Terms of Service

Acceptance of terms

These Terms of Service ("Terms") govern your use of the services provided by 0byte Lab ("0byte", "we", "us") — including 0byte.tech, the registry API, the dashboard, the command-line tool, and our Python and TypeScript SDKs (together, the "Service"). By accessing or using the Service, you agree to these Terms. If you do not agree, do not use the Service.

What the Service does

0byte is a C2PA certification and signing service for AI-generated content. Stamping does two things in one call: it signs a spec-compliant C2PA manifest (Content Credentials) into your file using our managed certificate, and it derives a perceptual fingerprint which is anchored in a public, append-only transparency log. Verification reads that evidence back — the embedded manifest and the registry record — and returns a verdict with its evidence cited.

The two halves exist because platforms routinely strip embedded metadata on upload. When the manifest is stripped, the fingerprint in the registry can still recover the proof — including from a screenshot or a re-encode.

Not every format supports an embedded manifest. Where one cannot be embedded, stamping still registers the fingerprint and returns a proof, and the response tells you which you got via its binding field. The current format matrix is published in our documentation and is part of what you should read before you build against the Service.

Verdicts are evidence-only. The Service reports what the evidence shows and never returns a probability that content is AI-generated as its verdict. A separate, opt-in AI-likelihood estimate is available through the analyze endpoint; it is explicitly statistical and is never part of a verdict.

Accounts and API keys

• You are responsible for keeping your API keys and credentials secure. We store keys only as hashes and cannot recover one for you.
• You are responsible for all activity that occurs under your account and keys.
• You must provide accurate information and keep it current.
• Notify us immediately at hello@0byte.tech if you suspect unauthorized use. Keys are individually revocable and stop working the moment they are revoked.

Stamping, our certificate, and what you assert

When you stamp, we sign a manifest on your behalf using 0byte's managed signing certificate, so you do not have to procure an X.509 certificate or run signing infrastructure. Bringing your own certificate is on our roadmap and is not available today.

The manifest records what you tell us: the provider, the model, and — if you supply it — a creator name and URL that is named as the claim generator, so the credential reads as generated by you. Those are your assertions, made on your instruction. You represent that they are accurate, that you have the right to make them, and that you have the right to submit the content you send.

You grant us the rights necessary to process your content for these purposes: to embed a signed manifest, to derive a fingerprint, to generate a proof, and to publish the resulting record. You retain ownership of your content. We claim no rights in it beyond what is needed to perform the Service.

A manifest asserts an identity; it does not verify one. Cryptographically verified identity assertions are a separate mechanism and are not part of the Service today.

Trust-list status

Stamped files carry standard C2PA manifests that validate structurally in c2patool and other C2PA-aware tooling. 0byte's signing certificate is going through the C2PA Conformance Program and is not yet on the public C2PA trust list.

Until it is, a validator will read a stamped file's manifest as structurally valid while flagging that the signer is not trust-listed, and our own verification reports that state rather than papering over it. The registry fingerprint match establishes origin independently in the meantime, and transparency-log inclusion proofs do not depend on trust-list status at all.

We make no commitment as to whether or when our certificate will be accepted onto the trust list. Do not build a contractual or regulatory obligation on the assumption that it will be, and do not represent to your own users that it already is.

What verification does and does not tell you

A verdict is a statement about the evidence available at the time of the check, not a legal determination of authenticity, authorship, or truth.

In particular: a result of no provenance found means no manifest and no registry match were readable. It is an honest null. It is not evidence that content is authentic, that it is not AI-generated, or that it was never stamped — a proof may simply have never been created, or the content may have been altered past the point where a fingerprint still matches.

Fingerprint matching is perceptual and operates within a similarity threshold. Heavy cropping, small images, and severe re-encoding can move content outside that threshold. We publish these limits in our documentation and expect you to account for them rather than treat verification as infallible.

Your compliance obligations remain yours

The Service is designed to help you produce machine-readable marking and provenance evidence of the kind that transparency regimes such as the EU AI Act and California's SB 942 call for. It is a tool, not legal advice, and using it is not a certification of compliance.

You remain solely responsible for determining what the law requires of you, in which jurisdictions, and by when, and for satisfying those requirements. We do not warrant that use of the Service makes you compliant with any statute, regulation, code of practice, or standard.

Acceptable use

You agree not to:

• Submit content you do not have the right to submit, or that infringes the rights of others.
• Attach false, misleading, or unlawful information to a proof, or misrepresent who generated content or which model produced it.
• Present a stamped file, a proof, or a verification result in a way that misstates what it establishes — including implying that a verdict is a legal determination, or that a signer is trust-listed when it is not.
• Attempt to forge a proof, to make content verify as something it is not, or to circumvent the Service's security, tenancy boundaries, or rate limits.
• Interfere with the Service's availability for others — including bulk automated harvesting of the transparency log at a volume that degrades it for everyone else.
• Use the Service to build or train a model on submitted content that you do not have the rights to, or otherwise use it as a route around another party's terms.

Reading the transparency log

The transparency log is public on purpose. You may read it, query it, mirror a copy, recompute inclusion and consistency proofs, and independently verify our signatures and published keys — that is the guarantee, and exercising it is not a breach of these Terms. You may also operate your own conformant registry; the protocol is intended to allow more than one operator.

The only limits on log access are the operational ones in Acceptable use above: do not degrade the service for others, and do not present mirrored data in a way that misrepresents its source or currency.

Proofs you create are permanent. You are responsible for the content and metadata you submit, and you should not submit personal or confidential information in fields that become part of the public record.

Plans, rate limits, and fees

Verification is free, requires no account, and will remain free — a provenance registry only works if anyone can check it.

Stamping plans are currently differentiated by request-rate limits rather than by price, and the Service is provided without charge during early access. We may introduce fees for stamping in future. If we do, we will give account holders advance notice by email, and no charge will be applied without your agreement.

Rate limits apply per API key. Exceeding one returns a rate-limit response with the headers needed to back off correctly; it is not a breach of these Terms, but persistent attempts to evade limits are.

Availability, changes, and suspension

The Service is under active development and will evolve. We aim to keep the versioned API additive and backward-compatible, and we publish a changelog; we do not otherwise commit to a service level, an uptime target, or a support response time.

We may suspend or terminate access for an account that breaches these Terms, that puts the Service or other users at risk, or where we are legally required to. Where circumstances allow, we will tell you why and give you an opportunity to put it right.

You may stop using the Service at any time and ask us to close your account. Closing an account does not remove proofs already anchored in the transparency log — see below.

Intellectual property

The Service, including its software, branding, and documentation, is owned by 0byte Lab and protected by applicable law. Our open-source components are licensed under their respective licenses (MIT unless stated otherwise), and third-party components we build on — including Adobe's c2pa-rs — remain under theirs.

You retain ownership of the content you submit and of the stamped files we return to you.

Disclaimers

The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement.

We do not warrant that verification will surface every match, that a fingerprint will survive every transformation of content, that a manifest will survive every platform, that the Service will be uninterrupted or error-free, or that it is fit for any particular legal, evidentiary, or regulatory purpose.

Limitation of liability

To the maximum extent permitted by law, 0byte Lab will not be liable for any indirect, incidental, special, or consequential damages, or for any loss of data, revenue, profits, or goodwill, arising from or relating to your use of the Service — including any decision made or not made on the strength of a verification verdict.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited.

Changes to these terms

We may update these Terms from time to time. Material changes will be reflected by the "Last updated" date above, and we will notify account holders of significant ones. Continued use of the Service after a change constitutes acceptance of the revised Terms.

Contact

Questions about these Terms? Email hello@0byte.tech.