Terms of use

Who is offering it

This service is operated by CANDO IT Consult LTD., in Ontario, Canada.

Where these terms say "we" or "the operator", that is the party they mean, and it is the party you are contracting with.

What this service is

Cryptobench is a test bench for signed and encrypted payloads. It is built for software engineers, QA engineers and anyone working with cryptographic integrations who needs to exercise their own code without waiting on the service at the other end of it.

The point is to remove that dependency. Your application can be tested end to end - against real signatures, real key sets and a real JWKS URL - without an upstream or downstream partner being ready to mock or validate anything. It supports several protocols and algorithms, keeps key sets and cases in projects, and reports on the results.

Non-production use only

This is the condition everything else rests on, and it is not a recommendation.

Cryptobench is not a replacement for production signing, encryption or key management. It offers no API for production use, and no part of it is intended to sit in a live system.

Use it only for testing. Anyone using this platform is doing so to test their own software.

Never import a private key that protects anything real. Your keys are yours, and they travel across the network to reach this service - which is precisely why the keys you send here must be test keys. Using this service with production key material is strictly prohibited, and anyone who does so accepts the whole of the risk that follows.

Accounts, fair use and quotas

Anyone may read the public parts of this site - the bench, the Inspector, the protocol catalogue, the glossary, the reference and the guides - without an account.

An account is needed to keep key sets, projects and results.

Accounts are by invitation. There is no self-registration, and there is no charge to an accepted user. Use is subject to fair use: quotas apply, and they exist so that one account cannot exhaust the service for everybody else.

There is no subscription offer today. If one is introduced, these terms will be updated to cover what it costs and how it is cancelled before it applies to anybody.

What you must not do

Do not attempt to obtain key material that is not yours. The keys held here are for non-production use, and that is not a licence to go after them.

Do not attack the service. Probing, intrusion attempts and anything of that kind are logged. Those records are kept as evidence and may be given to law enforcement.

Availability

The service runs on cloud infrastructure, and its availability depends on that provider. No uptime is guaranteed. It is monitored, and the intent is to keep it available - but the intent is not a commitment, and nothing here entitles you to any particular level of service.

No warranty, and no liability

The service is provided as it is, with no warranty of any kind.

It is a testing tool and a reference. Verifying that your own software is correctly implemented remains your responsibility - a result from this service is evidence about a test, not a certificate about your system. In particular, "it passed Cryptobench" is not a security guarantee, an audit, or a certification.

There is no liability, of any amount, for anything. In particular, and without narrowing that:

• data that is corrupted, altered or lost;
• material that cannot be decrypted, or that decrypts to something unexpected;
• key sets that are lost, unavailable, or not retained;
• the wrong key being applied to something;
• anything at all arising from production data, because production use is prohibited and this service is not built to hold it.

Key sets are not guaranteed to be kept. There is no durability commitment for anything stored here. If a key set is gone, generate another one - that is the nature of test material, and it is why nothing that matters should be here in the first place.

Ending it

You may stop using the service at any time. Deleting your account removes your key sets and your projects with it.

An account left unused for two years may be removed, together with the key sets and projects it holds. That is a decision taken by the operator rather than something that happens automatically on the day, but two years is the point past which it can be taken.

Export first if you want to keep anything. Key sets, projects and reports can be exported before the account goes, and once it is gone the material is not recoverable - see Privacy for what deletion does.

Governing law

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply in it. The courts of Ontario are where a dispute about them is heard.

Changes to these terms

Registered account holders are told by email when these terms change.

The software licence is a separate thing

Cryptobench itself is closed source. These terms cover the hosted service; they are not a licence to the software behind it.

There is no published image or package that would let you run your own copy of the service today. That may change: images for running it on your own machine or in a development environment may be released later, and this section will say so when they are.

The developer tooling is a separate matter. The SDKs, the command-line tool for working with key sets, and the sample code and scripts published to help you integrate are intended to be open source and free to use, under their own licences.

The SDK and the command-line tool do not exist yet. When they are published they will carry their own licences, and those licences will govern them.