AGILICRYPT™ Terms

Terms of service

Version 1.5 · 2 October 2026. What changed in 1.5: we no longer receive finished reports either. A second read is done on a call while you share your screen, and we keep no copy. What changed in 1.4: the tool now runs only on your own machines. We no longer produce reports from inventories sent to us, and we never ask for your inventory. The one-machine trial has been retired. The $295 plan-line check call is added, with its own section. The tool needs each machine’s operating system and version as well as the software list. Supersedes version 1.4 of 30 September 2026, version 1.3 of 14 September 2026, version 1.2 of 14 September 2026, version 1.1 of 4 September 2026 and version 1.0 of 9 August 2026, which we keep and will send you on request if you bought under them. What changed: every paying customer can now call us on (814) 737-0555, Monday to Friday, US Eastern business hours, excluding US federal holidays. In 1.2, the license no longer included updated snapshots of the validation register during the term; anyone who bought under 1.1 keeps what 1.1 promised.

These terms apply when you buy AGILICRYPT™ FIPS CertStanding™, or a plan-line check call, from us. They are written to be read rather than skimmed, and they say what we do not claim as plainly as what we do.

Who you are contracting with

AGILICRYPT LLC, a Pennsylvania limited liability company trading as AGILICRYPT, of 502 W 7th St, Ste 100, Erie, PA 16502, USA (registered office), with mail at 620 Allendale Rd, Ste 60522, King of Prussia, PA 19406, USA. In these terms “we” and “us” mean that company, and “you” means the organization buying from us.

These terms are between organizations. We do not sell to consumers. By buying, you confirm you are authorized to enter into this agreement on behalf of your organization.

What you get

Twelve months of FIPS CertStanding. A report naming every affected certificate by number, the vendor’s published position, and the question to put to each supplier, plus a companion document listing what the assessment could not see.

Across the year that includes:

How it runs. The tool produces the inventory and writes the report on your own machines, in minutes. Nothing is sent to us, and we never ask for your inventory or your finished report. If you want a second read, we do it on a call while you share your screen.

Every finding is traceable to a specific record in the authoritative public validation register, and cites it. No figure in the report is our opinion.

What we cannot see, stated before you buy. We do not hold your asset register and do not want one. A system missing from the inventory you assess is missing from the findings, and its absence leaves no trace. Reconciling the report against your complete estate is your step, and every report carries the five checks to make. No assessment tool offers complete detection, here or anywhere in security.

What this is not

We are not a cryptographic testing laboratory. We do not test, validate or certify cryptographic modules, and we cannot issue, extend, renew or influence any CMVP certificate. We analyze the public validation records in depth and tell you what they say about the software you run.

What the tool needs

An inventory of installed software (package names and version numbers) and each machine’s operating system and version. A FIPS 140 validation applies only to the operational environments listed on its certificate, so without the operating system the report cannot confirm which certificate applies, and says so. For hardware (network devices, HSMs, appliances), one line each: vendor, model, firmware version.

The inventory and the finished report stay on your machines. If you want a second read, we do it on a call while you share your screen, and you may replace machine names with labels such as system-01 first. Please do not send configuration files, private keys, certificates, credentials, network diagrams, IP addressing, or anything containing personal data. If it arrives by accident, tell us and we will delete it immediately.

You confirm that you are entitled to give us whatever you send, and that sending it does not breach an obligation you owe to someone else.

Scope, and the limits we declare in advance

The assessment covers what your inventory covers, and nothing else. Anything absent from the inventory the tool reads is absent from the report.

Where we cannot reach a conclusion, the report says so. We treat “unknown” as a valid answer and will never present a confident guess in its place, and every coverage gap is listed in the report itself, rather than left for you to discover.

A report finding that no validated cryptography was present is a real finding, and frequently the most important one. It is not a failed assessment and is not grounds for a refund.

Price and payment

$5,000 for twelve months, in US dollars. One price, one number: no per-system charge, no seat count, no platform fee, and no charge that varies with the size of your estate.

Card and invoice are both accepted; invoices are payable on receipt unless we agree otherwise in writing. The term runs twelve months from the date of purchase. It does not renew automatically. We will write to you before it ends, and if you do nothing, it simply stops.

Prices exclude any tax that may apply. Where we are required to charge sales tax, it is added at checkout.

The plan-line check call

$295, paid in advance by card. A 45-minute video call. We go through your certificate list and the encryption line in your plan of action with you, and tell you plainly where each one stands on the public record.

Support

Support requests start at agilicrypt.com/support. Most questions are answered on that page; the rest reach us from it. There is no account to create and no portal to log into.

What is included, without limit and at no further charge: getting the tool running; getting your inventory format read correctly, including writing a new profile for an export we do not yet handle; understanding what any term, label or column in your report means; and investigating any finding you believe is wrong.

A finding that turns out to be wrong is our defect. We reproduce it before answering, we correct it, we re-issue your report at no charge, and we tell you what changed. This is not a service level you can buy a better version of. It is the same for every customer.

What is advisory, and quoted separately: interpreting your findings for a specific assessment, drafting plan-of-action wording for your situation, joining a call with your assessor or contracting officer, and reviewing vendor replies to advise what to do next. That is consulting work on your own contract position rather than support of our software. We will always tell you before anything is chargeable, and nothing is chargeable without your written agreement first.

Response times. A tool that will not run, and a finding you believe is wrong, get a reply the same working day where the request reaches us before 12:00 US Eastern, and the next working day otherwise. Everything else gets a reply within two working days. Working days are Monday to Friday, US Eastern, excluding US federal holidays. Every paying customer can also call us on (814) 737-0555, Monday to Friday, US Eastern business hours, excluding US federal holidays. We do not offer 24×7 cover, and we would rather state that here than have you discover it. Optional premium support shortens everything else to the next working day, gives you a named contact, puts a profile for your export format ahead of the queue, and includes two scheduled working sessions a year; it does not change what is included above, and it does not make the urgent cases any faster, because those are already as fast as we go for everyone.

These are commitments we expect to beat rather than targets we hope to reach. If we miss one, say so and we will make it right. On premium support that means a pro-rata refund of the premium fee for the month in question, without argument and without you having to prove anything.

Support is provided in English, by email, for the term of your license.

Refunds

Fees are non-refundable and payment obligations are non-cancellable, except as set out below and in the plan-line check call section.

If the tool cannot produce a report at all from your inventory, you do not pay for it: we will either correct it or refund you. That one is not a judgment call. Our tool is built to stop and say “this input cannot answer the question” rather than return a clean-looking result that means nothing, so either we could answer or we could not, and if we could not, you should not be paying for it.

We will try to correct it first. The most common cause is a source-level SBOM: a list of an application’s own libraries rather than the operating system underneath. That is usually a five-minute fix rather than a refund. We will tell you exactly what to send instead, and most people simply send it.

If we cannot correct it within a reasonable period, you may end the license and we will refund a pro-rata portion of the fees paid for the unused part of your term. This is your sole and exclusive remedy where the software does not perform as described, and our entire liability for it, subject always to the final paragraph of “Liability” below, which we do not limit.

Anything else (you change your mind, or the findings are not what you expected): talk to us. We look at those individually and in good faith, but they are not refund cases under these terms. Email support@agilicrypt.com.

Confidentiality: this section is the NDA

Accepting these terms puts a mutual non-disclosure agreement in force between us. There is nothing further to sign before anything is exchanged. It binds us exactly as it binds you, and it is in force from the moment you accept.

What is confidential. Anything either of us gives the other that is marked confidential, or that a reasonable person would understand to be confidential from its nature or the circumstances. It does not have to be marked.

What is not. Anything public through no fault of the receiving party, already lawfully known without a duty of confidence, independently developed without reference to the other’s information, or lawfully received from a third party free to disclose it. Whoever claims one of these applies has to show it.

What each of us does. Use it only for the purpose it was shared for: your report, or your plan-line check call. Protect it with at least the care we each use for our own confidential information, and never less than reasonable care. Show it only to people who need it and are under obligations at least as protective, and each of us stays responsible for the people we tell. Tell the other promptly on discovering any unauthorised disclosure, and help contain it.

If a court or an agency compels disclosure, the receiving party may disclose what it must, but, where lawful, gives the other prompt notice, a fair chance to object, and discloses only what is required.

Do not send us CUI. Or classified material, export-controlled technical data, personal data, credentials, private keys, or configuration files. We do not need any of it and we ask for none of it.

Your inventory may well be CUI, which is why the tool runs inside your own environment and nothing leaves your network. It works that way because DFARS 252.204-7012 requires CUI to remain in systems meeting NIST SP 800-171, and our email is not such a system. Nothing in these terms authorizes either of us to transmit material whose handling is restricted by law, regulation or another contract. If restricted material reaches us by accident, tell us. We delete it immediately and confirm that we have.

Deletion. We never receive your inventory. Either of us may ask the other in writing to return or destroy its confidential information at any time; that happens within thirty days and is confirmed in writing on request. Either may keep one archival copy where a law, regulation or automated backup requires it, and that copy stays subject to this section for as long as it exists.

We name no customer without written permission. We do not quote you, describe your estate, or list you as a client. If we ever want to say that a finding was found (never who, never any detail), we will ask first, and refusing changes nothing about what you receive. Neither of us makes a public statement about the other without the other’s written consent.

How long. These obligations last five years from the date each item was disclosed. Trade secrets stay protected for as long as they remain trade secrets. This section survives the end of everything else here.

If it is breached. Damage to confidence usually cannot be measured in money, so either of us may seek an injunction without proving loss or posting security, in addition to any other remedy. The liability cap below does not limit either party’s obligations under this section.

This section is the agreement. There is nothing further to sign, nothing to wait for, and no separate document to chase before anything is exchanged.

Your data

We never receive your inventory. The tool runs on your own machines and sends nothing to us, and we do not receive your finished report either. On a second-read call we see only what you choose to show us on screen; we do not record the call and we keep no copy, and we do not use anything we see to train anything. The full detail is in our privacy policy, which forms part of these terms.

Who owns what

The report is yours. Use it internally, give it to your auditor, your assessor, your prime contractor, your insurer or your acquirer. You do not need our permission and we charge nothing further for it.

What stays ours is everything the report was made with: our tooling, our registry, our methods and our documentation. Buying a subscription does not license those, and the report may not be resold or republished as a commercial product of your own.

If we give you the software

We send you a bundle: collectors, the assessment tool, and a dated snapshot of the validation record. It is issued to you by name and reference.

You get a license to use it, not ownership of it. That license is non-exclusive, non-transferable, non-sublicensable, revocable, and limited to assessing systems your own organization owns or operates. Run it as often as you like, on as many of your own machines as you like. Nothing in it expires, phones home, or counts you.

What you may not do with it:

We are not hiding the code, and that is deliberate. The collectors are plain text specifically so your administrator can read every line before running them. A tool you cannot inspect has no business on your network. Reading it is expected and encouraged. Reusing it is what these restrictions are about.

The software and the data files are our confidential information, and the confidentiality section above covers them in both directions. If you breach this section the license ends immediately, no refund is due, and because damage of that kind cannot be measured in money, we may seek an injunction without having to prove loss or post security. Delete the bundle when you have finished with it, and confirm you have done so if we ask. These obligations continue after the engagement ends.

Nobody but you may rely on the report. You are free to share it, and sharing it creates no duty of care from us to whoever receives it and no right for them to bring a claim against us. The report is prepared for you, on the information you gave us, on the date stated on it. If a third party intends to rely on it, they must contract with us separately.

What we warrant, and what we cannot

We warrant that the assessment is performed with reasonable skill and care, by the tooling described, against the validation record as it stood on the assessment date shown on the report. That is a real promise and we stand behind it.

What we cannot warrant, and do not:

To the fullest extent permitted by law, and apart from the warranty stated above, all other warranties are excluded, including any implied warranty of merchantability, fitness for a particular purpose, and non-infringement.

Liability

We stand behind our findings. The correction-then-refund above is your sole and exclusive remedy where the software does not perform as described. Beyond that, and to the extent the law allows:

Any claim must be brought within twelve months of the date of the report it relates to. After that, it is out of time.

Nothing here limits liability that cannot lawfully be limited, including for fraud, fraudulent misrepresentation, or anything else that cannot be excluded under Pennsylvania law.

You cover us for what you control

You will indemnify and hold us harmless against any claim, loss or cost arising from:

Disputes

If something goes wrong, email us first and give us thirty days to put it right. Most things end there, and we would rather fix a problem than argue about one.

If that fails, a dispute goes to the courts named under Governing law below. Both parties waive trial by jury, and each brings claims only on its own behalf rather than as part of any class or representative proceeding. Either party may still use small claims court, and either may go straight to court for an injunction protecting confidential information or intellectual property.

Things that stop us performing

We are not liable for delay or failure caused by something outside our reasonable control, including the public validation register being unavailable, altered, restricted or withdrawn, or a government shutdown or outage affecting access to it.

Anything we owe you waits for as long as that lasts, and resumes when access does. We will tell you the same day we know, and you can wait or take a full refund. Your choice, no argument.

In practice this affects less than you would expect. The tool carries a dated snapshot of the register, so an outage does not stop you running it on your own machines. What it stops is us refreshing that snapshot. Every report states the snapshot date it used.

Governing law

These terms are governed by the laws of the Commonwealth of Pennsylvania, and the courts of Montgomery County, Pennsylvania have jurisdiction. Where a signed agreement between us says something different, that agreement wins.

Changes

We may update these terms. The version that applies to you is the one published on the day you bought, and changes are never applied backwards to a term already paid for. The version and date at the top identify it; we keep every published version and will send you the one you bought under on request.

Accepting these terms

Nobody receives a report without accepting these terms first. On the card route you tick the box at checkout. On the invoice route the invoice states that payment is acceptance, and we will not start work until you have confirmed it in writing.

By accepting, you confirm that you are authorized to bind your organization, that you have read the sections above on what this is not, what we warrant, and liability, and that you are entering into this agreement for business purposes and not as a consumer.

The rest

Entire agreement. These terms and our privacy policy are the whole agreement between us on this subject and replace anything said before them. If we later sign a separate NDA or another agreement with you, that signed document wins wherever the two cover the same ground.

Severability. If any part of this is unenforceable, it is cut out and the rest stands.

No waiver. If we do not enforce something immediately, we have not given it up.

Assignment. Neither of us assigns this agreement without the other’s written consent, except as part of a sale of substantially the whole business.

Contact

AGILICRYPT
620 Allendale Rd, Ste 60522
King of Prussia, PA 19406, USA
support@agilicrypt.com