Terms of service

These terms are a draft for counsel to review. They are not in effect, and using the local demo does not create a contract.

Tellshield provides an interaction-authenticity API. Customers embed the browser SDK, send a token to their own server, and redeem it with a secret key. Customers decide what to allow, challenge, or block. Tellshield does not guarantee that a classification is correct.

Customers must not use Tellshield to identify a specific person across sites, to collect typed content, or to make solely automated decisions that produce legal effects without their own review. Customers are responsible for their own privacy notice and for configuring allowed origins.

Secret keys are credentials. A leaked key lets the holder read verification results for that site. Customers must store keys on a server, rotate them if exposed, and not ship them in frontend code.

Either party should be able to stop using the service. On termination, verification records are deleted on the retention schedule described in the privacy draft.

The service is provided as available. Outages happen. Customers choose, per action, whether to fail open or fail closed when Tellshield cannot be reached. See docs/FAILURE.md.