By creating an account or using any FIPSign product or service available at fipsign.dev and its subdomains, you agree to be bound by these Terms of Service. If you do not agree, do not use the service.

By registering an account, you also agree to receive service-related emails (authentication codes, account notices, service updates) and occasional product announcements from FIPSign. You may opt out of non-transactional communications at any time by contacting [email protected].

FIPSign is a public, permissionless, self-service platform for post-quantum security. It provides three products:

PQ-Sign is an API and SDK to sign, verify, and revoke tokens using ML-DSA (NIST FIPS 204). Three security levels are available: ML-DSA-44, ML-DSA-65, and ML-DSA-87. The service also includes Certificate Authority (CA) functionality, allowing you to create a project-scoped root CA and issue, verify, and revoke X.509 or PQCert-format certificates — CA operations use ML-DSA-65.

PQ-Proxy Cloud is a managed reverse proxy service that terminates TLS connections using X25519MLKEM768 (post-quantum hybrid key exchange, NIST FIPS 203) and forwards traffic to your backend. It provides automatic certificate provisioning via Let's Encrypt, connection metrics, and backend health monitoring.

PQ-Proxy On-Premise is a self-hosted version of PQ-Proxy that runs on your own server. It is distributed as a Docker Compose stack and licensed on an annual basis. The license file (license.pqp) is signed with ML-DSA-65 (NIST FIPS 204) and verified offline by the binary at startup. Each license authorizes use by a single organization on one active server instance.

No prior approval, sales call, or contract is required to start using any of these products.

The service is operated by an independent developer and is not affiliated with NIST, Cloudflare, or any other organization referenced in the documentation.

FIPSign products are priced independently. Prices, free tiers, and trial periods may change at any time without prior notice.

PQ-Sign offers a free tier of tokens per calendar month per account, as published on our pricing page. Free tokens reset on the 1st of each month (UTC) and do not accumulate. Additional tokens may be purchased as non-expiring packs. Pack tokens are consumed after the monthly free tokens are exhausted. Each API operation — including /sign, /verify, /revoke, and CA operations (/ca/issue, /ca/verify, /ca/revoke) — costs 1 token. Failed requests do not consume tokens. Token pack purchases are final and non-refundable.

PQ-Proxy Cloud offers a 7-day free trial. After the trial, the service is billed on a prepaid wallet basis — you add credit and the service deducts usage hourly per active domain. Wallet credits are non-refundable.

PQ-Proxy On-Premise offers a 14-day free trial with 1 domain and all features enabled. Annual licenses are purchased at a fixed price. All license fees are non-refundable once the license file has been issued.

You agree to use FIPSign only for lawful purposes and in compliance with these Terms. You may not:

• Use the service to sign, certify, or distribute content that is illegal, fraudulent, or harmful.
• Attempt to circumvent rate limits, quotas, or access controls.
• Reverse engineer, decompile, or attempt to extract the underlying cryptographic keys or infrastructure.
• Resell or sublicense access to the API or SDK without prior written consent.
• Use automated tools to create multiple accounts in order to exploit the free tier.
• Use the service in any way that could damage, disable, or impair the service or interfere with other users.

We reserve the right to suspend or terminate accounts that violate these terms, without prior notice and without refund of any payments made.

You are solely responsible for:

• Keeping your credentials confidential — API keys, admin tokens, and dashboard passwords. Anyone with access to these credentials can act on your behalf.
• The content and legality of the payloads you sign, the traffic you proxy, and any data processed through FIPSign products.
• How you use, store, and distribute outputs generated by FIPSign — signed tokens, certificates, and proxied connections — in your own applications and infrastructure.
• Revoking compromised API keys or rotating admin tokens promptly.
• The correct configuration of your proxy backends and the security of your server infrastructure when using PQ-Proxy On-Premise.
• Keeping the license.pqp file secure and not sharing it with third parties when using PQ-Proxy On-Premise.

FIPSign provides cryptographic and networking infrastructure. We are not responsible for the applications or systems you build using our products, nor for any legal or regulatory obligations that may apply to your use of post-quantum cryptography or TLS proxying in your jurisdiction.

We strive to maintain high availability but provide no uptime guarantee. The service is provided on a best-effort basis.

We reserve the right to:

• Modify, update, or discontinue any feature of the service at any time.
• Change pricing, free tier limits, trial periods, or any other commercial terms at any time without prior notice, as stated in Section 3.
• Perform maintenance that may temporarily affect service availability.
• Discontinue the service entirely, with at least 30 days' prior notice to registered users, during which time you may export any data associated with your account.

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF SECURITY VULNERABILITIES. YOU USE THE SERVICE AT YOUR OWN RISK.

FIPSign implements ML-DSA-44, ML-DSA-65, and ML-DSA-87 as standardized by NIST FIPS 204, and X25519MLKEM768 as standardized by NIST FIPS 203. We make no representation that these implementations satisfy any specific regulatory, legal, or compliance requirement in your jurisdiction. It is your responsibility to verify that use of the service meets any applicable legal standards.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, FIPSIGN AND ITS OPERATOR SHALL NOT BE LIABLE FOR ANY DAMAGES OF ANY KIND ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF THE SERVICE, INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, LOSS OF PROFITS, DATA, BUSINESS, OR GOODWILL.

THE SERVICE IS PROVIDED AT NO COST OR AT A NOMINAL FEE. YOU ASSUME ALL RISK ASSOCIATED WITH ITS USE. IN NO EVENT SHALL OUR TOTAL LIABILITY TO YOU EXCEED ZERO (USD $0).

Some jurisdictions do not allow the complete exclusion of liability. In such jurisdictions, our liability is limited to the minimum extent permitted by applicable law.

The following additional terms apply to the purchase and use of PQ-Proxy On-Premise licenses:

• One license, one organization, one instance. Each license authorizes use by a single organization on one active server instance at a time. Running the same license on servers belonging to different organizations is not permitted.
• No transfer. Licenses are non-transferable and may not be shared with, resold to, or sublicensed to any third party.
• Non-refundable. All license fees — including trial conversions and annual renewals — are non-refundable once the license file has been issued and downloaded.
• Heartbeat requirement. The proxy-core binary sends a periodic heartbeat to proxyonprem.fipsign.dev every 24 hours. Deliberately blocking this outbound connection violates these terms and will cause the proxy to stop after 96 hours without a successful heartbeat.
• License file security. You are responsible for keeping the license.pqp file secure. Sharing or publishing the license file constitutes a violation of these terms and may result in immediate revocation without refund.
• Revocation. FIPSign reserves the right to revoke any license immediately and without refund if it determines, at its sole discretion, that the license is being used in violation of these terms. Revocation is enforced via the heartbeat mechanism — the proxy will stop within 72 hours of revocation.
• Grace period. Upon license expiry, a 30-day grace period applies during which the proxy continues to operate normally. After the grace period, the proxy stops routing traffic until a valid license is installed.

The FIPSign name, logo, dashboard, API, and SDK are the intellectual property of the operator. The underlying cryptographic algorithms — ML-DSA-44, ML-DSA-65, ML-DSA-87 (NIST FIPS 204) and X25519MLKEM768 (NIST FIPS 203) — are public standards published by NIST and are not the intellectual property of FIPSign.

You retain ownership of all payloads and data you submit to the service. By using the service, you grant FIPSign a limited, non-exclusive license to process your data solely for the purpose of providing the service.

You may delete your account at any time by contacting us at [email protected]. Upon deletion, your email address and account data will be removed within 30 days. No refunds are issued for any unused token packs, wallet credits, or license periods remaining at the time of termination.

We reserve the right to terminate or suspend accounts that violate these Terms, without notice and without refund.

These Terms of Service are governed by and construed in accordance with the laws of the Argentine Republic, without regard to conflict of law principles. Any disputes arising from these Terms or your use of the service shall be subject to the exclusive jurisdiction of the courts of Argentina.

We reserve the right to update these Terms of Service at any time. If we make material changes, we will notify registered users by email at least 14 days before the changes take effect. Your continued use of the service after that date constitutes acceptance of the updated Terms.

The effective date at the top of this page always reflects the most recent version.

For any questions about these Terms, contact us at [email protected].