Terms of Service

The NOA Mandate service is operated by Tora Toraman (enkeltmandsvirksomhed — sole proprietorship), CVR 42692271, Amager Strandvej 28C, 2. th., 2300 København S, Denmark.

• The published NOA Mandate Core receipt package — Apache-2.0 package artifacts, published at public artifact listing: noa-receipt@0.8.0. You can run the published verifier yourself without any hosted service. The published package is governed by its Apache-2.0 license, not by these terms. This link is a package artifact, not a claim that a source repository is public.
• The NOA Mandate Enterprise Console — a hosted admin product (RBAC, audit trail, evidence store, SSO/SCIM). Currently pre-general-availability; specific feature maturity (shipped vs. alpha vs. roadmap) is stated plainly on /compare and /regulations rather than repeated here.
• NOA Mandate Enterprise — the approver mobile app.
• Free while in beta — paid plans may follow. The hosted console and the mobile app are free to use while the service is in beta, and this codebase contains no billing integration today. We reserve the right to introduce paid plans (for example a subscription or a paid pilot). If we do, we will give advance notice on this page, and you will not be charged for continued use without first being shown and agreeing to the new terms — so a free beta account is never silently converted into a paid one.

• Use the service only in ways that are lawful where you use it.
• Do not attempt to access accounts, organizations, or data that are not yours, and do not probe, overload, or disrupt the hosted service — security research on the hosted service belongs in the disclosure channel described at /.well-known/security.txt, not against live customer data.
• Do not misrepresent a NOA receipt: a receipt proves what it proves (a signed, tamper-evident record of a decision) and must not be presented as proof of anything the format itself does not claim — see /security for what is and is not claimed.

Enterprise console accounts are protected by role-based access control and, for sensitive actions, step-up passkey re-authentication — see /security for the full, honestly-labeled control list (including named gaps). Keep your credentials and paired devices to yourself; if you suspect a credential or device has been compromised, rotate it and tell us at security@noamandate.com so we can revoke what needs revoking.

The hosted console and the mobile app are pre-general-availability beta software, provided as is and as available, without warranties of any kind. There is no uptime commitment and no SLA; the service may change, be interrupted, or end, with notice on this page. To the maximum extent Danish law permits, our liability in connection with the service is limited — we do not invent a numeric cap here, and nothing in these terms limits liability that Danish law does not allow to be limited. What is already stated plainly elsewhere on this site is not re-promised here more strongly: this is not a certification of SOC 2, EU AI Act, or NIST AI RMF compliance (see /regulations), and the audit trail is tamper-evident, not tamper-proof (see /security).

We may suspend or terminate access that violates the acceptable-use rules above or that creates a security risk for other users. You can stop using the service at any time. What happens to data afterwards is governed by the retention terms in the privacy policy — expired sign-in artifacts and aged security-event records are removed by the retention cleanup job, while append-only audit and receipt records are not deleted by that job and are kept as the tamper-evident accountability record.

These terms are governed by the law of Denmark, and disputes belong before the courts of Denmark.

When these terms change, this page changes, with a new effective date at the top. The current version is effective 2026-08-28; it replaces the version of 2026-08-12, adding the reservation of the right to introduce paid plans with advance notice. The 2026-08-12 version replaced the first version of 2026-08-11, correcting the description of what the retention cleanup job removes.

Questions about these terms: legal@noamandate.com