no more than once per calendar year, Entrinsia will provide an executive summary of then-available third-party security audit reports, such as a SOC 2 report if and when obtained, or other compliance documentation reasonably requested to support your own compliance review. This Section applies to Customers with a current subscription, and to prospective Customers evaluating the Service under a mutual non-disclosure agreement. Any such materials are Confidential Information under Section 13 and may be shared only with your personnel and advisors who need them for that purpose. This Section does not obligate Entrinsia to obtain any particular certification or audit it does not otherwise choose to pursue.

11. Disclaimers

THE SERVICE, INCLUDING ALL VERIFICATION RESULTS, IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

Without limiting the foregoing, we do not warrant that:

• The Service will be uninterrupted, error-free, or secure
• Any Verification Result will be accurate in every instance. Identity verification and liveness detection technology, including ours, can produce false positives and false negatives, and a pass result is not a guarantee that a submitted document or selfie is genuine
• The Service will detect every instance of fraud, document forgery, or spoofing
• The Service satisfies the specific legal or regulatory requirements applicable to your business (see Section 8)

12. Intellectual Property

12.1 Our IP

The Service, including its underlying software, models, documentation, and branding, is owned by Entrinsia or our licensors and is protected by intellectual property laws. Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Service during the term of these Terms, solely for your internal business purposes.

12.2 Your IP and Your Instructions

You retain all rights to Your Data and to your own website, application, and branding. You grant us a limited licence to use Your Data solely as necessary to provide the Service to you. You instruct us to process End User personal data as necessary to perform verifications for you and to meet our obligations under these Terms and the Data Processing Addendum, and you represent that you have the authority to give that instruction.

12.3 Feedback

If you provide feedback or suggestions about the Service, we may use them without restriction or obligation to you.

12.4 No Model Training

Entrinsia will not use Your Data, End User ID images, video selfies, biometric data, or any data extracted from an ID to train or improve any machine learning model, whether our own or a third party's. Our agreements with the cloud processing providers described in Section 16 impose the same restriction on them. We may use aggregated, de-identified operational metrics, such as error rates, processing latency, and step completion rates, to improve the Service.

13. Confidentiality

Each party may have access to the other's non-public business, technical, or financial information ("Confidential Information"). Each party agrees to use the other's Confidential Information only to perform its obligations under these Terms, and to protect it using at least the same degree of care it uses for its own confidential information of similar importance, but no less than reasonable care. This Section does not apply to information that is or becomes public through no fault of the receiving party, was already known to the receiving party without restriction, or is independently developed. Either party may disclose Confidential Information as required by law, provided it gives the other party reasonable notice where legally permitted.

14. Indemnification

14.1 Your Indemnification of Entrinsia

You will defend, indemnify, and hold harmless Entrinsia and its officers, directors, employees, and agents from and against any third-party claims, damages, liabilities, costs, and expenses, including reasonable attorneys' fees, arising out of or related to: (a) your actual or alleged non-compliance with any law applicable to your use of the Service, including age-verification or privacy laws; (b) your failure to provide required notice or obtain required consent from End Users; (c) your use of Verification Results, including decisions made or not made based on a Verification Result; (d) Your Data or your instructions to us; or (e) your violation of these Terms.

14.2 Our Indemnification of You

We will defend, indemnify, and hold you harmless from third-party claims that the Service, as provided by us and used in accordance with these Terms, infringes a third party's US intellectual property rights, and will pay resulting damages finally awarded, subject to Section 15. This obligation does not apply to claims arising from your modification of the Service, your combination of the Service with other products not provided by us, or your use of the Service in violation of these Terms.

14.3 Process

The indemnified party will promptly notify the indemnifying party of any claim, give the indemnifying party control of the defence and settlement, except that any settlement requiring the indemnified party to admit fault or take action must be approved by the indemnified party, and provide reasonable cooperation at the indemnifying party's expense.

15. Limitation of Liability

15.1 Exclusion of Certain Damages

TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Without limiting the foregoing, Entrinsia is not liable for regulatory fines or penalties assessed against you, costs of any recall, credit monitoring, or breach notification you undertake, or damages arising from your failure to satisfy your compliance responsibilities under Section 8.

15.2 Liability Cap

TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID TO ENTRINSIA IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE THOUSAND DOLLARS ($1,000).

15.3 Exceptions

The limitation in Section 15.2 does not apply to: (a) your indemnification obligations under Section 14.1; (b) your payment obligations under Section 4; (c) either party's breach of Section 13; or (d) either party's gross negligence, willful misconduct, or fraud.

Entrinsia's indemnification obligations under Section 14.2 are not subject to Section 15.2, but are subject to a separate aggregate cap equal to the greater of (i) three (3) times the fees you paid to Entrinsia in the twelve (12) months preceding the first claim under Section 14.2, or (ii) fifty thousand dollars ($50,000).

15.4 Basis of the Bargain

The parties acknowledge that the fees charged for the Service reflect the allocation of risk in this Section 15, and that this allocation is an essential basis of the parties' agreement.

16. Third-Party Services and Subprocessors

The Service relies on third-party infrastructure and AI processing providers, currently Amazon Web Services, to perform document authentication, liveness detection, and facial comparison, under contract terms consistent with those described in our Privacy Policy and our Data Processing Addendum. We are not responsible for the availability or performance of third-party services outside our control, except to the extent caused by our failure to properly configure or maintain our use of them.

We maintain a current list of the subprocessors that process End User personal data at zerotrust.entrinsia.com/subprocessors. We will give you at least thirty (30) days' notice before adding or replacing a subprocessor that processes End User personal data. If within that period you object on reasonable data protection grounds, and we cannot make available a commercially reasonable alternative, you may terminate the affected portion of the Service without penalty and receive a refund of any prepaid, unused fees. We impose on each subprocessor obligations no less protective than those in our Data Processing Addendum, and we remain responsible to you for each subprocessor's performance.

17. Export Control

The Service may be subject to US export control and economic sanctions laws. You represent that you are not located in, or a national or resident of, any country subject to a US embargo, and are not on any US government restricted-party list. You will not use the Service in violation of applicable export control or sanctions laws.

18. Force Majeure

Neither party is liable for any failure or delay in performance, other than payment obligations, resulting from causes beyond its reasonable control, including natural disasters, war, terrorism, labour disputes, internet or utility failures, acts of government, or failures of third-party infrastructure providers such as AWS.

19. General Provisions

19.1 Governing Law and Venue

These Terms are governed by the laws of the State of Delaware, without regard to conflict of laws principles. For any dispute not subject to arbitration under Section 20, the parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Santa Clara County, California, and waive any objection to venue there.

19.2 Modifications to These Terms

We may update these Terms from time to time. For material changes, we will provide notice through the Service, by email, or by publishing a new version with a new effective date. Continued use of the Service after changes take effect constitutes acceptance. If you do not agree to updated Terms, your remedy is to stop using the Service and cancel your account.

19.3 Modifications to the Service

We may modify, update, or discontinue features of the Service from time to time. We will provide reasonable advance notice of any change that materially reduces core functionality you rely on, where practicable.

19.4 Assignment

You may not assign these Terms without our prior written consent, except to a successor in a merger, acquisition, or sale of substantially all assets, provided the successor is not a direct competitor of Entrinsia. We may assign these Terms without restriction. Any attempted assignment in violation of this Section is void.

19.5 Notices

We may provide notice to you via the email address associated with your account or through the Service. You may provide notice to us at support@entrinsia.com, or in writing to the address in Section 21.

19.6 Severability

If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.

19.7 No Waiver

Failure to enforce any provision of these Terms is not a waiver of our right to enforce it later.

19.8 Entire Agreement

These Terms, together with the Privacy Policy, the Data Processing Addendum, and any Documentation incorporated by reference, constitute the entire agreement between you and Entrinsia regarding the Service, and supersede any prior agreements regarding the same subject matter, except that a separately signed written agreement between you and Entrinsia, such as a negotiated subscription agreement, will govern to the extent it conflicts with these Terms.

19.9 Relationship of the Parties

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship.

20. Dispute Resolution and Arbitration

20.1 Agreement to Arbitrate

Except for claims that may be brought in small claims court, and except as provided in Section 20.3, you and Entrinsia agree that any dispute arising out of or relating to these Terms or the Service will be resolved through binding arbitration rather than in court, on an individual basis.

20.2 Class Action Waiver

YOU AND ENTRINSIA AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.

20.3 Exceptions

Either party may bring an individual action in court seeking injunctive or other equitable relief for actual or threatened infringement, misappropriation, or violation of a party's intellectual property or confidentiality rights.

20.4 Procedure

Unless a separately signed order form or enterprise agreement between you and Entrinsia designates a different administrator, arbitration will be administered by JAMS under its Comprehensive Arbitration Rules and Procedures then in effect. The arbitration will be seated in Santa Clara County, California, and governed by the substantive law specified in Section 19.1.

20.5 End Users Are Not Parties

End Users are not parties to these Terms. Nothing in this Section 20 limits any right of an End User, and no End User is required by these Terms to arbitrate any claim. As between you and Entrinsia, claims brought by an End User arising from your notice or consent practices, or from your use of a Verification Result, are allocated by Sections 14 and 15.

21. Contact Information

If you have questions about these Terms, contact us at:

Email: support@entrinsia.com

Mail: Entrinsia Inc. 559 S El Monte Ave Los Altos, CA 94022

These Terms apply specifically to ZeroTrust. Other Entrinsia products, such as MementoBook, are governed by their own terms of service. If you have a separately signed subscription agreement with Entrinsia for ZeroTrust that conflicts with these Terms, that agreement controls.

Revision History

Every published version of this document remains available at zerotrust.entrinsia.com/terms/<version>.