Terms of Service

These terms govern your use of the PQCClear website, the assessment platform, the scanner, and the PQC Verified trust seal. Using any of them means you accept these terms. If you are agreeing on behalf of an organization, you are confirming that you have the authority to bind it.

Where your organization has signed a separate written agreement with us, that agreement controls anywhere the two conflict.

PQCClear is an assessment and certification service. We measure post-quantum readiness, publish a PQC Readiness Score, produce a Cryptographic Bill of Materials, and issue a certification that a third party can verify.

We do not sell remediation, migration services, or the cryptographic products we assess. That is a deliberate limit on our business, and it is the reason our scores are worth reading.

• Give accurate registration details and keep them current.
• Keep your credentials, and any vendor portal link we issue you, confidential. A portal link is a credential: anyone holding it can answer on your behalf.
• You are responsible for activity under your account. Tell us promptly if you believe it has been compromised.
• Accounts are for the organization they were opened for. Do not share one across organizations.

The scanner and the platform are tools for assessing systems you are entitled to assess. You agree not to:

• Point the scanner at systems you do not own or are not authorized in writing to test.
• Submit answers or evidence you know to be false, or answer on behalf of an organization without its authority.
• Attempt to reach another tenant's data, probe the platform for vulnerabilities without our written permission, or interfere with its operation.
• Resell, redistribute, or publish our scores, reports, or CBOM output as your own assessment product.
• Reverse engineer the scoring model, or scrape the verification endpoint in bulk.

A PQC Readiness Score is a rating, not a verdict and not a guarantee. It reflects the information available at the time of the assessment: what you told us, what the scanner observed, and what evidence was supplied.

A score does not certify that a system is secure, that an organization is compliant with any regulation, or that it will satisfy any particular examiner. It does not transfer risk to us. An institution assessing its vendors remains responsible for its own due diligence, and a vendor's self-certification supplements that work rather than replacing it.

Scores are produced by a versioned model that we recalibrate on a defined cadence as assessment data accumulates. A later assessment may score differently from an earlier one for that reason.

• It expires. A certification is valid for the period stated when it is issued, and must be renewed to stay current.
• It is specific. You may display the seal only for the entity and scope that were assessed, and only while the certification is current.
• It stays honest. Do not present an expired, revoked, or altered certification as current, and do not modify the seal or the cert ID.
• We can revoke it. If a certification was obtained with inaccurate information, or the seal is misused, we may revoke it and record the lookup as revoked.

You keep ownership of everything you submit: answers, evidence documents, vendor records, and scanner output. You grant us the permission we need to host and process it in order to deliver the service, produce your results, and meet our obligations to you.

You confirm that you have the right to submit what you submit, including any personal information about your colleagues or your vendors' staff. Our handling of personal information is described in the Privacy Policy.

We may use assessment data in aggregate and de-identified form to calibrate the scoring model and to publish research. We will not identify your organization in that work without your written permission.

Paid plans are billed as set out in the plan or order you accept. Fees are stated exclusive of taxes unless we say otherwise. If a payment fails or an invoice goes unpaid, we may suspend access until it is settled.

Each side will protect the other's non-public information with at least the care it applies to its own, and use it only to perform under these terms. This does not cover information that is already public, was already known without an obligation of confidence, or must be disclosed by law.

PQCClear provides assessment output, not legal, regulatory, audit, or security advice. Decisions about procurement, remediation, disclosure, or regulatory filings are yours, and you should take your own professional advice on them.

We work to keep the service available, but we do not promise uninterrupted access. Maintenance, provider outages, and events outside our control will occasionally interrupt it.

We may change the service as it develops. Where a change materially reduces functionality you rely on, we will give reasonable notice. We may also update these terms; the effective date at the top shows when they last changed, and we will tell account holders about material changes rather than rely on you noticing.

Except where the law does not allow it, the service is provided as is and as available, without warranties of any kind, whether express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that assessment output is complete, that it will detect every cryptographic weakness present, or that it will satisfy any regulator.

To the extent the law allows, neither side is liable for indirect, incidental, special, or consequential loss, or for lost profits, revenue, data, or goodwill, arising out of these terms or the service.

Nothing here limits liability that cannot be limited by law, including liability for fraud or for death or personal injury caused by negligence.

You may stop using the service at any time. We may suspend or terminate access if these terms are breached, if use of the service puts other customers or the platform at risk, or if fees go unpaid.

On termination, certifications tied to the account stop being renewable and lapse at their expiry date. We will make your assessment records available for a reasonable period so you can export what you need.