Terms of use

These terms govern the use of VerifBox. Please read them before using the Service. Nothing in these terms excludes or limits any right, remedy or protection that cannot lawfully be excluded or limited.

1. Who we are

VerifBox (the “Service”) is operated by HTTPS CARD — Internet Identity Card Limited, a company registered in England and Wales under number 09168431, whose registered office is at 124 City Road, London EC1V 2NX, United Kingdom (“we”, “us”). Contact: contact@verifbox.com. The Service is currently provided free of charge.

2. How the Service works

The SHA-256 fingerprint of your file is computed on your device, by your browser. The file itself is never transmitted to the Service. Only the fingerprint is sent. The Service adds the date and time according to its server clock, in Coordinated Universal Time (UTC), and signs the result with two signatures, Ed25519 and ML-DSA-65 (NIST FIPS 204), producing a proof file (.verifbox.json). The fingerprint and the signed attestation are also submitted, through the open OpenTimestamps protocol, for anchoring in the Bitcoin blockchain, and the fingerprint is submitted to IIC TSA for an optional RFC 3161 time-stamp token (section 5). The Service keeps no copy of your files or of their fingerprints.

3. What a proof establishes, and what it does not

A VerifBox proof attests, through our signature, that a file identical, byte for byte, to the one whose fingerprint it contains existed no later than the date and time stated in the proof. That date relies on trust in VerifBox as the issuer. Once completed, the Bitcoin anchors provide additional evidence, independent of us, that the fingerprint and the signed attestation existed before the relevant Bitcoin blocks.

A proof does not establish who created, owns, submitted or possesses the file, when it was first created, its originality, its content, its accuracy or its lawfulness, nor any intellectual property right.

4. Not a certification service

VerifBox is not a notary, a certification authority, a qualified trust service provider, an intellectual property office or a legal service, and we do not give legal advice. A proof is a simple electronic timestamp, not a qualified electronic timestamp. Under Article 41 of Regulation (EU) No 910/2014 (eIDAS), and of the equivalent regulation retained in United Kingdom law (UK eIDAS), within their respective scope, an electronic timestamp may not be denied legal effect or admissibility as evidence solely because it is electronic or not qualified. Its evidential value is assessed by the competent court or authority, and we do not guarantee that a proof will be accepted or given any particular weight.

You must not present a proof as a copyright registration, a certificate of authorship or ownership, a notarised document or a qualified timestamp, nor state or imply that we have reviewed or approved the content of a file.

5. Bitcoin anchors and time-stamp token

The Bitcoin anchors rely on OpenTimestamps servers run by independent third parties and on the Bitcoin network, which we do not operate or control. We do not guarantee that an anchor will be completed, nor how long it will take. If anchoring fails, the signed proof remains valid. To obtain the completed anchor, you must return to the Verify page and keep the completed proof. A completed anchor can be verified without VerifBox, using standard OpenTimestamps tools.

Since 10 October 2026, the proof also includes an RFC 3161 time-stamp token issued by IIC TSA, a non-qualified time-stamping service operated by the same company as VerifBox, and therefore not an independent third party. If the token cannot be obtained, the proof is issued without it and remains valid. A token can be verified without VerifBox, using standard tools such as OpenSSL.

6. Your responsibilities for your files and proofs

You must keep the original file and the proof, without modifying them: any change to the file, even a single byte, changes its fingerprint, and the proof will no longer apply to it. As we keep no copy, we cannot recover or reissue a lost proof. You are responsible for keeping suitable backups and for deciding whether the Service is appropriate for your intended purpose.

7. Acceptable use

You must use the Service lawfully. You must not attempt to compromise, overload or disrupt it, circumvent its rate limits or security measures, make mass automated submissions without our agreement, use it to commit or facilitate fraud, or misrepresent the nature of a proof as described in section 4.

8. Signing keys and independent verification

Our public signing keys are published on verifbox.com, and their fingerprint is also published independently in the DNSSEC-signed DNS of internetidentitycard.com and on GitHub. The proof format, the key lifecycle and the verification procedure are described in the specification, and independent verification tools are made available.

When a key is replaced, the previous key attests the new one, and retired keys remain published so that the proofs they signed can still be verified. If a private key is compromised, we will mark the key as revoked and publish the date of revocation. Since a compromised key could be used to produce backdated proofs, a proof signed with a revoked key is only reliable if the Bitcoin anchor of its attestation is recorded in a block dated before the revocation; for a proof issued without an anchor of its attestation, the signed date can no longer be relied upon after a revocation. No cryptographic algorithm or key can be guaranteed to remain secure indefinitely.

9. Availability and changes to the Service

The Service is provided as is and as available. We do not guarantee that it will be uninterrupted, error-free or permanently available, and we may modify, suspend or discontinue all or part of it, in particular for security, technical or legal reasons. Proofs already issued are designed to remain verifiable independently of the Service, using the published keys and independent tools.

10. Security measures

We may take immediate measures where reasonably necessary to protect the Service, its users or third parties, including rate limiting, blocking malicious traffic, suspending a feature or revoking a key, without prior notice where notice would increase the risk.

11. Intellectual property

The rights in the VerifBox software, website, design, brand and documentation belong to us or to our licensors, unless stated otherwise. Open-source components remain subject to their own licences. You keep all the rights you hold in your files: using the Service transfers no rights in them to us.

12. Privacy

The processing of personal data in connection with the Service is described in the privacy policy. VerifBox uses no cookies.

13. Liability

Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited. If you are a consumer, nothing in these terms affects your statutory rights, including, where applicable, the requirement that a service be provided with reasonable care and skill.

Subject to the above, and to the extent permitted by law, we are not liable for indirect or consequential losses, nor for losses resulting from the loss of a file or proof, from the failure of third-party infrastructure beyond our reasonable control, or from the use of a proof for a purpose for which the Service was not designed. If you use the Service in the course of a business, we are in addition not liable, to the extent permitted by law, for loss of profit, revenue, business, contracts, goodwill or anticipated savings, and you are responsible for the losses and reasonable costs caused to us by your unlawful use of the Service.

14. Changes to these terms

We may update these terms to reflect changes to the Service, to technology or to the law. The current version is published on this page, with the date of its last update. Changes do not affect rights that have already accrued.

15. Governing law, disputes and jurisdiction

These terms are governed by the laws of England and Wales. If you are a consumer, this choice does not deprive you of the protection of the mandatory provisions of the law of your country of residence.

In the event of a dispute, please contact us first at contact@verifbox.com: we will seek to resolve it amicably and in good faith. Failing that, the courts of England and Wales have non-exclusive jurisdiction. If you are a consumer, you may also bring proceedings before the courts of your country of residence, and use the alternative dispute resolution mechanisms available there, where the law so provides.

16. General provisions

If any provision of these terms is held invalid or unenforceable, it applies to the extent that it remains valid, and the other provisions remain in force. A failure or delay in exercising a right is not a waiver of it. We may transfer our rights and obligations under these terms in the context of a reorganisation or a transfer of our business, provided that your rights are not reduced. No person other than you and us has any right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999.

These terms are available in English and French. In the event of any discrepancy between the two versions, the English version prevails.

Last updated: 10 October 2026.