Scope

These Terms of Service ("Terms") govern the use of the identity verification services, dashboard, API, SDKs and websites (the "Services") of secuveri GmbH, Baarerstrasse 135, 6300 Zug, Switzerland, UID CHE-216.700.481 ("secuveri", "we").

They apply to business customers who use the Services to verify people (the "Customer", "you") and the individuals acting for them (sections 1 to 17), and to visitors to our websites (section 18).

People who complete a verification for a Customer don't enter into these Terms. The End User Terms and the Verification Privacy Notice apply to them, together with the Customer's own privacy notice.

1. The agreement

The agreement with a Customer consists of:

• the order form or online plan selection (the "Order");
• the Data Processing Agreement provided with the Order (the "DPA");
• these Terms.

If they conflict, they apply in that order. By creating an account, signing an Order or using the API, you accept these Terms on behalf of your organisation and confirm that you are authorised to do so. The Services are for businesses only, not for consumers.

2. The Services

The Services let you verify people remotely by checking identity documents (including optical checks and, where supported, the document's chip), checking that a live person is present, and comparing their face with the document photo. You configure which checks run through workflows in the dashboard.

Features, supported documents and countries are described in our documentation and may change over time. We will not materially reduce the core functionality of a paid plan during its current term.

3. Accounts and API keys

• You are responsible for all activity under your accounts and API keys.
• Keep credentials confidential, enable two-factor authentication for administrators, and give access only to people who need it.
• Tell us immediately at security@secuveri.com if you suspect unauthorised access.
• Sandbox environments and test keys are for testing only. Don't submit real people's data to them.

4. Your responsibilities as controller

When you verify people, you are the controller of their personal data and secuveri is your processor, as set out in the DPA. You are responsible for:

• having a lawful basis for each verification and, where required, the person's consent;
• giving the people you verify your own privacy notice and telling them that secuveri processes their data for you, especially when you embed the flow in your own website or app or brand it as your own;
• deciding what you do with the results, and offering the review rights required by law for automated decisions;
• your own record-keeping obligations, for example under anti-money-laundering law, for the data you export.

secuveri's verification flow asks the person for explicit consent to biometric processing before the camera starts. This does not replace your own obligations.

5. Acceptable use

You must not, and must not let others:

• use the Services for anything unlawful, discriminatory or deceptive, or to verify people without a legitimate purpose;
• use the Services for mass surveillance, to identify unknown people (1:N search), to track people, or to infer emotions, ethnicity, health or other sensitive traits;
• verify children without a lawful basis and, where required, a parent's or guardian's consent;
• submit images or data you are not entitled to use, or test fraud techniques against the Services without our written permission;
• probe, scan or test the security of the Services, except under a written agreement with us (report vulnerabilities to security@secuveri.com);
• reverse engineer, copy or resell the Services, or use them to build a competing product, except where the law allows it;
• exceed rate limits or use the Services in a way that harms their availability for others.

We may suspend access immediately if a breach of this section creates a risk to people, to the Services or to us. We will tell you why, and restore access once the issue is resolved.

6. Results

Verification results are risk assessments based on the evidence available: the document, the captures and, where read, the chip. No verification method is error-free. A "verified" result does not guarantee that a document is genuine or that a person is who they claim to be, and a "not verified" result does not prove fraud.

You remain responsible for your decisions, including manual review where appropriate. We document how results are produced and will tell you about changes that materially affect them.

7. Data and data protection

• We process personal data from verifications only on your documented instructions and under the DPA.
• Verification data is stored and processed in Switzerland.
• We delete verification data at the end of the retention period you configure, within the limits in the DPA, or earlier on your instruction.
• We use verification data for our own purposes only as set out in section 8, and we never sell it.
• We may use aggregated, anonymised operational statistics, such as volumes, error rates and latency, that identify neither you nor any person, to run and improve the Services.

8. Improving fraud detection

• Authorisation. You authorise secuveri to use verification data processed through the Services to develop, train, test and improve its fraud-detection models, such as document tamper, presentation-attack, liveness, deepfake and morph detection ("Model Improvement"). For this purpose secuveri acts as an independent controller.
• Face recognition excluded. secuveri does not use verification data to train face-recognition models (models that identify or match individuals) unless the person has given separate, explicit consent.
• Safeguards. Data used for Model Improvement is pseudonymised (names, document numbers and similar identifiers are removed), kept in a separate access-controlled store in Switzerland, retained only as long as set out in the Verification Privacy Notice, and never sold or disclosed to other customers.
• Opt-out. Model Improvement is on by default. An administrator can switch it off at any time in the dashboard's privacy settings. The opt-out takes effect immediately for all your data not yet used. It can't remove what models have already learned.
• Your notices. You will tell the people you verify that secuveri may use their data for Model Improvement, for example by linking to the Verification Privacy Notice, and you will pass on any objection you receive.

9. Fees and payment

• Fees are set out in the Order. Unless the Order says otherwise, they are in CHF, exclusive of VAT, invoiced monthly in arrears, and payable within 30 days.
• We may suspend the Services after written notice if an invoice is more than 30 days overdue.
• We may change prices for the next renewal term with at least 60 days' notice.

10. Availability and support

• We aim to keep the Services available around the clock, apart from planned maintenance, which we announce in advance where possible.
• Service levels and support terms apply only if they are agreed in the Order.

11. Intellectual property

• secuveri and its licensors keep all rights in the Services, including the software, models and documentation. You get a non-exclusive, non-transferable right to use the Services during the agreement, for your own business purposes.
• You keep all rights in your data.
• If you send us feedback, we may use it without obligation to you.

12. Confidentiality

Each party keeps the other's non-public information confidential and uses it only for the agreement. This obligation continues for 5 years after the agreement ends, and indefinitely for trade secrets and personal data.

13. Liability

• Neither party limits liability for intent or gross negligence, or where the law forbids a limitation.
• Otherwise, each party's total liability under the agreement is limited to the fees paid or payable by the Customer in the 12 months before the event giving rise to the claim.
• Neither party is liable for indirect or consequential damage, lost profit or lost data, to the extent the law permits.
• secuveri is not liable for decisions you make based on results (section 6), except where the result was caused by our breach of this agreement.

14. Indemnity

You will indemnify secuveri against third-party claims arising from:

• your use of the Services in breach of sections 4 or 5;
• data you submit without being entitled to do so.

15. Term and termination

• The agreement runs for the term in the Order and renews automatically for the same period unless either party gives 30 days' notice before the end of the term.
• Either party may terminate immediately for a material breach not fixed within 30 days of written notice.
• When the agreement ends, your access stops, you can export your results for 30 days, and we then delete your data as set out in the DPA, unless the law requires us to keep it.

16. Changes to these Terms

• We may update these Terms. For material changes, we give Customers at least 30 days' notice by email or in the dashboard.
• If you object, you can terminate before the change takes effect. Otherwise the new Terms apply from that date.

17. Governing law and jurisdiction

These Terms are governed by Swiss law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction is Zug, Switzerland.

18. Website visitors

You may use secuveri.com for information. Content on the website is provided without warranty. Links to other sites are outside our responsibility. Our Imprint and Privacy Policy also apply.