Terms of service

Version 1.3 · 14 September 2026. Supersedes version 1.2 of 14 September 2026, version 1.1 of 4 September 2026 and version 1.0 of 9 August 2026, which we keep and will send you on request if you bought under them. What changed: every paying customer can now call us on (814) 737-0555, Monday to Friday, US Eastern business hours, excluding US federal holidays. In 1.2, the license no longer included updated snapshots of the validation register during the term; anyone who bought under 1.1 keeps what 1.1 promised.

These terms apply when you buy AGILICRYPT™ FIPS CertStanding™ from us. They are written to be read rather than skimmed, and they say what we do not claim as plainly as what we do.

Who you are contracting with

AGILICRYPT LLC, a Pennsylvania limited liability company trading as AGILICRYPT, of 502 W 7th St, Ste 100, Erie, PA 16502, USA (registered office), with mail at 620 Allendale Rd, Ste 60522, King of Prussia, PA 19406, USA. In these terms “we” and “us” mean that company, and “you” means the organization buying the assessment.

These terms are between organizations. We do not sell to consumers. By buying, you confirm you are authorized to enter into this agreement on behalf of your organization.

What you get

Twelve months of FIPS CertStanding. A report naming every affected certificate by number, the vendor’s published position, and the question to put to each supplier — plus a companion document listing what the assessment could not see.

Across the year that includes:

• The assessment tool, licensed to you for the term, with a dated snapshot of the validation register.
• Unlimited runs against your own estate. Re-run after a change, on more machines, or next month. Nothing expires, phones home or counts you.
• Email support, unlimited, to get the tool running, to get your inventory format read correctly, to understand what a term in your report means, and to have any finding you believe is wrong investigated and corrected. Set out in full under Support below.

Two routes, one price.

• Run it yourself — the default. The tool produces the inventory and writes the report on your own machine, in minutes. Nothing is sent to us. Share the result with us or do not, as you choose.
• Send us an inventory and we produce it for you, returned within one to three business days of receiving something usable. That clock starts when your inventory arrives, not when you pay, and is paused while the NIST validation register is unavailable, as set out under Things that stop us performing below.

Every finding is traceable to a specific record in the authoritative public validation register, and cites it. No figure in the report is our opinion.

What this is not

• A report is not a determination of compliance. Whether you meet DFARS 252.204-7012, NIST SP 800-171, CMMC or any other obligation is decided by your contracting officer or assessor, not by us. Our report is evidence you can bring to that conversation.
• It is not legal advice, and we are not your lawyers.
• It is not a security assessment or a penetration test. We do not look for vulnerabilities, and a report saying nothing is affected says nothing about whether you are secure.
• We do not touch your systems. No scanning, no agents, no credentials, no connection into your environment — on any route, ever.

What you provide, and what it has to contain

An inventory of installed software: package names and version numbers. Three columns is enough. Do not send host names — if you want findings grouped by machine, use labels such as system-01. For hardware — network devices, HSMs, appliances — one line each: vendor, model, firmware version.

Please do not send configuration files, private keys, certificates, credentials, network diagrams, IP addressing, or anything containing personal data. We do not need any of it. If it arrives by accident, tell us and we will delete it immediately.

You confirm that you are entitled to give us whatever you send, and that sending it does not breach an obligation you owe to someone else. If your inventory is CUI, use the self-run route — it exists precisely so that data never has to leave your environment.

Scope, and the limits we declare in advance

The assessment covers what your inventory covers, and nothing else. Anything absent from what you send is absent from the report.

Where we cannot reach a conclusion, the report says so. We treat “unknown” as a valid answer and will never present a confident guess in its place — and every coverage gap is listed in the report itself, rather than left for you to discover.

A report finding that no validated cryptography was present is a real finding, and frequently the most important one. It is not a failed assessment and is not grounds for a refund.

Price and payment

$5,000 for twelve months, in US dollars. One price, one number — no per-system charge, no seat count, no platform fee, and no charge that varies with the size of your estate.

Card and invoice are both accepted; invoices are payable on receipt unless we agree otherwise in writing. The term runs twelve months from the date of purchase. It does not renew automatically — we will write to you before it ends, and if you do nothing, it simply stops.

Prices exclude any tax that may apply. Where we are required to charge sales tax, it is added at checkout.

Support

Support requests start at agilicrypt.com/support. Most questions are answered on that page; the rest reach us from it. There is no account to create and no portal to log into.

What is included, without limit and at no further charge: getting the tool running; getting your inventory format read correctly, including writing a new profile for an export we do not yet handle; understanding what any term, label or column in your report means; and investigating any finding you believe is wrong.

A finding that turns out to be wrong is our defect. We reproduce it before answering, we correct it, we re-issue your report at no charge, and we tell you what changed. This is not a service level you can buy a better version of — it is the same for every customer.

What is advisory, and quoted separately: interpreting your findings for a specific assessment, drafting plan-of-action wording for your situation, joining a call with your assessor or contracting officer, and reviewing vendor replies to advise what to do next. That is consulting work on your own contract position rather than support of our software. We will always tell you before anything is chargeable, and nothing is chargeable without your written agreement first.

Response times. A tool that will not run, and a finding you believe is wrong, get a reply the same working day where the request reaches us before 12:00 US Eastern, and the next working day otherwise. Everything else gets a reply within two working days. Working days are Monday to Friday, US Eastern, excluding US federal holidays. Every paying customer, trial included, can also call us on (814) 737-0555, Monday to Friday, US Eastern business hours, excluding US federal holidays. We do not offer 24×7 cover, and we would rather state that here than have you discover it. Optional premium support shortens everything else to the next working day, gives you a named contact, puts a profile for your export format ahead of the queue, and includes two scheduled working sessions a year; it does not change what is included above, and it does not make the urgent cases any faster, because those are already as fast as we go for everyone.

These are commitments we expect to beat rather than targets we hope to reach. If we miss one, say so and we will make it right — on premium support that means a pro-rata refund of the premium fee for the month in question, without argument and without you having to prove anything.

Support is provided in English, by email, for the term of your license.

Refunds

Fees are non-refundable and payment obligations are non-cancellable, except as set out below.

We will try to correct it first. The most common cause is a source-level SBOM: a list of an application’s own libraries rather than the operating system underneath. That is usually a five-minute fix rather than a refund — we will tell you exactly what to send instead, and most people simply send it.

If we cannot correct it within a reasonable period, you may end the license and we will refund a pro-rata portion of the fees paid for the unused part of your term. This is your sole and exclusive remedy where the software does not perform as described, and our entire liability for it — subject always to the final paragraph of “Liability” below, which we do not limit.

Anything else — you change your mind, or the findings are not what you expected — talk to us. We look at those individually and in good faith, but they are not refund cases under these terms. Email support@agilicrypt.com.

Confidentiality — this section is the NDA

What is confidential. Anything either of us gives the other that is marked confidential, or that a reasonable person would understand to be confidential from its nature or the circumstances. It does not have to be marked.

• Yours: your inventories, package and version data, firmware and model data, the composition of your estate, the findings in your report, your contract and compliance position, and the fact and content of our discussions.
• Ours: the tooling and collectors, the registry and snapshot data files, our methods, rule logic and report structure, anything in a bundle issued to you, and our pricing where it is not published.

What is not. Anything public through no fault of the receiving party, already lawfully known without a duty of confidence, independently developed without reference to the other’s information, or lawfully received from a third party free to disclose it. Whoever claims one of these applies has to show it.

What each of us does. Use it only to produce and act on your report. Protect it with at least the care we each use for our own confidential information, and never less than reasonable care. Show it only to people who need it and are under obligations at least as protective — and each of us stays responsible for the people we tell. Tell the other promptly on discovering any unauthorised disclosure, and help contain it.

If a court or an agency compels disclosure, the receiving party may disclose what it must, but — where lawful — gives the other prompt notice, a fair chance to object, and discloses only what is required.

Deletion. Your inventory is deleted on delivery of your report. Either of us may ask the other in writing to return or destroy its confidential information at any time; that happens within thirty days and is confirmed in writing on request. Either may keep one archival copy where a law, regulation or automated backup requires it, and that copy stays subject to this section for as long as it exists.

We name no customer without written permission. We do not quote you, describe your estate, or list you as a client. If we ever want to say that a finding was found — never who, never any detail — we will ask first, and refusing changes nothing about what you receive. Neither of us makes a public statement about the other without the other’s written consent.

How long. These obligations last five years from the date each item was disclosed. Trade secrets stay protected for as long as they remain trade secrets. This section survives the end of everything else here.

If it is breached. Damage to confidence usually cannot be measured in money, so either of us may seek an injunction without proving loss or posting security, in addition to any other remedy. The liability cap below does not limit either party’s obligations under this section.

This section is the agreement. There is nothing further to sign, nothing to wait for, and no separate document to chase before you can send us anything.

Your data

Your inventory is deleted on delivery of your report. We can promise that because a report is reproducible from its recorded snapshot version and assessment date — we do not need to keep your data in order to stand behind our findings. We do not sell or share it, and we do not use it to train anything. The full detail is in our privacy policy, which forms part of these terms.

Who owns what

The report is yours. Use it internally, give it to your auditor, your assessor, your prime contractor, your insurer or your acquirer. You do not need our permission and we charge nothing further for it.

What stays ours is everything the report was made with: our tooling, our registry, our methods and our documentation. Buying a subscription does not license those, and the report may not be resold or republished as a commercial product of your own.

If we give you the software

On the self-run route we send you a bundle — collectors, the assessment tool, and a dated snapshot of the validation record. It is issued to you by name and reference.

You get a license to use it, not ownership of it. That license is non-exclusive, non-transferable, non-sublicensable, revocable, and limited to assessing systems your own organization owns or operates. Run it as often as you like, on as many of your own machines as you like. Nothing in it expires, phones home, or counts you.

What you may not do with it:

• Pass it on. No redistribution, resale, sublicensing, lending, publication, or hosting it as a service — whether or not you charge for it. That includes group companies, contractors and clients unless we agree in writing.
• Use it on someone else’s estate. The license covers your systems. Assessing a customer’s or a supplier’s environment with it is a separate arrangement.
• Take it apart to rebuild it. No derivative works, no reverse engineering, decompiling or disassembling, and no using it — or what you learn from reading it — to build, specify, train or inform a competing or substantially similar product or service.
• Extract the data. The snapshot and registry files are a compiled dataset that took real work to assemble. Do not extract, re-publish, redistribute or incorporate them into anything else.
• Strip the notices. Copyright headers, the license file and the licensee reference stay where they are.

The software and the data files are our confidential information, and the confidentiality section above covers them in both directions. If you breach this section the license ends immediately, no refund is due, and because damage of that kind cannot be measured in money, we may seek an injunction without having to prove loss or post security. Delete the bundle when you have finished with it, and confirm you have done so if we ask. These obligations continue after the engagement ends.

What we warrant, and what we cannot

We warrant that the assessment is performed with reasonable skill and care, by the tooling described, against the validation record as it stood on the assessment date shown on the report. That is a real promise and we stand behind it.

What we cannot warrant, and do not:

• That your inventory is right. We assess what you send. We have no way to detect that a list is stale, partial, or missing a system entirely, and a report cannot be more complete than its input.
• That the record has not moved. A report is a snapshot. Vendors re-validate, certificates are added and revised, and the register changes without notice to us or to you. A report is accurate as at its assessment date and is not maintained afterwards.
• Any particular outcome. We do not warrant that acting on the report will result in a passed assessment, an awarded contract, a renewed policy, or a favourable determination by any agency, assessor, auditor or insurer.

To the fullest extent permitted by law, and apart from the warranty stated above, all other warranties are excluded, including any implied warranty of merchantability, fitness for a particular purpose, and non-infringement.

Liability

We stand behind our findings. The correction-then-refund above is your sole and exclusive remedy where the software does not perform as described. Beyond that, and to the extent the law allows:

• Our total liability is limited to the amount you paid for the assessment the claim relates to.
• We are not liable for indirect or consequential loss — lost contracts, lost profits, lost opportunity or reputational harm.
• You remain responsible for your own compliance. Decisions you take on the basis of our report, and the obligations you owe under your own contracts, remain yours.

Any claim must be brought within twelve months of the date of the report it relates to. After that, it is out of time.

Nothing here limits liability that cannot lawfully be limited, including for fraud, fraudulent misrepresentation, or anything else that cannot be excluded under Pennsylvania law.

You cover us for what you control

You will indemnify and hold us harmless against any claim, loss or cost arising from:

• Data you were not entitled to send us — including anything that breaches an obligation you owe to a third party, and any classified material, personal data, credentials or keys that reach us despite our asking you not to send them.
• Your use of the report, including any representation you make to a customer, agency, assessor, auditor or insurer on the strength of it.
• A claim by anyone you gave the report to, arising from their reliance on it.

Disputes

If something goes wrong, email us first and give us thirty days to put it right. Most things end there, and we would rather fix a problem than argue about one.

If that fails, a dispute goes to the courts named under Governing law below. Both parties waive trial by jury, and each brings claims only on its own behalf rather than as part of any class or representative proceeding. Either party may still use small claims court, and either may go straight to court for an injunction protecting confidential information or intellectual property.

Things that stop us performing

We are not liable for delay or failure caused by something outside our reasonable control — including the public validation register being unavailable, altered, restricted or withdrawn, or a government shutdown or outage affecting access to it.

In practice this affects less than you would expect. Your report is produced from a dated snapshot of the register held locally, so an outage does not stop us assessing your inventory. What it stops is refreshing that snapshot and re-checking each cited certificate against the live record before delivery. If we ever deliver without that final re-check, the report says so on its face and you may take a refund instead.

Governing law

These terms are governed by the laws of the Commonwealth of Pennsylvania, and the courts of Montgomery County, Pennsylvania have jurisdiction. Where a signed agreement between us says something different, that agreement wins.

Changes

We may update these terms. The version that applies to you is the one published on the day you bought, and changes are never applied backwards to a term already paid for. The version and date at the top identify it; we keep every published version and will send you the one you bought under on request.

Accepting these terms

By accepting, you confirm that you are authorized to bind your organization, that you have read the sections above on what this is not, what we warrant, and liability, and that you are entering into this agreement for business purposes and not as a consumer.

The rest

Entire agreement. These terms and our privacy policy are the whole agreement between us on this subject and replace anything said before them. If we later sign a separate NDA or another agreement with you, that signed document wins wherever the two cover the same ground.

Severability. If any part of this is unenforceable, it is cut out and the rest stands.

No waiver. If we do not enforce something immediately, we have not given it up.

Assignment. Neither of us assigns this agreement without the other’s written consent, except as part of a sale of substantially the whole business.

Contact

AGILICRYPT
620 Allendale Rd, Ste 60522
King of Prussia, PA 19406, USA
support@agilicrypt.com