Terms and Conditions

Effective Date: October 28, 2026 (updated for v2.3.0 AGPL-3.0 license change; originally effective July 27, 2026)

1. Acceptance of Terms

By downloading, installing, accessing, or using PyHSM software ("the Software"), whether as a free open-source user or a paid support subscriber, you ("User") agree to be bound by these Terms and Conditions ("Terms"). If you do not agree to these Terms, do not use the Software.

These Terms constitute a legally binding agreement between you and VectorGuard Labs ("we," "us," "our," or "the Company"), the developer and maintainer of PyHSM.

2. Nature of the Software

PyHSM is an open-source, software-based Key Management Service (KMS). It is not a hardware security module (HSM), does not carry FIPS 140-2/3 certification, and does not provide physical tamper evidence or secure enclave protections. The Software operates within standard operating system process boundaries.

As of v2.3.0, PyHSM is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). This license change is effective immediately. Users who had v2.2.5 already installed in their infrastructure prior to October 28, 2026 are unaffected by this change. As of v2.2.0, the IPC server requires mutual HMAC-SHA256 authentication (--ipc-secret is mandatory), and Shamir shares include per-share HMAC-SHA256 integrity. As of v2.2.5, the audit log HMAC chain spans rotation boundaries, and startup Known-Answer Tests cover all 10 active cryptographic primitives. These improvements harden the Software but do not change its fundamental nature as a software-boundary KMS.

PyHSM is provided under the AGPL-3.0. Open-source use is free. If you are embedding PyHSM in a proprietary product or running it as part of a network service without releasing your application source under AGPL, a commercial license is required — see COMMERCIAL_LICENSE.md or contact pavon@vectorguardlabs.com. These Terms supplement (and do not replace) the AGPL-3.0 and apply to all use of the Software, documentation, and associated services.

3. Assumption of Risk

You expressly acknowledge and agree that:

  • Key management is inherently risky. The management of cryptographic keys, including private keys used for blockchain transaction signing, encryption keys, and signing keys, carries material risk of irreversible loss.
  • You assume all risk of key management. You are solely responsible for the security, backup, storage, and lifecycle management of all cryptographic keys generated, imported, stored, or managed by the Software.
  • Loss of keys may result in permanent loss of funds or data. If you use the Software to manage private keys for cryptocurrency wallets, blockchain signing, or any financial application, loss of or inability to access those keys may result in the permanent, irreversible loss of digital assets. You accept this risk entirely.
  • Loss of the master password results in permanent inaccessibility. The Software encrypts all key material using a master password. If you lose the master password (or an insufficient number of Shamir shares), all keys stored in the keystore become permanently inaccessible. We cannot recover lost master passwords or keys.
  • Software bugs may exist. Despite rigorous testing (274+ tests across both layers), no software is free from defects. You acknowledge that bugs, including those affecting encryption, decryption, key rotation, or key storage, may exist and could result in data loss or key inaccessibility.

4. No Warranty

THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR FITNESS FOR SECURING DIGITAL ASSETS.

Without limiting the foregoing, we make no warranty or representation that:

  • The Software will meet your requirements or expectations;
  • The Software will be uninterrupted, timely, secure, or error-free;
  • The results obtained from the use of the Software will be accurate or reliable;
  • The Software is suitable for protecting any particular value of digital assets or sensitive data;
  • Any defects in the Software will be corrected.

5. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL VECTORGUARD LABS, ITS CREATORS, CONTRIBUTORS, AFFILIATES, OR LICENSORS BE LIABLE FOR ANY:

  • Loss of funds, digital assets, cryptocurrency, or tokens;
  • Loss of private keys, encryption keys, or signing keys;
  • Loss of access to wallets, keystores, or encrypted data;
  • Indirect, incidental, special, consequential, or punitive damages;
  • Loss of profits, revenue, data, or business opportunities;
  • Cost of procurement of substitute goods or services;

ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF OR INABILITY TO USE THE SOFTWARE, REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE), EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

This limitation applies whether the alleged liability is based on contract, tort, negligence, strict liability, or any other basis, and whether or not we have been advised of the possibility of such damage.

6. Liability Cap for Paid Support Subscribers

If you are a paid support subscriber (Priority Support or any other paid engagement), our total aggregate liability to you for all claims arising out of or related to the Software or support services shall not exceed the total fees actually paid by you to VectorGuard Labs during the twelve (12) months immediately preceding the event giving rise to the claim.

This cap applies regardless of the form of action, whether in contract, tort (including negligence), strict liability, or otherwise.

7. Indemnification

You agree to indemnify, defend, and hold harmless VectorGuard Labs and its creators, officers, employees, agents, and affiliates from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or in connection with:

  • Your use or misuse of the Software;
  • Your violation of these Terms;
  • Your violation of any applicable law, regulation, or third-party right;
  • Any loss of funds, data, or keys resulting from your use of the Software;
  • Any claims by third parties related to your use of the Software for managing their keys or assets.

8. No Fiduciary or Custodial Relationship

Nothing in these Terms or in the provision of the Software creates a fiduciary, custodial, or trust relationship between VectorGuard Labs and you. We do not hold, manage, or have access to your keys, funds, or digital assets. The Software runs entirely on your infrastructure under your control.

We are not a financial institution, custodian, wallet provider, or money services business. We provide software tools; you provide the operational security.

9. No Professional Advice

The Software, its documentation, and any communications from VectorGuard Labs (including support interactions) do not constitute financial, legal, tax, investment, or security advice. You should consult qualified professionals for decisions regarding the security of high-value digital assets, regulatory compliance, and risk management.

10. User Responsibilities

As a user of the Software, you are solely responsible for:

  • Maintaining secure backups of your keystore file(s);
  • Safeguarding your master password and/or Shamir shares;
  • Configuring IPC mutual authentication (--ipc-secret) and storing the IPC secret securely (chmod 600, preferably on tmpfs);
  • Testing the Software in a non-production environment before deploying with real assets;
  • Implementing appropriate operational security measures (access controls, network security, monitoring, audit log protection);
  • Verifying that the Software meets your specific security requirements before entrusting it with sensitive keys;
  • Keeping the Software updated to benefit from security patches;
  • Evaluating whether software-based key management is appropriate for your use case, as opposed to hardware HSMs or cloud KMS solutions with FIPS certification;
  • Reviewing COMPLIANCE.md and HARDENING.md to understand the compliance posture and deployment hardening requirements for your regulated environment.

11. Support Services

Paid support services (Priority Support, consulting engagements) are advisory in nature. Support interactions provide guidance, recommendations, and code review — they do not constitute a guarantee of security, correctness, or fitness for purpose.

Support services are subject to separate engagement terms that may include:

  • Scope of services and response time commitments;
  • Confidentiality obligations;
  • The liability cap described in Section 6 above;
  • Termination and refund provisions.

12. Open Source License

As of v2.3.0, the Software is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). This license change is effective immediately; users who had v2.2.5 already installed in their infrastructure prior to October 28, 2026 are unaffected. These Terms apply in addition to (and do not supersede) the applicable open-source license. In the event of a conflict between these Terms and the open-source license regarding the use and distribution of the source code, the open-source license governs source code licensing, and these Terms govern the relationship between you and VectorGuard Labs.

AGPL-3.0 key obligations (v2.3.0+): If you distribute a modified version of the Software, or use it to provide a network service, you must make the complete corresponding source code available under the AGPL-3.0. Proprietary use in products you distribute, or in network services where the source is not disclosed, requires a commercial license from VectorGuard Labs. Contact pavon@vectorguardlabs.com or see COMMERCIAL_LICENSE.md in the repository.

The following disclaimer (from the MIT License, preserved here for users who had v2.2.5 installed prior to October 28, 2026) is retained for continuity:

"THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."

13. Blockchain and Digital Asset Specific Terms

If you use the Software for blockchain transaction signing, cryptocurrency wallet management, or digital asset operations:

  • Irreversibility of blockchain transactions. Blockchain transactions signed using the Software are irreversible once confirmed on-chain. We bear no responsibility for incorrectly signed, misdirected, or unauthorized transactions.
  • No recovery mechanism. We cannot reverse blockchain transactions, recover lost private keys, or restore access to blockchain wallets. The decentralized nature of blockchain networks means no party can undo a confirmed transaction.
  • Regulatory compliance is your responsibility. You are solely responsible for compliance with all applicable laws and regulations regarding digital assets, including but not limited to securities laws, anti-money laundering (AML) regulations, and tax obligations in your jurisdiction.
  • Smart contract interactions. If you use keys managed by the Software to interact with smart contracts, you assume all risk associated with those interactions, including smart contract bugs, exploits, or unexpected behavior.

14. Modifications to Terms

We reserve the right to modify these Terms at any time. Updated Terms will be posted on this page with a revised effective date. Your continued use of the Software after any modification constitutes acceptance of the updated Terms.

For paid support subscribers, material changes to these Terms will be communicated via email at least thirty (30) days before taking effect.

15. Severability

If any provision of these Terms is found to be unenforceable or invalid by a court of competent jurisdiction, that provision shall be limited or eliminated to the minimum extent necessary so that the remaining provisions of these Terms shall remain in full force and effect.

16. Governing Law and Dispute Resolution

These Terms shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of law provisions.

Any dispute arising out of or relating to these Terms or the Software shall first be subject to good-faith negotiation between the parties for a period of thirty (30) days. If the dispute cannot be resolved through negotiation, it shall be resolved through binding arbitration administered in accordance with the rules of the American Arbitration Association.

17. Entire Agreement

These Terms, together with the applicable open-source license (AGPL-3.0, effective immediately as of v2.3.0) and any applicable support engagement terms, constitute the entire agreement between you and VectorGuard Labs regarding the subject matter hereof and supersede all prior or contemporaneous communications, representations, or agreements, whether oral or written.

18. Contact

For questions about these Terms, contact us at:

VectorGuard Labs
Email: pavon@vectorguardlabs.com
Web: vectorguardlabs.com