Terms of Service

1. Acceptance and definitions

These Terms of Service ("Terms") are a contract between you and Mandatary ("Mandatary", "we", "us"). By creating an account, calling our API, signing a mandate, registering an agent, requesting an attestation or otherwise using the service, you accept these Terms. If you act for a company, you confirm you have authority to bind it. If you have signed a separate order form or master agreement with us, that document prevails where it conflicts with these Terms.

In these Terms:

• Principal — the person or company that owns the assets and grants a mandate.
• Representative and Approver — people who sign or approve on behalf of a Principal.
• Agent — a software program, identified on ERC-8004, that trades under a mandate.
• Operator — the person or company that develops or runs an Agent.
• Verifier — a trading platform, token issuer or institution that checks mandates before letting an Agent trade.
• Auditor — an external auditor or authority given read-only access by a customer.
• Mandate — the limited, verifiable and revocable authorization a Principal grants to an Agent, in the form of a signed document and an on-chain record (ERC-8226).
• Evidence — the record of each mandate event and each verification decision, chained by hash and anchored on a blockchain (ERC-8273).

2. What the service is

Mandatary is a cloud service, with supporting smart contracts, that:

• lets Principals create, sign, modify, renew and revoke Mandates for Agents, using templates and the Principal's own wallet;
• verifies the identity of companies (LEI through GLEIF), signers and Operators through third-party identity providers;
• answers, through an API and an on-chain hook, whether a specific trade by a specific Agent is within its Mandate — allowed, denied or requires human approval — with the reason;
• records every decision as Evidence and produces reports and dossiers in the formats used by regulators (for example SEC books and records, MiCA and FCA transaction records);
• issues credentials, public profiles and reputation information for Agents, and sells signed attestations to other agents through machine payments (x402);
• provides a web console, an SDK, webhooks and an MCP server to use all of the above.

The service is provided "as a service": we do not deliver software for you to install, other than the SDK and MCP server, which are licensed under the terms that accompany them.

3. What we certify and what we do not

This clause is the heart of the service and is repeated in every certificate, attestation and dossier we produce.

We certify

• that a Mandate with a specific content existed at a specific time, signed by a person whose identity and authority were verified to the level stated in the Mandate;
• that a specific trade was evaluated against that Mandate and against the Verifier's own rules, with a specific result and reason;
• that the Evidence of those facts has not been altered since it was written, which anyone can check against the blockchain.

We do not certify

• that a trade was convenient, profitable, lawful on its merits, or suitable for the Principal's profile;
• that an Agent is safe, well built, or will behave as its Operator claims;
• that a Principal, Operator or Verifier complies with its own regulatory obligations;
• the accuracy of information supplied by third parties (identity providers, sanctions lists, price oracles, risk scores), which we use as received.

4. What we are not

• We are not a custodian. We never hold, receive, transfer or have access to your funds, tokens or private keys. You sign with a wallet you control.
• We are not a trading venue, broker, exchange or issuer. We do not execute, route or settle trades and we do not issue tokens. The Verifier decides whether to execute a trade; our answer is one input to that decision.
• We are not an investment adviser. Nothing in the service is a recommendation to buy, sell or hold anything.
• We are not a law firm. Mandate templates and regulatory formats are tools, prepared with legal advice, but they do not replace advice from your own counsel about your situation and jurisdiction.
• We are not your KYC provider. We verify what the service needs and we can reuse a Verifier's existing KYC; we do not replace the Verifier's own obligations.

5. Accounts, roles and your responsibilities

You are responsible for:

• the truth and completeness of the information you give us and the documents you sign;
• keeping your credentials, API keys and wallets secure, and for everything done with them until you tell us they are compromised;
• having the authority to sign a Mandate on behalf of a Principal, and for keeping that authority current;
• managing the users, roles and Auditor access you create in your account;
• your own licensing, registration, reporting and tax obligations in every jurisdiction where you or your Agents operate — including, where an Agent gives advice or manages assets, any obligation to register as an adviser;
• the Agents you operate: their behavior, their endpoints, and any loss they cause.

You must be at least 18 years old and able to enter into binding contracts. You may not use the service if you or your company are on a sanctions list or located in a jurisdiction where the service would be unlawful.

6. Mandates

• Legal effect. A Mandate is a document that you sign and that you intend to be binding between you and your Agent's Operator, and to be relied on by Verifiers. Its enforceability depends on the law that governs it, which is stated in the template you choose. Mandatary is not a party to the Mandate.
• Templates. We provide Basic, Professional and Institutional templates with versions for several jurisdictions. Choosing a template is your decision. We may update templates; existing Mandates keep the version they were signed with.
• Signing. Mandates are signed with your wallet (EIP-712). The signed document, its hash and the structured terms are stored as Evidence; the hash and the structured limits are registered on-chain.
• Modification and renewal. Changes create a new signed version; the history is kept. Renewals extend validity. We send reminders before expiry but you are responsible for renewing.
• Revocation. A Principal, an Approver or an emergency contact can revoke a Mandate at any time from the console, the API or directly on-chain. Revocation is immediate on our side, always free, never blocked by billing, and cannot be undone. Verifiers are notified; the time it takes them to act is outside our control.
• Wallet policies. Where supported, we translate a Mandate into the policy of a third-party wallet. The wallet provider's rules govern how that policy is enforced.

7. Real-time verification

• What we check. Whether the Mandate is valid and not revoked; the asset, action, amount, hour, venue and counterparty; limits per trade, per day, in total and per time window; the approval threshold; sanctions and risk signals from third-party providers; and any rules the Verifier configured.
• Deny when in doubt. If any check cannot be completed — a provider is down, data is inconsistent, a Mandate is not in cache — the answer is denied. This is a design rule, not a defect.
• Human approval. Trades over the threshold create an approval request. If no authorized person answers within the configured time, the request expires and the trade is treated as denied.
• Determinism. The rules engine is deterministic: the same input produces the same decision, so any decision can be reproduced later. The version of the rules is recorded with each decision.
• The Verifier decides. Our answer is information. Executing, delaying or rejecting a trade is the Verifier's act and responsibility. An allowed answer is not an instruction to trade and is not a guarantee that the trade will settle.
• Performance. We design for a response under 300 milliseconds at the 95th percentile. Committed latency and availability figures apply only where an order form includes a service-level agreement.

8. Evidence, records and auditor access

• Every mandate event and every decision is written to an append-only, encrypted evidence vault, chained by hash and anchored in batches on a public blockchain. We cannot edit or delete an evidence record, and we will not do so on request, except as the law requires.
• Evidence is kept for seven years from the date of the record, and longer if the law or a customer's retention policy requires.
• You can export your Evidence at any time as signed JSON, CSV or PDF, and generate dossiers and reports in the regulatory formats we support. Formats are prepared to match published requirements, but it is your responsibility to confirm they satisfy your regulator.
• You may grant Auditors read-only access limited in scope and time. Every query an Auditor makes is logged and visible to you. You are responsible for choosing whom you grant access to.
• Reports carry our signature so that anyone can verify they came from us and were not modified. A signature confirms authenticity of the record, not the merits of what it records (see clause 3).

9. Agents, operators and attestations

• Registration. Operators may register Agents on the ERC-8004 identity registry through us or link Agents already registered. You must own or control the wallet you link to an Agent.
• Verified credentials. We issue a "verified operator" credential after an identity check. It states that the Operator's identity was verified on a given date; it is not an endorsement of the Agent. Credentials expire and may be revoked if the check is no longer valid or these Terms are breached.
• Public profiles and reputation. Agent profiles and reputation dimensions are public. Reputation is computed from Evidence and from feedback tied to paid attestations; we never publish a single opaque score. You may not manipulate reputation, including through coordinated or self-dealing feedback.
• Attestations (x402). Our public endpoints return signed attestations about an Agent's identity, mandate scope, validation or reputation in exchange for a per-query payment in stablecoin. Prices are published at mandatary.ai/#pricing. Attestations are valid for the short period stated in them and reflect our records at that moment. Payments are final.
• Feedback. Feedback on an Agent is accepted only from a party that presents the receipt of a paid attestation about that Agent, once per receipt.

10. Fees and payment

• Fees are those published at mandatary.ai/#pricing or agreed in your order form. Subscriptions are billed annually in advance; per-mandate and per-attestation fees are billed when incurred or deducted from a plan allowance.
• Verifications above a plan's included volume are charged at the published overage rate. We never block or slow a verification because of billing.
• Revoking a Mandate is always free. Modifying a Mandate costs a fraction of its issuance fee, as published.
• Fees exclude taxes. You are responsible for any sales, value-added or withholding tax that applies.
• Unpaid invoices may lead to suspension of new Mandates, new Agent registrations and console access after notice; existing Mandates remain revocable and Evidence remains exportable.
• Prices may change with 60 days' notice; changes apply from your next renewal.

11. Availability and support

We work to keep the service available at all times and we will announce planned maintenance in advance. Unless an order form includes a service-level agreement, we do not guarantee uninterrupted availability. Blockchains, identity providers, wallet providers and networks we depend on are outside our control; when one of them fails, the verification service answers denied and revocation remains available through the on-chain contract directly.

Support is provided by email during business hours, or as stated in your plan.

12. Security

We protect the service with encryption in transit and at rest, append-only evidence storage, role-based and scoped access keys, tenant isolation, logging, backups and independent review of smart contracts before any change. Deployed contracts are not modified without an external audit and a published time-lock. Our signing key is held in a managed key service.

You must protect your credentials, keys and wallets, notify us promptly of any suspected compromise, and not attempt to probe, bypass or overload our security. If you find a vulnerability, please report it to [email protected].

13. Intellectual property and your data

• The service, its software, design, brand, documentation and templates belong to Mandatary or its licensors. You get a non-exclusive, non-transferable right to use them for your own business while these Terms are in force.
• Your data — your Mandates, your Evidence, your documents and everything you upload — remains yours. You grant us the right to process it to provide the service, to keep it for the retention periods in clause 8 and to produce the aggregated, non-identifying statistics we publish.
• Our smart contracts implement public Ethereum standards (ERC-8004, ERC-8226, ERC-8273 and others). The standards are public; our implementation, service and data formats are ours. Nothing you sign is locked to us: Mandates and Evidence are exportable and verifiable without our service.
• You may not copy, resell, reverse-engineer or build a competing service from our software or data, other than as permitted by the licenses of our open-source components.

14. Acceptable use

You may not use the service to:

• launder money, finance terrorism, evade sanctions, manipulate markets or commit fraud;
• sign a Mandate you are not authorized to sign, or on behalf of someone who has not consented;
• structure trades to stay under limits or approval thresholds in order to defeat the purpose of a Mandate;
• register Agents with fake or hollow identities, or manipulate reputation;
• interfere with the service, other customers, or the blockchains and providers we use;
• break any law that applies to you or to your Agents.

We may suspend or terminate access for breach, and we report suspicious activity to authorities where the law requires.

15. Warranties and limitation of liability

Except as expressly stated in these Terms or an order form, the service is provided "as is" and we disclaim all other warranties, including fitness for a particular purpose and non-infringement.

We are not liable for: decisions taken by you, your Agents or a Verifier; losses from trades, whether allowed or denied; the acts or failures of blockchains, wallet providers, identity providers, sanctions-list providers, price oracles or other third parties; your breach of your own regulatory obligations; or indirect, consequential, special or punitive damages, lost profits or lost data.

To the fullest extent permitted by law, our total liability arising out of the service is limited to the fees you paid us for the service in the three months immediately before the event giving rise to the claim, or USD 1,000 if you paid no fees in that period. Nothing in these Terms limits liability for fraud, wilful misconduct, or anything that cannot be limited by law.

16. Indemnity

You will defend and indemnify Mandatary against third-party claims arising from your breach of these Terms, from Mandates you sign without authority, from the behavior of Agents you operate, or from your violation of applicable law.

17. Term and termination

• These Terms apply from your first use of the service until your account is closed.
• You may close your account at any time. Subscriptions run to the end of the paid period; fees already paid are not refunded except where an order form says otherwise.
• We may terminate for material breach after notice and a reasonable chance to cure, or immediately for illegal use, security risk or sanctions exposure.
• On termination: you may export your Evidence for 90 days; we keep Evidence for the retention period in clause 8 and then delete it; on-chain Mandates remain on the blockchain and remain revocable by the Principal directly through the contract; credentials we issued are marked revoked.
• Clauses 3, 4, 8, 13, 15, 16, 19 and any other clause that by its nature should survive, survive termination.

18. Changes to these terms

We may update these Terms as the service, the standards we implement or the law change. The current version is always at mandatary.ai/terms.html with its date. For material changes we will email account holders at least 30 days before they take effect; continued use after that date is acceptance. Changes never reduce your right to revoke a Mandate or to export your Evidence.

19. Governing law and disputes

These Terms are governed by the laws of the Republic of Chile, without regard to conflict-of-law rules. Any dispute that cannot be settled amicably within 30 days of written notice will be submitted to the ordinary courts of Santiago, Chile, unless an order form provides otherwise. Mandates themselves are governed by the law stated in each Mandate, which may differ.

Where mandatory consumer or data-protection law of your country gives you rights that cannot be waived, those rights are not affected.

20. Contact

Mandatary · [email protected]

See also our Privacy Policy.