# Encypher CAWG Organizational Identity Subscriber Agreement

**Version:** 1.0
**Status:** Active on publication
**Certificate Policy OID:** 1.3.6.1.4.1.67057.1.1
**Governing document version:** Encypher CAWG Organizational Identity Certificate Policy and Certification Practice Statement (CP/CPS) v1.0
**Agreement location:** https://encypher.com/trust/documents/cawg-subscriber-agreement
**CPS location:** https://identity-ca.encypher.com/repository/cps

---

## 1. Parties and Acceptance

This Subscriber Agreement ("Agreement") is between Encypher Corporation, a Delaware corporation ("Encypher," "we," the "CA"), and the organization identified in the certificate application ("Subscriber," "you"). It governs each X.509 certificate issued to you under the Encypher CAWG Organizational Identity CP/CPS (each, a "Certificate") and the services Encypher performs to validate, issue, renew, use, and revoke it.

**Agreement formation.** This Agreement becomes binding only when, before Encypher accepts your application, an authenticated individual who is an owner or administrator of your Encypher organization account, with recent multi-factor authentication and organization membership verified server-side, affirmatively accepts this exact Agreement version by checking an initially unchecked box and activating an acceptance control. Applying for, receiving, or using a Certificate, silence, inactivity, a preselected control, or any other purported acceptance method does not form this Agreement.

**Electronic acceptance and records.** The acceptance presentation MUST identify your organization account and this Agreement's version number, link to this Agreement, and state whether you give the standing renewal authorization in Section 9.4. Encypher MUST record the accepting individual, your organization, the Agreement version, the SHA-256 digest of the Agreement text, the time, and your renewal choice, in an append-only record. Only an acceptance of the current version and digest counts. Encypher MUST NOT submit, evaluate, or issue under an application while no current acceptance exists.

**Authority to bind.** By accepting, the individual represents that they are authorized to bind your organization to this Agreement. That representation is separate from the authority confirmation in Section 4.3, which confirms that the requesting user may request a Certificate for your organization.

**Business use only.** Certificates are offered only to legal entities and only for business, professional, or institutional use. Certificates are not offered to individuals or for personal, household, or consumer use.

If you do not agree, you MUST NOT apply for or use a Certificate, and you MUST ask Encypher to revoke any Certificate already issued to you.

## 2. Definitions

Capitalized terms not defined here have the meaning given in the CP/CPS. The key words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY in this Agreement are to be interpreted as described in RFC 2119.

- **Actor:** the Encypher record that represents your organization as a CAWG named actor. Each Actor has its own signing key in Google Cloud KMS and at most one active Certificate at a time.
- **Actor Key:** the private key of the Actor. It is generated and held by Encypher and never leaves the hardware security module (Section 9).
- **CAWG Identity Assertion:** a `cawg.identity` assertion, as defined by the Creator Assertions Working Group Identity Assertion specification, that names your organization as the named actor in content credentials.
- **Certificate Beneficiaries:** you and Relying Parties who reasonably rely on a valid Certificate.
- **Encypher Verified Organizations List:** the CAWG trust list Encypher publishes at https://trust.encypher.com under its inclusion policy.
- **Registry Record:** the record of your organization in an accepted register (GLEIF, UK Companies House, or an official register consulted in exception review) from which Encypher copies every value in your Certificate.
- **Relying Party:** any person or system that validates a CAWG Identity Assertion signed with a Certificate.
- **Requesting User:** the owner or administrator of your Encypher organization account who submits your application (the "Applicant Representative" in the CP/CPS).
- **Role Addresses:** `admin@`, `administrator@`, `webmaster@`, `hostmaster@`, and `postmaster@` on the registrable domain of your verified website.
- **Signing Grant:** a permission, managed in your Encypher account, that lets a named user or system ask Encypher to sign with your Actor Key.
- **Standing Representative:** the recorded result of a successful authority confirmation for one Requesting User (Section 4.3).
- **Confidential Information:** non-public business, technical, security, pricing, validation, or operational information disclosed by one party to the other. It does not include Certificate contents, certificate status information, CRLs, OCSP responses, timestamps, entries in the Encypher Verified Organizations List, or information the CP/CPS or applicable law requires Encypher to publish or disclose.
- **Excluded Claims:** the claims and matters listed in Section 15.3 that are not subject to the liability cap or the exclusion of consequential damages.

## 3. Order of Precedence and Incorporation of the CP/CPS

The CP/CPS version named in the header of this Agreement version is incorporated by reference. Later publication or amendment of the CP/CPS does not change the version you accepted except through the acceptance process in Section 22. If documents conflict:

1. The CP/CPS controls certificate lifecycle, technical profile, identity and authority validation, issuance, repository, revocation, key custody, and security.
2. This Agreement controls commercial and legal terms to the extent it does not conflict with the CP/CPS.
3. An order form controls pricing, service levels, and business terms for that order, but cannot waive or reduce a CP/CPS, security, or legal-compliance obligation.

## 4. Certificate Application and Identity Validation

**4.1 Eligibility.** You MUST be a legal entity that appears in an accepted register with a status that the CP/CPS accepts, and you MUST hold an Encypher organization account with an active entitlement that includes organizational identity. Encypher issues organization certificates only. Certificates for individuals, subsidiaries, and brands are not issued under this Agreement version.

**4.2 Organization identity.** The Requesting User picks your organization from register search results; Encypher never picks a record for you. Encypher copies your legal name, country, and registration identifier from the Registry Record and from nowhere else. Nothing you type, no account display name, and no trademark is placed in a Certificate. You MUST prove control of your website's host through the Encypher domain verification process, and the Certificate names that host. Encypher re-fetches the Registry Record and re-checks domain control at every evaluation, including renewals.

- A US organization without an accepted Legal Entity Identifier (LEI), and any other organization that no automated source covers, goes to human exception review. The reviewer confirms your existence and good standing with the official register itself, either through the register's online record or through a certificate of good standing issued no more than 90 days before the review, whose authenticity the reviewer confirms with the issuing register. Encypher MAY ask you for such a certificate.
- Encypher does not check the personal identity of any individual. No personal name or personal data appears in a Certificate.

**4.3 Requesting User and authority confirmation.** Every application is made by a Requesting User. Encypher confirms that this specific user may act for your organization by one of three methods:

1. **Approval email (EV-linked domain).** Where your verified website presents a current, unrevoked Extended Validation TLS certificate whose registration number and jurisdiction match the Registry Record, Encypher emails each Role Address. The email names your organization, the Requesting User, and what approval grants. Approval or refusal requires an explicit action on the linked page. The link is valid for 24 hours.
2. **Registered-office letter.** Encypher posts a one-time code to the registered office shown in the Registry Record. The address is never one you supply. The letter names your organization, the Requesting User, what entering the code authorizes, and how to decline or report abuse. Entering the correct code confirms authority. A code expires after 45 days.
3. **Exception review.** An Encypher reviewer decides other evidence of authority, for example evidence that the Requesting User holds an officer post, or a letter from your attorney or accountant that the reviewer confirms independently. The reviewer never approves a Certificate; the reviewer records the evidence, and the automated process evaluates your application with it.

A successful confirmation creates a Standing Representative for that user, valid for up to 825 days. It ends earlier if you withdraw it, if a Role Address recipient or your registered office declines, if your registry name, number, or status changes, if the user stops being an owner or administrator of your account, or if a Certificate it supported is revoked for a trust-breaking reason. A confirmation for one user never authorizes another user.

You acknowledge that the approval email and the letter prove control of a channel that a public CA or a register vouches for, and do not prove that the person who approves holds an office. Anyone who can read a Role Address or who receives post at your registered office can approve a request made by an owner or administrator of your account. You are responsible for who can read those mailboxes and that post, and you MUST decline, through the path given in the email or letter, any request you did not authorize.

**4.4 One organization, one account.** An organization identifier MAY be held by only one Encypher organization account at a time. A claim that conflicts with another account goes to exception review, and Encypher notifies the account that holds the identifier.

**4.5 Review of a new Certificate.** You MUST review each new Certificate and report any error to ca@encypher.com within seven (7) days of issuance.

## 5. Authorized Use

You MAY use a Certificate only to sign CAWG Identity Assertions that name your organization as the named actor, through the Encypher signing path, under a Signing Grant, and only for content that your organization publishes or authorizes. Every such assertion carries a trusted RFC 3161 timestamp. A Certificate states your organization's verified identity. It does not state anything about the accuracy, editorial position, or lawfulness of the content you sign.

## 6. Prohibited Use

You MUST NOT, and MUST NOT permit any third party to:

1. Use a Certificate to sign an outer C2PA claim, for TLS client or server authentication, for S/MIME signing or encryption or any email use, for code signing or time-stamping, or for any document signing other than CAWG Identity Assertions.
2. Use a Certificate after it has expired or been revoked, or after you know or suspect that a credential controlling its use has been compromised.
3. Give a Signing Grant to, or otherwise let a Certificate be used by, any person or system that does not act for your organization, or use a Certificate to sign content on behalf of another organization.
4. Use a Certificate to misrepresent who created or published content, or to imply endorsement by Encypher, a trust program, or any Relying Party.
5. Sign content that you know is unlawful, infringing, or deceptive about its origin.

## 7. Subscriber Obligations

You MUST:

1. **Report changes.** Tell Encypher at ca@encypher.com within five (5) business days of any change in your legal name, registration number, registry status (including dissolution, strike-off, liquidation, or administration), registered office, or control of the verified host.
2. **Report compromise within 24 hours.** Tell Encypher at ca@encypher.com within twenty-four (24) hours of learning of, or suspecting, any out-of-policy handling of your Actor Key, any compromise of an account or API credential that holds a Signing Grant, or any signature you did not authorize.
3. **Request revocation.** Request revocation if any Certificate content becomes inaccurate.
4. **Limit Signing Grants.** Keep Signing Grants limited to people and systems that you authorize, and end a grant when the person leaves your organization or the system is retired.
5. **Protect account credentials.** Protect the credentials and multi-factor authentication of your owners, administrators, and every user or system that holds a Signing Grant.
6. **Use Certificates only as authorized.** Use Certificates only under Section 5, and stop requesting signatures with a Certificate once it has expired or been revoked.
7. **Review new Certificates.** Review each new Certificate under Section 4.5.
8. **Answer requests.** Respond to Encypher's reasonable requests for information about your registration or about a report received under Section 10.
9. **Control your confirmation channels.** Meet your responsibility for Role Addresses and registered-office post under Section 4.3.

## 8. Subscriber Representations and Warranties

You represent and warrant that:

1. The information you provide in the application and afterwards is accurate, complete, and truthful.
2. Your organization is a legal entity that exists and is in good standing in the register it is recorded in.
3. The Requesting User may act for your organization in requesting Certificates, and the individual accepting this Agreement is authorized to bind you.
4. You will comply with the CP/CPS and this Agreement and will use Certificates only for their authorized purpose.
5. You have all rights, permissions, licenses, and consents needed for the content, metadata, assertions, names, and personal data that you submit or sign.
6. Content you sign is not false or deceptive about its origin, and is not unlawful, infringing, or defamatory, and you will not use Certificates to imply Encypher or Relying-Party endorsement of content.

## 9. Key Management and Renewal

**9.1 Custody by Encypher.** Encypher generates each Actor Key inside Google Cloud KMS at the HSM protection level (FIPS 140-2 Level 3), as a non-exportable P-384 key under Encypher's exclusive control. You never hold the Actor Key. Encypher never delivers it to you or to anyone else, and does not escrow or back it up outside KMS. Every signature with it is computed inside the HSM.

**9.2 Control through Signing Grants.** Encypher signs with your Actor Key only when a user or system holding a valid Signing Grant for your Actor asks it to, and only while your Actor has an active Certificate. When onboarding finishes, you MAY create one Signing Grant for the Requesting User. That grant ends if the user stops being an owner or administrator of your account. You add, limit, and end other grants in your account.

**9.3 No re-key on the same Actor.** A Certificate over a new key is issued only to a new Actor, after the full validation of Section 4. This happens after any actor-wide revocation (Section 10.3) and whenever your registration identifiers change.

**9.4 Optional standing renewal authorization.** When you accept this Agreement you MAY authorize Encypher to renew for you. If you do, then thirty (30) days before a Certificate expires, Encypher submits the renewal application on your behalf, but only while your Standing Representative is current and that user remains an owner or administrator of your account. A renewal is evaluated like a new application: Encypher re-fetches the Registry Record, re-checks domain control, and requires a current Standing Representative. A renewal never extends a Standing Representative. You MAY withdraw the authorization at any time in your account or by email to ca@encypher.com. If you do not give the authorization, or it cannot be used, Encypher notifies your owners and an owner or administrator submits the renewal. If a renewal stalls, Encypher notifies your owners with the next action, and again seven (7) days before expiry.

## 10. Revocation

**10.1 Requests.** An owner or administrator of your account MAY request revocation at any time through the dashboard or API, or by email to ca@encypher.com. A Role Address recipient or your registered office MAY decline a request, or report it as unauthorized, through the path given in the approval email or letter. Encypher acts on an email request from anyone else after confirming it with your account contacts or after finding a revocation reason itself.

**10.2 Reasons and deadlines.** Encypher revokes a Certificate within 24 hours after it learns that you request revocation; that a Role Address recipient, your registered office, or you decline or report the request as unauthorized; that the Actor Key, or any key or credential that controls its use, has been compromised or handled out of policy; or that the identity or authority evidence relied on cannot be relied upon. Encypher revokes a Certificate within 5 days after it learns that your registry status is no longer accepted; that your legal name or registration number has changed; that you no longer control the host named in the Certificate; that the Certificate does not conform to the CP/CPS or was issued in breach of it; that you have breached this Agreement or the CP/CPS or misused the Certificate; or that Encypher ceases operating the hierarchy without arranging continued status services. Suspension is not supported.

**10.3 Actor-wide scope.** Every revocation is actor-wide, with one exception. Actor-wide revocation revokes every unexpired Certificate over your Actor Key, disables the Actor Key in KMS, and stops all signing for that Actor. Any later Certificate is issued to a new Actor with a new key, after full validation. After a trust-breaking revocation, a new application for your organization goes to exception review. The exception: when your legal name changes and the replacement Certificate is already active on the same Actor, only the old Certificate is revoked, with reason `superseded`, and the Actor continues.

**10.4 Status publication.** Encypher publishes revocation status through the CRL of the issuing CA and through OCSP at http://identity-ca.encypher.com/ocsp. Revocation takes effect on publication. How a Relying Party treats content signed before revocation depends on the Relying Party and on the revocation reason; Encypher does not control it.

**10.5 Effect on a Standing Representative.** A user losing their role or membership ends that user's Standing Representative and the onboarding Signing Grant. It does not by itself revoke the Certificate, because the Certificate identifies your organization and not the user.

## 11. CA Obligations and Warranties

1. Encypher will validate, issue, manage, and revoke Certificates under the CP/CPS, and will publish the CP/CPS, CA certificates, CRLs, and OCSP responses without authentication.
2. **Scope of warranty.** For the validity period of each Certificate, Encypher warrants to the Certificate Beneficiaries that, at issuance, the legal name, country, and registration identifier in the Certificate matched a Registry Record verified under the CP/CPS; a Standing Representative confirmed under the CP/CPS authorized the request; you controlled the host named in the Certificate; the Certificate conformed to the CP/CPS profile; and Encypher maintained revocation status under the CP/CPS. These warranties are limited to identity, authority, issuance, and status facts.
3. **Content disclaimer.** A Certificate confirms organizational identity and makes no judgment on editorial position. Encypher does not warrant, and is not responsible for, the accuracy, authorship, lawfulness, licensing, originality, human or AI origin, or safety of any content or assertion signed with a Certificate.
4. **Trust decisions of others.** Each validator, platform, and trust program decides for itself whether to trust the Encypher root. Encypher does not warrant that any of them accepts a Certificate, and this hierarchy has no external audit.

## 12. Confidentiality and Publication

**12.1 Confidentiality.** Each party will use the other's Confidential Information only to perform this Agreement, protect it with at least reasonable care, and disclose it only to personnel, contractors, professional advisers, auditors, and subcontractors who need to know it and are bound by confidentiality obligations, or as required by law, court order, or the CP/CPS. Validation evidence, exception-review documents, challenge records, and audit logs are Encypher's confidential records.

**12.2 Identity in signed content.** Your verified identity is public by design. Every Certificate carries your organization's legal name, country, registration identifier, and verified website host, and every CAWG Identity Assertion you sign carries that Certificate to anyone who receives the content.

**12.3 Encypher Verified Organizations List.** If you opt in during your application, Encypher adds your organization to the Encypher Verified Organizations List when your Certificate is activated. The entry shows your legal name, country, organization type, Certificate, listing status and dates, and, if you choose it, that your organization discloses AI-generated content. You MAY withdraw your opt-in at any time; Encypher then stops listing your organization as active within five (5) business days. When a listed Certificate is revoked, Encypher marks the entry revoked. The list's change history is append-only, so a past entry is marked, not deleted. Presence on the list is not, by itself, a reason for anyone to trust a Certificate; Relying Parties still check status.

## 13. Intellectual Property

1. You retain ownership of your content, your names, and your marks.
2. Encypher retains ownership of the CA services, APIs, software, documentation, certificate templates, repository, and Encypher marks. Encypher owns the Certificates, CRLs, and OCSP responses it issues, and MAY store, use, publish, and disclose them as the CP/CPS requires.
3. You grant Encypher a limited license to use your name, registration details, and submitted information to validate, issue, list (when you opt in), renew, revoke, audit, and support Certificates, and for marketing only with your prior written consent.
4. No other license to either party's marks or to any Encypher patent or patent application is granted by implication, estoppel, or otherwise. Encypher MAY use feedback you provide without restriction.

## 14. Disclaimer of Warranties

Except for the limited warranty in Section 11.2, each Certificate and all related services are provided "as is" and "as available," and Encypher disclaims all other warranties, express or implied, including any implied warranties of merchantability, fitness for a particular purpose, and non-infringement, to the maximum extent permitted by law. Nothing in this Section disclaims a warranty that cannot be disclaimed under applicable law.

## 15. Limitation of Liability

1. **No indirect damages.** Except for Excluded Claims, and to the maximum extent permitted by law, neither party is liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or goodwill. This exclusion does not limit your indemnification obligations (Section 16) or your payment obligations.
2. **Encypher liability cap.** Except for liabilities that cannot be limited under applicable law, Encypher's total, aggregate, cumulative liability to you, your affiliates, and all Certificate Beneficiaries claiming through or based on Certificates issued to you under this Agreement, collectively as one shared liability pool and not separately per claimant, Certificate, event, or claim, arising out of or relating to this Agreement, any Certificate, the CP/CPS, or related CA services, whether in contract, tort including negligence, strict liability, statute, or otherwise, will not exceed USD 100, unless an order form states a different amount. The parties agree that this cap is a material part of the bargain and reflects the limited CA function of identity and authority validation, certificate issuance, key custody, lifecycle management, repository operation, and revocation status. Encypher does not insure content, assertions, your systems, Relying Party decisions, market outcomes, or downstream use of signed content. If a court of competent jurisdiction finally holds the USD 100 cap unenforceable as applied to a particular claim, the cap must be reformed and enforced to the maximum extent permitted by law; if the court does not reform it, Encypher's aggregate liability for that claim will not exceed the greater of USD 100 and the fees paid or payable by you to Encypher for the services giving rise to the claim during the twelve (12) months before the event giving rise to the claim.
3. **Your uncapped liability (Excluded Claims).** Nothing in this Section 15 limits your indemnification obligations (Section 16) or your payment obligations, and, as to you only, the following matters (the "Excluded Claims") are not subject to any cap or to the exclusion of indirect damages: your breach of Sections 5, 6, 7, 8, 12.1, or 13; certificate misuse; use after expiration or revocation; compromise of an account, API credential, or Signing Grant attributable to you or your systems; approval of a request through a Role Address or registered-office channel you control; content signed by or for you; claims of infringement, defamation, privacy, publicity, consumer-protection, false-advertising, regulated-content, or misrepresentation related to your content or assertions; fraud; willful misconduct; or gross negligence. Your liability for the Excluded Claims is uncapped.
4. **Subscriber-fault losses.** Encypher is not liable for any loss arising from your failure to protect a credential or limit a Signing Grant, your use of a Certificate outside Section 5, your use of a Certificate after expiry or revocation, inaccurate information you supplied or failed to update, or the content you sign, except to the extent the loss directly arises from Encypher's negligence or willful misconduct. Any Encypher liability preserved by the preceding sentence remains subject to Section 15.2 except to the extent it cannot be limited under applicable law.
5. **Optional enterprise cap (applies only if invoked by an order form).** Notwithstanding Section 15.2, solely for a paid enterprise order that expressly identifies and invokes this Section 15.5, Encypher's aggregate liability to you will not exceed the fees paid or payable under that order form during the twelve (12) months before the event giving rise to the claim. This Section 15.5 does not increase Encypher's liability to Relying Parties or any other Certificate Beneficiary.

## 16. Indemnification

1. You will defend, indemnify, and hold harmless Encypher and its affiliates, officers, directors, employees, agents, contractors, licensors, and service providers from and against all third-party claims, demands, investigations, losses, liabilities, damages, penalties, settlements, costs, and expenses (including reasonable legal fees) arising out of or relating to any Excluded Claim, including claims by Relying Parties, validators, trust programs, regulators, content owners, or data subjects.
2. **Defense procedure.** Encypher will give you prompt notice of the claim. You will not settle any claim in a manner that admits Encypher fault or imposes any obligation or restriction on Encypher without Encypher's prior written consent. Encypher MAY assume sole control of the defense and settlement of any matter affecting revocation, trust-list status, injunctive relief, or its reputation.

## 17. Term and Termination

1. This Agreement is effective on acceptance and continues while you have an open application or any valid Certificate.
2. You MAY terminate at any time by revoking all of your Certificates and withdrawing any open application. Either party MAY terminate on written notice if the other materially breaches and fails to cure within thirty (30) days. Encypher MAY suspend service or terminate immediately for security reasons or for use that violates Section 6.
3. On termination, Encypher revokes every Certificate issued to you actor-wide (Section 10.3), ends your Signing Grants and any standing renewal authorization, and stops listing your organization as active in the Encypher Verified Organizations List. The following survive termination: Sections 8, 11.2 (for claims arising while a Certificate was valid), 11.3, 11.4, 12, 13, 14, 15, 16, 19, and 20.

## 18. Fees and Service Levels

Issuance requires an active Encypher entitlement that includes organizational identity. Fees, if any, are stated in the applicable order form and are non-refundable except as required by law or as the order form states. Service levels, support, and service credits, if any, are stated only in the applicable order form or SLA. The CP/CPS repository and status-service obligations do not create any uptime warranty, service credit, or remedy except as an order form or SLA expressly states.

## 19. Data Protection

The parties will comply with applicable privacy and data-protection laws. If the parties separately execute a data processing agreement, that agreement controls the processing within its stated scope. Encypher processes the personal data collected for validation and issuance as an independent controller for CA operations, security, fraud prevention, audit, and legal purposes, under the Encypher Privacy Policy (https://encypher.com/privacy). A Certificate contains no personal data.

Encypher shares data with these subcontractors only to perform this Agreement:

| Subcontractor | Purpose | Data it receives |
|---|---|---|
| Lob | Prints and mails registered-office letters | Your legal name and registered-office address, the Requesting User's name, the letter text, and the one-time code |
| Zoho (Zoho Mail) | Delivers approval emails | The Role Addresses and the approval emails, including the approval links |
| Google Cloud (Cloud KMS) | Generates and holds CA keys and Actor Keys, and computes every signature | The digests to be signed; the keys it generates never leave it |

Lob prints in the United States, so the letter data of a non-US organization is transferred to the United States. Encypher also queries GLEIF and UK Companies House with the search terms and identifiers needed to find your Registry Record, and runs its services on infrastructure providers named in the Encypher Privacy Policy. Encypher does not sell onboarding data and does not use it for marketing. You acknowledge that Certificates, revocation status, CRLs, OCSP responses, logs, and validation records are retained for the periods stated in CP/CPS Section 5.5 and may not be deletable on an ordinary data-subject request where retention is legally or operationally required.

## 20. Governing Law and Disputes

This Agreement, and any dispute arising out of or relating to this Agreement, the CP/CPS, or any Certificate, is governed by the laws of the State of Delaware, United States, without regard to conflict-of-laws principles. The state and federal courts located in Delaware have exclusive jurisdiction, and each party waives objection to venue and personal jurisdiction in those courts. Either party MAY seek temporary, preliminary, or permanent injunctive relief in any court of competent jurisdiction for certificate misuse, credential or key compromise, confidentiality breach, data-security breach, or infringement or misuse of intellectual property.

## 21. Notices

Operational notices, revocation requests, and compromise reports to Encypher go to ca@encypher.com. Legal notices go to Encypher Corporation, 850 New Burton Road, Dover, DE 19904, USA, with a copy to ca@encypher.com. Written correspondence MAY be sent to Encypher Corporation, 2093 Philadelphia Pike #6262, Claymont, DE 19703, USA. Notices to you go to the owners of your Encypher organization account. Each party MUST keep its contact information current.

## 22. Amendments

Encypher MAY publish new versions of this Agreement or the CP/CPS and notify the owners of your account. A new version does not modify the version you accepted unless an authenticated owner or administrator affirmatively accepts it through the process in Section 1. Continued use of a Certificate does not constitute acceptance of a new version. When a new version adds Subscriber obligations, your open application returns to `needs_info` until an owner or administrator accepts it, and Encypher MAY decline to submit a renewal under a version you have not accepted. Certificates already issued remain governed by the version you accepted until they expire or are revoked.

## 23. General

1. **Assignment:** you MUST NOT assign this Agreement or a Certificate without Encypher's prior written consent; Encypher MAY assign this Agreement to an affiliate or to a successor that continues the hierarchy under the CP/CPS.
2. **Severability and reformation:** if any provision of this Agreement, including any exclusion, cap, or limitation in Section 15, is held invalid or unenforceable, it will be enforced to the maximum extent permitted by law and reformed to the valid, enforceable provision that most closely reflects the parties' original intent, and the remainder of this Agreement stays in effect.
3. **Waiver:** a waiver of one breach is not a waiver of another.
4. **Force majeure:** Encypher is not liable for delay caused by events beyond its reasonable control, but it MUST still publish revocations as soon as it is able.
5. **Entire agreement:** this Agreement, together with the CP/CPS version named in its header, any separately executed data processing agreement, and any written order form, is the entire agreement between the parties regarding Certificates.