Terms of service

1 · What SelfCheck is

SelfCheck assesses whether a correspondence artefact — an email file — supports a stated claim, and produces a record of that assessment. It grades how faithful the file is to what was transmitted, tests any cryptographic signature the file carries against the key the signing domain publishes, and returns one of three answers with the reasons preserved.

2 · What SelfCheck is not

It is not legal advice, and it is not an expert report. It makes no finding about any person's honesty or intentions. It carries no approval, accreditation or endorsement from any court, regulator, government body or standards organisation, and none should be inferred.

An assessment returns one of three answers.

• Rely — The evidence supports the claim, inside the scope set out with the answer. It is scoped to the stated claim and to the exact file assessed, and is not a statement that a message, sender, account or conversation is authentic in general.
• Inconclusive — The material available cannot settle the question. This is not a finding against anyone, and it is not a failure of the assessment — it is the assessment declining to go further than the evidence goes.
• Do not rely — The evidence does not support the claim, for the stated reason. It is reached only where a defined signal fails over a source of sufficient fidelity, and it never implies wrongdoing by any person.

3 · Who may use it

During the pilot, access is limited to organisations under an agreed arrangement, and a request is normally answered within two working days. You must be authorised to act for the organisation you register, and you are responsible for what the people you admit to your workspace do with it.

4 · Your material

You keep every right you have in the files you upload. You grant only the permission needed to run the service: to store the file, assess it, produce records and reports from it, and disclose it to the recipients you yourself nominate, to the extent you choose when you nominate them.

You must not upload material you have no right to hold or share. Where a message contains another person's information, it is for you to be satisfied that you have a lawful basis for uploading it and for granting access to it.

5 · Accuracy and limits

The assessment reflects the file supplied and the state of public DNS at the moment it ran. A key can be rotated or withdrawn afterwards, and a result that verified today may not verify tomorrow against the same file — which is why the record states the time and policy version under which it was made.

Signature verification cannot be performed at all over some container formats, most notably Outlook .msg exports, which do not retain the transmitted message. Where that is so, the record says so rather than reporting a failure.

6 · Attachments and malware scanning

Files attached to a message held in a record are scanned with ClamAV, an open-source antivirus engine, before they are handed over. Anything it identifies as malware is refused, and you are told what was found. You may also check a file without downloading it.

A scan is not a warranty that a file is safe. An antivirus engine finds what its signature database knows about on the day that database was built; it does not find what nobody has yet identified, and the date of the signatures is shown with every result so that you can judge it rather than take it on trust. Where a file could not be scanned — because the scanner was unavailable, or the file was larger than it accepts — the result says "not scanned" and never "clean".

We do not accept liability for any harm arising from a file you obtain through this service, whether or not it was scanned. The correspondence and its attachments were written and sent by other people; we carry them and assess them, and we do not vouch for what is inside them. Open any file with the same care you would give one from a stranger.

A detection is not a finding about any person. Malware routinely reaches people who forwarded it in good faith, and the sender of a message carrying it may have no knowledge of it at all.

7 · Availability

The pilot is provided as it stands, without a service level commitment. Records may be removed, and the pilot may be withdrawn, on reasonable notice.

8 · Liability

Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited. Subject to that, and because the pilot is provided without charge, liability for loss arising from reliance on an assessment is excluded to the extent the law allows. You remain responsible for the decisions you take.

9 · Governing law

These terms are governed by the law of England and Wales, and its courts have exclusive jurisdiction. SelfCheck is operated by Pavlo Kushnirenko, acting as an individual. The operating company is in the course of being incorporated; until it exists, no contract is offered or concluded through this site, and the data controller is a named individual rather than a company.