Verifications API and Sign in with Prson terms

Last updated: 4 November 2026

This legal document is provided in English.

1. What these terms cover

These terms apply when you use Prson's verifications product: the developer console at prson.net/developers, API keys, the Verifications API (live captures, identity facts and document signatures), Sign in with Prson, site notifications, the Prson SDKs and the MCP tools for verifications (together, "the Services").

They are an agreement between Yumankind OÜ, Sepapaja 6, 15551 Tallinn, Estonia, registry code 16232402 ("Prson", "we") and the organisation or developer that uses the Services ("you"). The people you verify or who sign in to your site with Prson are called "people" here.

These terms don't cover posting tasks for human agents. That is a separate product with its own requester and API terms. They don't cover the services marketplace either. If you use more than one product, each product's terms apply to it.

You accept these terms when you sign in to the developer console, create an API key or use the Services. If you accept them for an organisation, you confirm that you may bind it.

2. Who may use the Services

The Services are for organisations and for developers building a product, service or project. They are not for private, household use.
You must be at least 18 and able to enter a contract.
You must not use the Services if you, or your organisation, are subject to sanctions that prevent us from dealing with you.
You are responsible for your organisation's account, its apps and keys, and everything done with them, including by people you let use them.
Keep the contact details in your account current. We send notices about these terms, your plan and your account by email.

3. Your developer account, apps and production

You sign in to the developer console with Sign in with Prson. Your organisation has one or more apps. Each API key belongs to one app, and each app has its own plan and usage.
A new app starts in sandbox. In sandbox, verifications are free and are marked as tests. Use sandbox for building and testing only, not to verify real people for real decisions.
Each verification gives you a link. You send it to the person yourself, in your own channel; Prson doesn't contact them for you.
An app moves to production by itself once your organisation has topped up its balance or the app's free plan is approved. This happens for at most one app per person, identified by a passport or ID card verified from its chip. Any other app needs our approval, and we may refuse it.
Give accurate information about your organisation, your apps and their domains. Register only domains you control.
Developer console sessions last 12 hours and can be ended at any time. They manage your apps, keys, plan and balance only.

4. API keys and security

An API key is shown once. Keep it secret and store it on your server only. Never put a key in a website, a mobile app or a public repository.
Give each key only the scopes it needs: verifications:read, verifications:write and, for site notifications, notify:write. You can set a spending cap per key.
Rotating a key creates a new one and keeps the old one working for 24 hours. Revoke a key at once if you think it has leaked.
You are responsible for all use of your keys until you revoke them.
Requests are rate limited. Don't try to get around limits, probe other organisations' data, or test the security of the Services without our written permission. Report security issues to [email protected].
Tell us without delay at [email protected] if you learn of unauthorised access to your account or to data you received through the Services.

5. How you may use the Services

You must:

ask people for only what you need for a clear, lawful purpose, and tell them who you are and why you ask;
have a lawful basis under data protection law for each request, and give people the information that law requires before or when you ask;
keep what you receive secure, use it only for the purpose you told the person, and delete it when you no longer need it;
follow the laws that apply to you, including data protection, consumer protection, anti-discrimination and electronic communications law.

You must not:

verify, track or identify anyone without their knowledge, or use the Services for covert surveillance;
pressure or deceive people into sharing, or make access to something unrelated depend on sharing more than you need;
use results to discriminate against people unlawfully, or to profile them in ways the law doesn't allow;
use a verification result as the only basis for a decision that has legal effects on a person, or affects them similarly significantly, unless the law allows it and you give them the safeguards it requires, including the right to have a person review the decision;
resell, sublicense or share the Services or results with others as a verification service of your own, unless we agree in writing;
combine pseudonymous identifiers across organisations or sites, or try to re-identify people from data that was shared without their name;
use the Services for anything illegal, for fraud, or to harm the people you verify.

6. What a verification shows, and what it doesn't

A verification asks a person, through the Prson app, for one or more items: a fact (for example "18 or older"), a live selfie or photo, an identity document, or a signature on a PDF you upload. The person decides whether to answer. Each answer comes with Prson's verdict, signed by Prson, which you can check with Prson's published public key.

Identity facts come from a passport or ID card whose chip Prson checked against the issuing country's signature. They describe the document as it was at the time of the check.
Verification levels. Level 5 means Prson checked the chip of a genuine, unexpired document. It doesn't show that the person holding the phone is the document's holder. Level 6 adds a face match between a live selfie and the chip photo. The match runs on the person's phone, in the Prson app, and Prson checks the phone's attestation. It is not a certified presentation-attack detection check.
Live captures are photos, selfies and videos taken in the Prson camera at the time of the request. The result says what Prson could check, such as the phone's attestation and whether motion and network location were consistent. It shows that a genuine Prson app made the capture, not that what it shows is true.
Document signatures are advanced electronic signatures under the EU eIDAS Regulation (Article 26). They are not qualified electronic signatures. Prson is not a qualified trust service provider and is not on the EU Trusted Lists. Some documents need a qualified or handwritten signature by law; you decide whether an advanced electronic signature is enough for your purpose. How Prson issues signing certificates is set out in the certificate policy.

A verification doesn't show that a document is still valid, or hasn't been reported lost or stolen, after the check. It doesn't tell you anything about a person's character, intentions or eligibility for your service. You decide what a result means for you, and you remain responsible for your decisions.

7. People stay in control

People can decline any request, leave out optional items, or ignore it. A verification expires after the time you set (from 1 hour to 7 days; 72 hours by default).
When people sign in with Prson, they choose what to share with your site. They can sign in without being linked to earlier sign-ins where your site allows it.
People can stop sharing where the app offers it, turn off notifications from your site, or remove your site from their app at any time.
Each organisation sees a person through an identifier made for that organisation only. Don't try to link it to identifiers other organisations see.
Don't penalise people for declining, beyond not giving them what genuinely needed the verification.

8. Site notifications

If a person ticks "Let your site send you notifications" when they sign in with Prson, your site receives a notification handle. You can then send that person short notifications through POST /v1/notify. The rules:

Send only to people who opted in, and only with the handle from that person's own sign-in.
Send only messages about the person's relationship with your site: for example their account, an order, a booking, a request they made or a security alert. No advertising, marketing or promotions, unless the person gave separate consent that meets the law on electronic marketing.
Write truthfully as yourself. Don't pretend to be Prson or anyone else. Links must go to the exact domain the person signed in to.
Each notification is plain text: a title of up to 60 characters and a body of up to 180. A person can receive at most 3 notifications from you in any 24 hours. A production app can send up to 10,000 in 24 hours, a sandbox app 100.
When a person turns notifications off, the handle stops working for good. Don't try to reach them another way to get around that.
If, over 7 days, at least 10 people tap "Stop notifications" on your messages and they are at least 10% of the people you notified, sending is suspended automatically. We may also suspend it if you break these rules.

9. Fees, prepaid balance and free plans

Prices. Paid use is charged from a prepaid balance. Current prices, discounts and when they end are shown in the developer console and in the API (GET /v1/verifications/requirements). A verification has a base price; a price for the identity document check, charged once however many facts or details it reads; a price for a PDF signature, charged once; and a premium for some items (such as phone, address and bank facts). Launch and volume discounts apply only to the base, document check and signature prices, never both at once, and never to premiums; a verification keeps the price it was created with. A site notification costs 1 cent, or one unit of a free plan's allowance.
How money moves. When you create a verification, its full price is reserved from your balance. It is spent as answers are verified. What isn't spent goes back to your balance when the verification is cancelled or expires. If nobody answers, nothing is charged.
Top-ups. You top up by card through Stripe, in EUR, USD, GBP, CAD or AUD, from 20 to 50,000 per top-up. Your balance doesn't earn interest and isn't a deposit or e-money.
Free plans. An app may apply for the open source plan (1,000 verifications a month) or the non-commercial plan (100 a month). The open source plan needs a public, original (not forked) repository with an OSI-approved licence, pushed to in the last 6 months, holding a file Prson gives you, and linked to one of the app's domains. We check this automatically and again every 30 days. The non-commercial plan needs our approval and your acceptance of its own terms. Allowances reset on the 1st of each month (UTC) and don't carry over. Premiums are always paid. Past the allowance, requests are refused or charged at standard prices, as you choose. If an app stops qualifying, it moves back to standard prices.
Refunds. Amounts spent on verified answers and sent notifications are not refunded. You can ask at [email protected] for unused balance that isn't reserved to be refunded to the card it came from.
Taxes. Prices exclude taxes such as VAT, which are added where the law requires.
Disputed payments. If you dispute a card payment that funded your balance, we may take that amount back from your balance and suspend your organisation while the dispute is open.
Price changes. We give at least 30 days' notice by email before prices go up. A verification keeps the price reserved when it was created.

10. Personal data

You decide why you verify people, what you ask for and what you do with the results. You are the controller of the personal data you ask for and receive.
Prson as your processor. When we handle your verification requests, the PDFs you upload, the answers and the webhooks we send you, we do so on your behalf, as your processor. Our data processing agreement applies to that processing and forms part of these terms. Our sub-processors are listed on the sub-processors page.
Prson as a controller. We are the controller of people's Prson accounts and wallets, of the document checks and credentials we issue, and of what we need for security, fraud prevention, billing and our legal duties. Our Privacy Policy explains this to people.
Sign in with Prson. The person's app sends what they choose to share to your site. Once you receive it, you hold it as your own controller. For notifications, Prson keeps the domains a person turned notifications on for, so it can deliver them.
How long we keep it. Answers are kept until 30 days after the verification expires, then deleted. A PDF you upload for signing is deleted a week after upload if no verification uses it; otherwise once no verification refers to it. A signed PDF is deleted 30 days after its verification expires. Notification text stays in the person's app inbox for 30 days; our record of each send (no text) is kept 90 days. Copies you download or receive are your responsibility.

11. Availability, early access and changes to the API

The Services are in early access. We work to keep them available and secure, but we don't promise any particular uptime, and there is no service level agreement unless we sign one with you.
The API is versioned by date. The current version is 2026-10-01. We may add endpoints, fields and events at any time; build your integration to ignore what it doesn't know. When we must make a change that breaks existing integrations, we give at least 30 days' notice by email where we can. We may make urgent changes for security or legal reasons with shorter notice.
We may change or stop a feature. If we stop the Services as a whole, we give at least 90 days' notice and refund unused balance.

12. Suspension and ending

We may suspend an app, a key or your organisation, or stop notifications, if you break these terms or the law, if your use puts people, Prson or others at risk, or if a payment is disputed. Where we can, we warn you first and give you time to fix the problem. We tell you what we decided and why, and you can ask for a review by writing to [email protected].
You can stop using the Services at any time. Revoke your keys and write to us to close your organisation.
We can end these terms with 30 days' notice, or at once if you seriously or repeatedly break them.
When these terms end, your keys stop working and we delete data we hold for you as the data processing agreement says. Unused balance that isn't reserved is refunded, unless we ended the terms because of fraud or a serious breach and the law allows us to keep it to cover our losses.
Sections that by their nature should continue, such as fees owed, confidentiality, liability and law, survive the end of these terms.

13. Intellectual property, SDKs and feedback

Prson owns the Services, the API, the documentation and the Prson name and marks. We give you a limited, non-exclusive, non-transferable right to use them to build and run your integration while these terms are in force.
The SDKs are licensed under the licence stated in each package. That licence governs the SDK code; these terms govern your use of the Services the SDKs connect to.
You may use the "Sign in with Prson" button and the Prson name to show that you use the Services. Don't change the button in a misleading way, and don't suggest that Prson endorses you.
You keep your rights in your content. You give us the rights we need to run the Services for you.
If you send us feedback, we may use it without owing you anything.

14. Confidentiality

Each of us keeps the other's non-public information confidential, uses it only for these terms, and shares it only with staff and advisers who need it and are bound to confidentiality. This doesn't apply to information that is public, was already known, or is independently developed, or where the law or a court requires disclosure.

15. Warranties and liability

We provide the Services with reasonable skill and care. Apart from that, and as far as the law allows, we provide them "as is", without other warranties, express or implied.
Neither of us is liable for indirect or consequential loss, or for loss of profit, revenue, business or goodwill.
Each party's total liability under these terms is limited to the fees you paid Prson for the Services in the 12 months before the event that caused the claim.
These limits don't apply to your payment obligations, to your indemnity below, to breaches of section 5, or where the law doesn't allow a limit, such as for intent or gross negligence.

16. Indemnity

You will cover Prson's reasonable losses and costs, including legal fees, from claims by people you verified, authorities or others that arise from your breach of these terms or of the law in how you used the Services or the data you received. We will tell you promptly about such a claim and let you take part in its defence.

17. Changes, law and contact

We tell you about changes to these terms by email at least 30 days before they take effect, unless a change is needed sooner for legal or security reasons. If you don't agree, you can stop using the Services before then.
You may not transfer these terms without our consent. We may transfer them to a company that takes over the Services, and will tell you.
These terms are governed by Estonian law. The courts of Tallinn (Harju County Court) have jurisdiction, unless the law gives you the right to go to another court.
If part of these terms is invalid, the rest still applies.
Questions: [email protected]. Privacy: [email protected]. Security: [email protected].