Terms of Use of the DSTUcrypt Service

Translation notice. This English translation is provided for convenience only. The legally binding text is the Ukrainian original: Умови використання.

1. General Provisions

1.1. These Terms of Use (hereinafter — the Terms) define the rules of access to and use of the DSTUcrypt service available at https://dstucrypt.com.ua.

1.2. The Terms constitute a contract of adhesion within the meaning of Article 634 of the Civil Code of Ukraine. The Customer accedes to the Terms as a whole and may not propose its own terms for the contract of adhesion. The Customer's rights provided for by parts two and three of Article 634 of the Civil Code of Ukraine are preserved. If the Customer is a consumer, Section 17 of these Terms additionally applies, and its provisions prevail over any other provisions of the Terms.

1.3. The Terms govern the rules of use of the Service. Related documents:

1.4. In the event of a conflict between the Terms and the Public Offer with respect to commercial matters, the Public Offer prevails. In matters of personal data processing, the DPA prevails. In all other matters, these Terms prevail.

1.5. Use of the Service in any manner — including connecting the SDK, loading a widget, or accessing the application programming interfaces (APIs) — constitutes full and unconditional acceptance of the Terms. If the Customer does not agree with the Terms, the Customer must cease using the Service.

2. Definitions

The Provider — Elektronnyi Obih LLC, EDRPOU (company code) 46191111.

The Service (DSTUcrypt) — the Provider's software suite consisting of the website https://dstucrypt.com.ua, embeddable iframe widgets, a JavaScript SDK, a WebAssembly cryptographic module and server-side application programming interfaces (APIs), which provides creation and verification of electronic signatures, encryption, decryption, certificate handling and authentication by electronic signature.

The Customer — a legal entity, an individual entrepreneur or a natural person who has acceded to the Terms and uses the Service on a Licensed Domain.

Consumer — a Customer who is a natural person and purchases, orders or uses the Service for needs not directly related to entrepreneurial activity or to the performance of duties as an employee, within the meaning of the Law of Ukraine "On Consumer Rights Protection" No. 1023-XII.

Licensed Domain — a domain name for which the Customer has paid a Subscription or for which a Trial Period is in effect.

End User — a natural person who interacts with the Service's widgets on the Customer's web resource.

Subscription — the paid right to use the Service on one Licensed Domain during a defined period.

Trial Period — 7 (seven) calendar days of free use of the Service, granted automatically for each new domain.

Widget — an isolated iframe component of the Service that is loaded from the dstucrypt.io domain and performs a single operation (sign, verify, encrypt, decrypt, cert, auth).

SDK — the dstucrypt-embed.mjs module that the Customer connects on its own web resource and that provides interaction with the Widgets.

Badge — the visual "Protected by DSTUcrypt" mark displayed in the Widgets.

Trust List — the list of qualified providers of electronic trust services maintained in accordance with the Law of Ukraine "On Electronic Identification and Electronic Trust Services" No. 2155-VIII.

Technical Protection Measures — the licensing control mechanisms of the Service, including domain verification by the Origin and Referer headers, the Content-Security-Policy: frame-ancestors directive and the restriction of resource delivery to unlicensed domains.

Automatic mode (session) — an optional feature of the Service that allows the encrypted container of the End User's private key to be stored in the local storage (localStorage) of the dstucrypt.com.ua domain for up to 30 days. A detailed description is provided in the Cookie and Local Storage Policy (https://dstucrypt.com.ua/en/cookies).

3. Legal Status of the Provider and Legal Regime of the Signature

3.1. The Provider is not a provider of electronic trust services and is not a qualified provider of electronic trust services (qualified trust service provider) within the meaning of the Law of Ukraine "On Electronic Identification and Electronic Trust Services" No. 2155-VIII. The Provider is not included in the Trust List.

3.2. The Provider does not create, issue, store or maintain private keys, qualified public key certificates or any other certificates. The End User obtains electronic signature means independently, from an electronic trust service provider of the End User's own choosing.

3.3. The Provider does not provide qualified electronic trust services; in particular, it does not generate qualified electronic time stamps by its own means. Electronic time stamps are generated by third-party electronic trust service providers included in the Trust List; the Service acts solely as a technical intermediary (proxy) relaying requests to such providers, since their servers generally do not support the CORS mechanism.

3.4. The signature verification result returned by the Service (including via the verify() methods and the POST /api/verify, POST /api/auth/verify endpoints) is a technical conclusion of a software tool regarding the cryptographic integrity of the signature and the presence, in the Trust List, of the provider that issued the signer's certificate. The technical field accredited in the Service's response means precisely the presence of the provider in the Trust List. Such a conclusion:

• is not a qualified validation service for a qualified electronic signature;
• does not create the statutory presumption of legal effect of an electronic signature;
• does not replace verification of the signature by the means prescribed by legislation for the relevant legal relations, in particular in state information systems.

3.5. The decision on the legal consequences of an electronic signature — admitting a person, accepting a document, entering into a transaction — is made exclusively by the Customer, at its own risk and under its own responsibility. The Provider is not a party to the legal relations between the Customer and the End User.

3.6. The Provider does not identify persons, does not establish their legal capacity and does not verify the scope of authority of representatives. The values of the subject, fullName, taxId, orgCode fields are derived from the data of a certificate issued by a third-party provider, and the Provider is not responsible for their accuracy.

3.7. The Service is not a qualified electronic signature means within the meaning of Law No. 2155-VIII and has not undergone the conformity assessment procedures for such a means. The Service works with file-based key containers (PKCS#12, JKS, PKCS#8, Key-6.dat) and does not support hardware key media — protected tokens and smart cards (clause 11.3 of the Terms).

The legal regime of a signature created using the Service — a qualified, advanced or simple electronic signature — is determined by the properties of the certificate and the signature means that the End User chooses independently. The Provider does not warrant that a signature created using the Service will meet the requirements that legislation establishes for a qualified electronic signature.

The Customer must independently ascertain which level of electronic signature is required for its legal relations and must not present the Service to its users as a means of guaranteed creation of a qualified electronic signature.

4. Subject of the License

4.1. Subject to compliance with the Terms and to an active Subscription or Trial Period, the Provider grants the Customer a non-exclusive, non-transferable, revocable license without the right to sublicense to use the Service by connecting the SDK and the Widgets on the Licensed Domain.

4.2. The license is granted for one domain. Each additional domain requires a separate Subscription. Unless otherwise expressly agreed by the Parties, subdomains are deemed separate domains.

4.3. The scope of the license is determined by the paid pricing plan. Certain features — in particular "Custom design" (theme, styles, css, brand, branding: false), "Multiple signers" (coSign) and "Encryption/decryption" — are activated only upon payment of the corresponding option for the specific domain. In the absence of a paid option, the corresponding method returns an error with the code MULTISIGN_NOT_ENABLED, and non-standard styling is not applied.

4.4. The Provider grants a Trial Period of 7 calendar days automatically, on each new domain, without registration. Access from localhost is provided free of charge in developer mode, with the corresponding mark displayed.

4.5. Upon expiry of the Trial Period or of the paid Subscription period, operation of the Widgets on the relevant domain stops automatically; method calls are rejected with the error code not_licensed.

4.6. The license takes effect from the moment use of the Service begins and remains in force for the duration of the Subscription or the Trial Period.

5. Restrictions on Use

5.1. The Customer is prohibited from:

5.1.1. hosting (self-hosting) the Service's files on its own or third-party servers, including the embed/ and sdk/ directories, the *.wasm modules and dstucrypt-embed.mjs, as well as loading the Widgets from any origin other than dstucrypt.com.ua;

5.1.2. circumventing, disabling, removing or modifying the Technical Protection Measures, or otherwise interfering with their operation, including by spoofing the Origin/Referer headers, proxying requests or using the service parameter src outside local development;

5.1.3. removing, hiding or reducing the Badge to an illegible state unless the "Custom design" option has been paid for;

5.1.4. decompiling, disassembling or reverse engineering the Service or any part of it, except in the cases and to the extent expressly permitted by mandatory provisions of the legislation of Ukraine;

5.1.5. reselling the Service, leasing it, providing third parties with access to it, or offering the Service as its own service under a different brand, except where a white-label arrangement has been separately agreed by the Parties;

5.1.6. using the Service for actions that violate the legislation of Ukraine, including forgery of documents, unauthorized access to information, or misleading others as to the identity of the signer;

5.1.7. generating automated load on the Service's API that substantially exceeds the volumes typical of ordinary use by the Licensed Domain, performing load testing without written approval, or taking actions aimed at disrupting the availability of the Service;

5.1.8. using the Service on a domain for which there is no active Subscription or Trial Period.

5.2. A breach of clauses 5.1.1, 5.1.2, 5.1.5 or 5.1.8 constitutes a material breach of the Terms and entitles the Provider to suspend access immediately, without prior notice, with subsequent notification of the Customer by email. Refunds for the unused period are handled in accordance with the Refund Policy. Suspension of access does not deprive the Provider of the right to claim compensation for documented losses caused by such a breach.

6. Customer's Obligations as Integrator

6.1. The Customer is solely and fully responsible for the lawfulness of the processing of End Users' personal data carried out on its web resource and on its instructions, including for having a proper legal basis and for informing personal data subjects.

6.2. The Customer must ensure that its web resource contains the Customer's own privacy policy which, among other things, discloses the use of the Service and the transfer of data to the Provider.

6.3. The Customer must not rely on the values of the subject and accredited fields received from the auth Widget on the browser side when making an authentication decision. Such values are provided solely for interface purposes. Authentication must be based on the response of the server endpoint POST /api/auth/verify obtained in a server-to-server exchange.

6.4. The Customer must maintain the confidentiality of access to the personal account and is responsible for actions performed using it.

6.5. The Customer must independently assess the suitability of the Service for its own purposes, including whether the chosen signature format and level (CAdES, XAdES, PAdES, ASiC; levels BES, T, C/LT, XL/LTA) meet the requirements applicable to its legal relations, taking into account clause 3.7 of the Terms.

6.6. The Customer confirms that it has been informed of the following: by default, the signature is created using the DSTU GOST 34.311-95 hash function, since this is the pair of algorithms accepted by state validators; use of the DSTU 7564:2014 (Kupyna) hash function is enabled explicitly and may not be accepted by certain state systems. The choice of algorithm is made by the Customer.

6.7. The Customer must report discovered vulnerabilities of the Service to security@dstucrypt.com.ua and must not disclose them publicly until they are remedied or until 90 calendar days have elapsed from the date of the report, whichever occurs first.

7. Technical Model and Limits of the Provider's Control

7.1. Cryptographic operations involving the private key are performed in the End User's browser, in a WebAssembly environment, inside a Widget loaded from the origin dstucrypt.com.ua.

7.2. The private key and its password are entered inside the Widget and are not transmitted either to the Customer's web resource or to the Provider's servers. Isolation is ensured by the browser's Same-Origin Policy.

7.3. The Customer is informed and agrees that the following data is transmitted to the Provider's servers:

7.3.1. when calling POST /api/verify — the electronic signature in base64 encoding, and, for a detached signature, also the content of the signed data;

7.3.2. when calling POST /api/auth/verify — the electronic signature and the challenge; the response returns the signer's data: surname, given name, patronymic, taxpayer registration number (RNOKPP), EDRPOU code, and information about the provider;

7.3.3. when generating electronic time stamps and checking certificate status — hash values of data, serial numbers and identifiers of certificates, transmitted through the Provider's proxy to third-party electronic trust service providers included in the Trust List;

7.3.4. when checking the license (GET /api/license, GET /api/licensed) — the domain name of the Licensed Domain, the IP address and the value of the request's Origin header;

7.3.5. when calling POST /api/auth/challenge — a request to generate a one-time challenge; no personal data is transmitted in such a request; the generated challenge is stored on the server until it is used or until it expires (approximately 300 seconds).

7.4. The encrypt and decrypt operations and certificate parsing (cert.inspect) are performed entirely on the End User's device; the content of the data is not transmitted to the Provider's servers. Certificate status verification (cert.verify) involves calls to OCSP or CRL services as set out in sub-clause 7.3.3.

7.5. The processing of the data referred to in clauses 7.3 and 7.4 is governed by the Privacy Policy and the Data Processing Agreement (DPA).

7.6. The Provider has no technical ability to influence the operation of the Customer's web resource, the content of the documents being signed, or the actions of End Users.

7.7. Network operations for generating time stamps (TSP), checking certificate status (OCSP) and downloading certificate revocation lists (CRL) are performed through the Provider's proxy with automatic failover between several providers. The Provider is not responsible for the availability, correct operation or content of the responses of third-party providers.

8. Intellectual Property

8.1. The exclusive economic intellectual property rights to the Service, its components, source and object code, interfaces, documentation, trade designations and design belong to the Provider.

8.2. Accession to the Terms does not transfer to the Customer any intellectual property rights other than the right of use expressly set out in Section 4.

8.3. The Service contains open-source components, including the UAPKI cryptographic core, which is distributed under the BSD 2-Clause license. The list of such components and the texts of the relevant licenses are available at https://dstucrypt.com.ua/third-party-licenses. The use of such components is governed by the respective licenses.

8.4. The Provider may indicate the Customer's name and trademark in the client list on the Provider's web resource and in marketing materials only with the Customer's separate written consent, given, inter alia, by email. The Customer may withdraw the consent given at any time by sending a notice to legal@dstucrypt.com.ua; the Provider removes the relevant references within 10 business days.

9. Personal Data

9.1. With respect to the Customer's data — email addresses, domain names, payment records, personal account session data — the Provider acts as a personal data controller. The processing procedure is set out in the Privacy Policy.

9.2. With respect to the personal data of End Users transmitted to the Provider's servers in the cases specified in clause 7.3, the Provider acts as a personal data processor (in the terminology of Regulation (EU) 2016/679 — processor), and the Customer acts as the controller. The Parties' relations in this respect are governed by the Data Processing Agreement (DPA), available at https://dstucrypt.com.ua/en/dpa, which is an integral part of the Terms.

9.3. The Provider does not store the content of requests to POST /api/verify and POST /api/auth/verify, nor the information about the signer obtained from certificates. Technical logs, one-time challenges and other service data are processed to the extent and for the periods defined by the Privacy Policy and the DPA.

10. Availability of the Service

10.1. The Provider takes reasonable measures to ensure uninterrupted operation of the Service, but does not guarantee continuous and error-free operation.

10.2. The Provider may carry out scheduled maintenance. Where possible, the Provider gives advance notice of such maintenance by email or through the personal account.

10.3. The Provider may change the functionality of the Service, provided that such changes do not make it impossible to use the paid pricing plan for its intended purpose. If a change materially impairs the ability to use paid features, the Customer may terminate the Subscription with a refund for the unused period in accordance with the procedure set out in the Refund Policy.

10.4. The Provider may discontinue support for certain obsolete features by giving the Customer at least 60 calendar days' notice.

10.5. The consequences of unavailability of the Service through the Provider's fault during a substantial part of the paid period are determined by the Refund Policy.

10.6. If the server-side verifier is temporarily unavailable, the relevant endpoints return a response with code 503 and the reason verifier_unavailable. The Customer must ensure correct handling of such a response in its own software.

11. Disclaimer of Warranties

11.1. The Service is provided on an "as is" and "as available" basis.

11.2. To the extent permitted by the legislation of Ukraine, the Provider gives no warranty that the Service will meet the Customer's subjective expectations or operate without interruption, nor any warranty that signatures created using the Service will be accepted by any third party, state authority or court. This provision does not release the Provider from the obligation to provide a Service fit for ordinary use for the purpose described in the documentation.

11.3. The Provider does not guarantee compatibility of the Service with all types of key containers, browser versions and configurations of End Users' devices. Hardware key media (protected tokens, smart cards) are not supported by the Service; the legal consequences of this limitation are described in clause 3.7 of the Terms.

12. Limitation of Liability

12.1. The Provider's aggregate liability for all claims arising out of or in connection with the Terms is limited to the amount actually paid by the Customer for the Subscription for the relevant domain during the 12 (twelve) calendar months preceding the event giving rise to the claim, but not less than the amount paid for the current paid period.

12.2. The Provider is not liable for lost profits, indirect losses, reputational damage, or losses caused by the actions of End Users or third parties.

12.3. The Provider is not liable for:

12.3.1. the legal consequences of decisions made by the Customer on the basis of the Service's results; 12.3.2. the unavailability or incorrect operation of third-party time-stamp providers, OCSP and CRL services, or electronic trust service providers; 12.3.3. non-conformity of a signature with the requirements of a specific state information system or of the Customer's counterparty, including on the grounds specified in clause 3.7; 12.3.4. the End User's loss of the private key, password or PIN code; 12.3.5. the consequences of the Customer's use of the Automatic mode (session) feature without properly informing End Users; 12.3.6. actions of the Customer in breach of Section 6 of the Terms.

12.4. The limitations established by this section do not apply to:

12.4.1. cases of intentional infliction of harm or gross negligence on the part of the Provider; 12.4.2. harm caused to the life or health of a natural person; 12.4.3. the Provider's liability for breach of the Data Processing Agreement — to the extent set out in clause 12.3 of the DPA; 12.4.4. cases where limitation of liability is expressly prohibited by mandatory provisions of the legislation of Ukraine; 12.4.5. relations with a Customer who is a consumer — to the extent set out in Section 17 of the Terms.

12.5. The Customer undertakes to compensate the Provider for documented losses incurred as a result of justified third-party claims caused by the Customer's breach of Sections 5 or 6 of the Terms. The Provider must promptly notify the Customer of such a claim and must not acknowledge it without written agreement with the Customer.

13. Term, Suspension and Termination

13.1. The Terms take effect upon the Customer's accession and remain in force until use of the Service ceases.

13.2. The Provider may suspend or terminate the Customer's access to the Service in the event of:

13.2.1. failure to pay for the Subscription within the period specified in the Public Offer; 13.2.2. a material breach of the Terms within the meaning of clause 5.2; 13.2.3. receipt of a justified demand from an authorized state authority; 13.2.4. detection of actions that threaten the security or availability of the Service for other customers.

13.3. In the cases provided for in sub-clauses 13.2.2 and 13.2.4, access may be suspended immediately, with subsequent notification of the Customer by email.

13.4. The Customer may stop using the Service at any time by cancelling the Subscription in the personal account. Access is retained until the end of the paid period.

13.5. Termination of the Terms does not release the Parties from obligations that arose before such termination. Sections 3, 8, 9, 11, 12, 16, 17 and 18 of the Terms survive termination.

14. Amendments to the Terms

14.1. The Provider may unilaterally amend the Terms.

14.2. A new edition is published at https://dstucrypt.com.ua/terms with the edition date indicated and takes effect 10 calendar days after publication, unless a later date is specified in the edition itself.

14.3. Amendments that materially restrict the Customer's rights or expand its obligations are additionally communicated by email to the address specified in the personal account at least 10 calendar days before they take effect. In that case, the Customer may, before the effective date of the amendments, terminate the Subscription with a refund for the unused period in accordance with the procedure set out in the Refund Policy.

14.4. Continued use of the Service after a new edition takes effect constitutes acceptance of it.

14.5. The Provider retains previous editions of the Terms and provides them upon the Customer's written request.

15. Force Majeure

15.1. The Parties are released from liability for partial or complete failure to perform their obligations if such failure results from force majeure circumstances arising after accession to the Terms, including: armed aggression, martial law, hostilities, acts of terrorism, damage to critical infrastructure, prolonged power outages, natural disasters, fire, epidemics, as well as acts of state authorities that make performance of the obligations impossible.

15.2. The Party affected by such circumstances must notify the other Party within 10 calendar days from the date of their occurrence. The time for performance of the obligations is extended for the duration of such circumstances.

15.3. A certificate issued by the Chamber of Commerce and Industry of Ukraine or by the relevant regional chamber of commerce and industry constitutes proper evidence of the existence of force majeure circumstances, except where such circumstances are generally known.

16. Dispute Resolution and Governing Law

16.1. The Terms and the relations between the Parties are governed by the substantive law of Ukraine.

16.2. Disputes are resolved through negotiations. A Party that considers its rights violated sends the other Party a written claim; the period for its consideration is 30 calendar days from the date of receipt.

16.3. If no agreement is reached, the dispute is referred to the court having jurisdiction under the procedural legislation of Ukraine.

16.4. The Customer's claims are sent to legal@dstucrypt.com.ua or by registered mail to the address of the Provider's registered office.

17. Special Provisions for Consumer Customers

17.1. Applicable legislation. Relations with a consumer Customer are additionally governed by the Law of Ukraine "On Consumer Rights Protection" No. 1023-XII and the Law of Ukraine "On Electronic Commerce" No. 675-VIII.

The Parties take into account that the Law of Ukraine "On Consumer Rights Protection" No. 3153-IX of 10 June 2023 has not entered into force as of the date of this edition — it enters into force one year after the day of its publication, but not earlier than the day martial law is terminated. From the date it enters into force, references in this section are deemed references to the corresponding provisions of Law No. 3153-IX.

17.2. Unfair terms. No provision of the Terms applies to a consumer Customer to the extent that it constitutes an unfair contract term within the meaning of Article 18 of the Law of Ukraine "On Consumer Rights Protection". In particular, the following do not apply to a consumer Customer:

17.2.1. the provisions of clause 5.2 concerning the consequences of suspension of access — refunds are made in accordance with the Refund Policy and the requirements of consumer protection legislation;

17.2.2. the provisions of Section 11 to the extent that they exclude or limit the quality warranties provided for by mandatory provisions of legislation;

17.2.3. the provisions of clause 12.1 to the extent that the limitation of the amount of liability conflicts with mandatory provisions of consumer protection legislation;

17.2.4. the provisions of clause 12.5 on compensation of the Provider's losses by the Customer — they do not apply to a consumer.

17.3. Right of withdrawal from a distance contract. A consumer Customer has the right to withdraw from the contract within fourteen calendar days from the date of its conclusion, in accordance with the procedure of Article 13 of the Law of Ukraine "On Consumer Rights Protection".

Since the Service is a service provided in electronic form, by starting to use the Service before the expiry of the said period, the consumer Customer confirms consent to the commencement of the provision of the service and agrees that, once provision of the service has begun, the right of withdrawal applies subject to the limitations established by part six of Article 13 of the said Law, and the cost of the part of the service actually consumed is not refundable.

This provision does not limit the right to the free Trial Period of 7 calendar days (clause 4.4 of the Terms), during which the Customer may stop using the Service without any payments.

17.4. Unilateral change of terms. Amendments to the Terms and to the pricing that worsen the position of a consumer Customer apply to the consumer Customer only with their consent. In the absence of consent, the consumer Customer may terminate the Subscription before the effective date of the amendments, with a refund for the unused period.

17.5. Automatic renewal of the Subscription. The Provider notifies the consumer Customer of the next automatic charge by email no later than 7 calendar days before the charge date, indicating the amount and the procedure for cancelling the Subscription.

17.6. Dispute resolution. A consumer Customer has the right to apply to the court at their own registered place of residence or stay in accordance with the procedural legislation of Ukraine, and is exempt from court fees in cases involving consumer protection claims in the cases provided for by law. The mandatory pre-trial claim procedure provided for by clause 16.2 of the Terms is not mandatory for a consumer Customer.

17.7. Consumer inquiries. Inquiries of a consumer Customer are sent to legal@dstucrypt.com.ua and are considered within the periods established by legislation. A consumer Customer also has the right to apply to the central executive authority implementing state policy in the field of state control over compliance with consumer protection legislation.

17.8. Information about the Provider. The full name, registered office, identification code and contact details of the Provider are set out in Section 19 of the Terms, which fulfils the requirements of Article 7 of the Law of Ukraine "On Electronic Commerce" regarding disclosure of information about the seller.

18. Final Provisions

18.1. If any provision of the Terms is found to be invalid, this does not affect the validity of the remaining provisions.

18.2. The Provider's failure to exercise any right under the Terms does not constitute a waiver of that right.

18.3. The Customer may not assign its rights and obligations under the Terms to third parties without the Provider's written consent. The Provider may assign its rights and obligations in the event of reorganization or disposal of the Service, subject to notifying the Customer.

18.4. The Parties recognize the legal force of documents and notices exchanged by email at the addresses specified in the Terms and in the personal account.

18.5. The Terms are drawn up in the Ukrainian language. If a translation into other languages is provided, the Ukrainian-language text prevails.

18.6. The documents listed in clause 1.3 are integral parts of the Terms.

19. Provider's Details and Contacts

Elektronnyi Obih LLC (ТОВ «електронний Обіг») LIMITED LIABILITY COMPANY «eObig»

EDRPOU (company code): 46191111 Registered office: 1a Dniprovodska Street, office 1, Kyiv, 04077, Ukraine Website: https://dstucrypt.com.ua

Edition of 5 August 2026.