API Terms

1. Definitions

"API" means ProofLedger's programmatic interface, currently version 1, documented at proofledger.io/api.html and proofledger.io/openapi.json, including webhooks and bundles.

"API Key" means a credential beginning with sk_ issued from your account.

"Proof" means a record created through the API: a SHA-256 hash together with the filename and record identifier you choose, the time we received it, and the blockchain transactions that anchor it.

"Certificate" means the public certificate page and verification page we publish for a Proof.

"Bundle" means the JSON document returned by the bundle endpoint and in webhook payloads, in the file format read by the open-source verify-proof package.

"Public Chains" means the Polygon blockchain network and, for Proofs anchored before October 15, 2026, the Bitcoin network. Bitcoin anchoring is no longer offered.

"End User" means a person or organization that uses your product, and whose files you hash and submit to the API.

"Partner Data" means everything you send to the API: hashes, filenames, record identifiers, webhook addresses, and any other field you fill, together with the records we create from it. "Partner" and "partner branding" are used in these API Terms and on our site for convenience; nothing here creates a partnership, joint venture, agency or franchise.

2. License and API Keys

Subject to these API Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to use the API to build and operate your own product or internal systems, including offering proofs to your End Users as a feature of your product.

API Keys belong to your account. Keep them secret. You are responsible for every request made with your keys, whether or not you authorized it, until you revoke the key from your account page or tell us at support@proofledger.io. You may share a key with a hosting or infrastructure provider that operates your product for you; you may not give keys or raw API access to anyone else. We may rotate, suspend or revoke a key when we have reason to believe it is compromised or misused, and we will tell you when we do unless the law prevents it.

3. What a Proof Is, and Is Not

A Proof shows that a file with a specific SHA-256 hash existed no later than the time its hash was anchored on a Public Chain, and that a file which still produces that hash has not changed since. That is all it shows.

A Proof does not show who created a file, who owns it, what it contains, whether the content is true, or whether anyone had a right to it. It is not a copyright registration, a notarization, an electronic signature, or a certification of authenticity. ProofLedger does not see, open, examine or evaluate any file; we receive a hash. Whether any court, insurer, platform, registry or other third party gives a Proof weight is their decision, not ours, and we make no promise about it. Nothing on our site or in the API is legal advice.

4. Your End Users

Your End Users are your customers, not ours, unless they open their own ProofLedger account. You are responsible for your relationship with them, including your own terms, your privacy notice, your support, and your compliance with the laws that apply to your product. In particular you agree that:

• You have the right, under your own agreements and applicable law, to compute a hash of each file you submit and to send us the Partner Data you send.
• Your privacy notice tells End Users, in substance, that a cryptographic hash of their file, with the filename and identifier you choose, is sent to ProofLedger and published permanently on public blockchains, and that the file itself is not sent. The hash cannot be turned back into the file, but the fact of its existence at that time becomes public and cannot be withdrawn.
• You do not put personal data into a filename or record identifier unless you are entitled to disclose it to us and to have it appear on a public Certificate. Filenames appear on Certificates; record identifiers do not, but we store them.
• You handle End User requests about their data in your product. Where a request needs something from us (for example, deleting our stored filename for a Proof), you forward it to us and we help, subject to Section 9.

5. Acceptable Use of the API

In addition to Section 4 of the Terms, you agree not to:

• Resell, sublicense or expose the API itself, API Keys or raw API access to third parties, or operate a service whose only product is unbranded access to our free tier. Offering proofs as a feature inside your own product is what the API is for and is allowed.
• Open multiple accounts, rotate keys, or use other means to exceed the monthly cap or per-minute limit that applies to your plan.
• Submit hashes of material whose creation or possession is unlawful, or use the API to harass, defraud or deceive anyone.
• Send requests to the API, the Certificate pages or the verification endpoint by any means other than the documented interfaces, or at a rate or in a pattern intended to degrade the service for others.
• Probe, scan or test the security of the API or of any ProofLedger system without written permission, or try to access another account's Proofs, keys or webhooks.
• Register a webhook address that points at a private, internal or metadata network. We refuse such addresses, and attempting to reach one is a violation.
• Use the API in violation of United States export control or sanctions laws, or if you are located in, or ordinarily resident in, a country or territory subject to comprehensive U.S. sanctions, or are a person on a U.S. government restricted-party list.

6. How You Describe Proofs to Your Users

Because a Proof is easy to over-sell, this section is a condition of your license. In your product, your marketing and your support materials you must describe a Proof accurately and consistently with Section 3. In particular you must not state or imply that:

• a Proof establishes authorship, ownership, originality or copyright, or that it "protects," "registers" or "copyrights" a work;
• ProofLedger or your product has verified, certified, authenticated or reviewed a file's content;
• a Proof is legally binding, guarantees admissibility, or has been accepted by any court, agency, registry or insurer, unless that is true and you can show it;
• ProofLedger endorses, sponsors or is affiliated with your product beyond the fact that your product uses the ProofLedger API.

You may truthfully say that your product timestamps or anchors files with ProofLedger, link to Certificates, and show the information a Certificate or Bundle contains. You may not alter the content of a Certificate, present an edited copy as a Certificate, or remove or hide the ProofLedger verification link when you show one.

7. Partner Branding

On request, we may show your product name on the Certificates for Proofs your account creates, in the form "Recorded through <your product> · Anchored by ProofLedger." Approval is at our discretion and follows a check that the name is yours to use. By requesting branding you confirm that you own, or are licensed to use, the name you give us, and you grant us a non-exclusive, royalty-free license to display it on Certificates, verification pages and related API responses for as long as those Proofs exist.

Because Proofs are immutable records, a name is copied onto each Proof when the Proof is created and stays on those Proofs even if the name is later changed, revoked or removed. Changing or revoking a name only affects Proofs created afterwards. You accept this before requesting branding.

We may decline, change or revoke branding at any time, including when we receive a complaint that the name infringes someone's rights, when it is used in a way that breaches Section 6, or when your account is not in good standing. The wording of the branding line is fixed. Branding does not license you to use the ProofLedger name, logo or marks for anything beyond the statement that your product uses the ProofLedger API; any other use needs our written permission.

8. Limits, Plans and Fees

Each plan includes a monthly number of API proofs and each API Key is limited to a number of requests per minute. The current figures are on the pricing page and in the API reference. When a limit is reached the API refuses the request and tells you why; we do not bill overage. Higher limits are available by agreement. Fees for paid plans are those in the Terms and on the pricing page; We may change limits and prices as the Terms allow; changes to limits that reduce what you can do are announced on the changelog at least thirty (30) days before they take effect, except where needed to protect the service or comply with law.

9. Data

What we hold. For each Proof we store the hash, the filename and record identifier you sent, when we received it, which API Key created it, and the blockchain transaction details. For your account we hold the account email, API Key metadata (never the key itself, only a hash of it), webhook addresses and the secret for each, a log of webhook deliveries, and ordinary server logs that include request times, paths and IP addresses. We never receive files.

What becomes public. The hash is published on the Public Chains, permanently, by design; it cannot be deleted or altered by us or anyone. The Certificate for each Proof is a public page showing the hash, the filename, the times and the transactions, and your product name where branding is approved. Record identifiers and your account email are not shown on Certificates. A Certificate URL is not listed anywhere by us, but anyone who has it can open it.

Our role. Where Partner Data includes personal data of your End Users, you decide why and how that data is processed and we process it on your behalf only to provide the API and the Certificates, to keep the service secure and running, to comply with law, and as these API Terms describe. We do not sell Partner Data, use it for advertising, or combine it with data from other customers except in aggregate statistics that identify no one. We use the service providers listed on our subprocessors page; we update that page before adding one that will receive Partner Data. Partners that need a signed data processing agreement, including standard contractual clauses for transfers out of the European Economic Area, the United Kingdom or Switzerland, can ask for one at support@proofledger.io. Our data is stored and processed in the United States.

Security. We apply the practices described on our security page. If we confirm a breach of security that affects Partner Data in our systems, we will notify the email on your account without undue delay after confirming it, with what we know at the time.

Deletion and export. You can list and export your Proofs through the API at any time. Deleting your account removes our stored records for your Proofs, keys and webhooks. It does not and cannot remove anything from the Public Chains, and we may keep records we need for billing, security, legal compliance or to defend a claim.

10. Webhooks

Webhook endpoints must be public https addresses that you control. We sign every delivery, and you are responsible for checking the signature before trusting a payload. Delivery is at least once; the event identifier lets you ignore repeats. After repeated failed deliveries we switch an endpoint off and email the account; nothing is lost, because the same information is available from the API. Webhook payloads contain Partner Data, including the Bundle, so the receiving system is part of your responsibility under Section 4.

11. Availability, Changes and Continuity

No service level. The API is provided without any uptime commitment. We work to keep it available and to anchor Proofs promptly, but anchoring depends on the Public Chains and on third-party infrastructure that we do not control. A blockchain transaction can be delayed, and a transaction that has been included can in rare cases be dropped or reordered by the network before it is final; we do not guarantee inclusion or finality.

Versioning. Version 1 of the API only gains fields and endpoints; we do not remove or rename what exists. If we ever need to make a change that would break a correctly built integration, we announce it on the changelog at least ninety (90) days before it takes effect, except for changes required for security or by law, which we make as quickly as the situation demands and explain afterwards.

If the API or ProofLedger is discontinued. If we discontinue the API or the service, we will say so on the changelog and by email to the address on your account at least ninety (90) days in advance where that is within our control, and we will keep Certificate pages available during that period. Whatever happens to us, the anchors already written to the Public Chains remain there, Bundles you have stored keep working with the open-source verify-proof package (MIT licensed, so it can be run and maintained by anyone), and the verification procedure is documented in each Bundle. Storing the Bundle for each Proof next to the file it describes is the way to make your records independent of us, and we recommend that you do it.

12. Confidentiality

API Keys and webhook secrets are confidential and you must protect them as you protect your own credentials. We treat the details of your integration that are not public (your webhook addresses, record identifiers, usage patterns) as confidential and disclose them only to the service providers that need them to run the service, or as required by law.

13. Disclaimer of Warranties

TO THE FULLEST EXTENT PERMITTED BY LAW, THE API, THE CERTIFICATES, THE BUNDLES AND EVERYTHING ELSE WE PROVIDE ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, OR THAT THE API WILL BE UNINTERRUPTED OR ERROR-FREE. WE DO NOT WARRANT THAT ANY PROOF WILL BE ACCEPTED, RELIED ON OR GIVEN ANY WEIGHT BY ANY THIRD PARTY, OR THAT THE PUBLIC CHAINS WILL CONTINUE TO OPERATE. Some jurisdictions do not allow the exclusion of implied warranties, so parts of this section may not apply to you.

14. Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY LAW, PROOFLEDGER AND ITS MEMBERS, MANAGERS, EMPLOYEES, CONTRACTORS AND SERVICE PROVIDERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, ARISING OUT OF OR RELATING TO THE API OR THESE API TERMS, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY. OUR TOTAL LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE API OR THESE API TERMS IS LIMITED TO THE GREATER OF (A) THE AMOUNTS YOU PAID US IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM AND (B) ONE HUNDRED U.S. DOLLARS (US$100). These limits do not apply to liability that cannot be limited by law, including liability for fraud or willful misconduct. Some jurisdictions do not allow such limitations, so parts of this section may not apply to you.

15. Indemnity

You will defend, indemnify and hold harmless ProofLedger and its members, managers, employees and contractors from and against any third-party claim, and the resulting damages, costs and reasonable attorneys' fees, arising out of (a) your product or your End Users' use of it, (b) Partner Data, including any claim that you lacked the right to submit it, (c) any statement you make about Proofs that breaches Section 6, (d) a name you asked us to display under Section 7, or (e) your breach of these API Terms or of applicable law. We will notify you promptly of any such claim, let you control the defense and settlement (except that you may not admit fault on our behalf or settle on terms that bind us without our written consent), and cooperate at your expense.

16. Term, Suspension and Termination

These API Terms apply from the moment you create an API Key and for as long as you hold one. You may stop at any time by revoking your keys or closing your account. We may suspend API access, with notice where practicable, if we reasonably believe your use breaches these API Terms, threatens the security or stability of the service, or exposes us or others to legal risk, and we may terminate your API access for a breach you do not cure within fourteen (14) days of notice, or immediately for a breach that cannot be cured. On termination your keys stop working and webhooks stop, Proofs you created and their Certificates remain public and verifiable, and Bundles you stored keep working. Sections 3, 4, 6, 7 (as to Proofs already created), 9, 12, 13, 14, 15, 16 and 18 survive.

17. Changes to These API Terms

We may change these API Terms. For a change that materially reduces your rights or increases your obligations we will post a notice on the changelog and email the address on your account at least thirty (30) days before it takes effect, except for changes required by law or needed to protect the service, which take effect when posted. Other changes take effect when posted here, with the date at the top updated. Continued use of the API after a change takes effect is acceptance of it; if you do not agree, revoke your keys before then.

18. General

Governing law and venue. These API Terms are governed by the laws of the State of Florida, without regard to its conflict of law principles. Any dispute arising under or relating to them will be resolved in the state or federal courts located in Citrus County, Florida, and you consent to personal jurisdiction there.

Independent parties. You and ProofLedger are independent contractors. Neither can bind the other.

Assignment. You may not assign these API Terms without our written consent, except to a successor to your whole business that agrees in writing to be bound. We may assign them to a successor to the ProofLedger service.

Notices. Notices to us go to support@proofledger.io or the postal address above. Notices to you go to the email on your account.

Entire agreement; severability; waiver. These API Terms, the Terms and the policies they reference are the entire agreement about the API and replace any earlier understanding. If a provision is unenforceable it is limited to the minimum extent necessary and the rest stands. A failure to enforce a provision is not a waiver of it.

Electronic acceptance. You agree that creating an API Key or sending a request to the API is your signature to these API Terms, and that notices and records exchanged electronically satisfy any requirement that they be in writing.

19. Contact

ProofLedger LLC
PO Box 24
Floral City, FL 34436
support@proofledger.io