Use Totem to verify narrow authority—not to outsource judgment.

These Terms govern the hosted service at totemlayer.com and are between you and Totem (referred to as “Totem,” “we,” “us,” or “our”). They do not govern software or a deployment independently operated by another person or organization. By affirmatively accepting these Terms while activating an account and then using the hosted service, you agree to them. If you use Totem for an organization, you represent that you are authorized to act for it.

A separate written order, enterprise agreement, or deployment-specific agreement controls if it expressly conflicts with these Terms. Software operated by another organization may also be subject to that operator’s terms and privacy notice.

Totem provides tools for organizations to register agents, define narrow permissions, connect with other organizations, exchange challenge-bound presentations, and check whether presented authority is current for a stated recipient, action, request, and time.

A passing result is limited technical evidence. It is not a universal trust score, legal-identity opinion, safety certification, compliance determination, credit or solvency assessment, or guarantee that an agent’s request is accurate or appropriate. The receiving organization remains responsible for its own policy and downstream decision.

• You must be at least 18 years old, have legal capacity to agree, and use the service for legitimate business purposes.
• Registration details must be accurate. You must keep your account, mailbox, session, API keys, workload keys, and recovery methods secure.
• Organization owners and administrators are responsible for member access, roles, offboarding, and the authority they grant through the service.
• You may claim or verify only a domain and organization you are authorized to represent. Completing DNS control does not by itself prove a company’s legal status or your authority under corporate law.

You must not use Totem to:

• break the law, violate another person’s rights, or misrepresent an identity;
• claim a domain, organization, mailbox, agent, credential, or permission you do not control or have authority to use;
• probe, disrupt, overload, reverse engineer, bypass limits, defeat security controls, or gain unauthorized access to the service or another tenant;
• distribute malware, harvest credentials, replay proofs, forge records, or use a verification result outside its bound recipient, action, request, or time;
• use Totem as the sole control for life-safety, medical, legal, employment, housing, credit, insurance, critical-infrastructure, or other high-impact decisions; or
• submit children’s data, regulated personal data, production secrets, or highly sensitive information unless a written agreement expressly covers that use.

You retain your rights in information you submit. You grant Totem a limited right to host, copy, transmit, validate, secure, and otherwise process that information only as needed to provide, protect, support, and improve the service.

You represent that you have the rights and permissions needed to provide the data and direct its processing. When you invite a contact, connect organizations, send a company request, or present a credential, you direct Totem to disclose the relevant information to the intended recipient.

Do not use free-text fields for passwords, raw API keys, private signing material, payment-card data, health information, government identifiers, or unrelated confidential content.

API keys and workload credentials are confidential. You must scope them narrowly, store them in an appropriate secret manager, rotate them after suspected exposure, and revoke access that is no longer needed. You are responsible for requests made with credentials issued to your organization until they are revoked or expired.

Totem’s verification output does not authorize a business action by itself. Your systems must independently decide whether to grant access, release data, accept a request, or perform any other operation.

Totem is a beta service. Features, formats, limits, integrations, and availability may change. Unless a separate written agreement says otherwise, there is no service-level commitment, and you are responsible for maintaining source records, recovery procedures, and appropriate fallback controls.

We may impose reasonable limits or pause a feature to protect users, investigate abuse, comply with law, or preserve service integrity. We will try to give reasonable notice when practical, but urgent security action may be immediate.

Totem relies on infrastructure, database, email, analytics, scheduling, and other providers. A link or integration does not make Totem responsible for the provider’s service, terms, security, or content. Your use of a third-party service may be subject to a separate agreement with that provider.

Totem and its licensors retain rights in the service, design, documentation, trademarks, and underlying technology, excluding your data. These Terms give you only a limited, revocable, non-transferable right to use the hosted service as permitted here.

If you voluntarily provide feedback, you allow us to use it without restriction or compensation, provided we do not identify you publicly without permission. Separate source-code licenses, if any, govern code distributed under them.

You may stop using the service at any time. We may restrict or end access if you materially breach these Terms, create security or legal risk, fail to pay fees agreed in writing, or if operating the service becomes unlawful or impracticable.

Suspension or termination does not erase obligations or records that must reasonably survive, including accrued payment obligations, security evidence, rights in feedback, warranty disclaimers, and liability limits. Data handling after termination follows the Privacy Policy and any separate written agreement.

To the maximum extent permitted by law, the service is provided “as is” and “as available.” Totem disclaims implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant that the service will be uninterrupted, error-free, completely secure, or suitable for every legal or regulatory requirement.

Some jurisdictions do not allow certain disclaimers. Nothing here limits a warranty or right that cannot lawfully be excluded.

To the maximum extent permitted by law, Totem will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, data, or business opportunities arising from the service.

Totem’s total liability for claims arising out of or relating to the service will not exceed the greater of 100 US dollars or the fees you paid for the hosted service during the 12 months before the event giving rise to the claim. This limit does not apply where applicable law forbids it.

We may update these Terms as the service changes. The version and effective date will appear above. The service may require renewed acceptance before further authenticated use when a change is material. Changes do not retroactively authorize a materially different use of personal information.

These Terms do not limit non-waivable rights. Before starting a formal dispute, send a private message to the address below without including passwords, API keys, verification tokens, or other secrets. Any governing law, venue, dispute process, or commercial terms in a signed agreement take priority.