SOTRU Website Terms and Conditions

SOTRU IDENTITY AND COMMUNICATIONS (PTY) LTD ("our company") manages the SOTRU Software Website Platform ("SOTRU Platform"). If you would like to contact us directly, please email us at info@sotru.io. These terms and conditions are applicable every time you access the SOTRU Platform and/or order goods from the website. Reference to goods include any software products ordered from our company.

About SOTRU

SOTRU is a secure, decentralised identity and messaging platform purpose-built to solve the growing need for verifiable, privacy-preserving digital identities in both domestic and cross-border B2B contexts.

The platform leverages W3C-compliant Decentralised Identifiers (DIDs) and AnonCreds Verifiable Credentials (VCs) to enable real-time, trust-based data sharing between organisations – without relying on centralised identity providers or compromising privacy.

At its core, SOTRU combines DIDComm-encrypted messaging with credential-based identity verification, allowing counterparties to authenticate each other instantly and securely exchange sensitive information such as invoices, payment details, or contracts.

A key architectural feature is SOTRU's data sovereignty model. All verifications and credential exchanges are permissioned and under full user control. When one party requests specific data, such as a registration number or verified bank account number, the counterparty can selectively approve or decline the disclosure. All interactions are cryptographically signed and transmitted over secure encrypted channels. Identity verification is performed by validating the authenticity of credentials owned by an organisation.

In parallel to the main SOTRU platform, a separate Issuer platform is responsible for issuing credentials to verified organisational accounts.

To maintain integrity over time, SOTRU implements comprehensive credential lifecycle management:

• Initial ID&V checks are performed at issuance using trusted government and banking sources.
• Credentials include an issuance date and verified data source timestamp, both visible to verifiers.
• Verifiers always receive the latest valid version, with cryptographic proof of issuance and revocation status.
• Contextual warnings, shown after identities have been verified (e.g., "This company was registered less than a month ago"), further support risk-based decision-making.

All verification events are recorded in a comprehensive audit trail, accessible to both parties in a connection. Verified contacts have rich profile views showing credential holdings, status, and history – enabling businesses to build a complete, up-to-date trust profile for each counterparty.

Ultimately, SOTRU provides a privacy-preserving, verifiable communications layer tailored to the realities of modern B2B interaction – bridging decentralised identity and secure messaging in a seamless experience.

1. Ownership

The SOTRU platform is operated by our company and by ordering our product, we provide you with a limited, non-exclusive, non-transferable license to use the SOTRU Platform for legitimate business purposes in accordance with these terms. All rights and intellectual property in this SOTRU Platform are owned by our company. Unless explicitly authorized in writing, users may not:

• Copy, reproduce, or modify any part of the SOTRU platform;
• Distribute or lease the platform or services;
• Use SOTRU's content for commercial gain outside the scope of agreed services.

2. Ordering Goods and Cancellations

Users are not allowed to impersonate someone and must be over the age of 18 to use the Application.

No information or data on this SOTRU Platform is an offer, but merely an invitation to do business.

All orders placed through our SOTRU Platform will be subject to our acceptance of the order. We reserve the right to decline any order without giving any reasons and will only be liable to refund monies already paid by you.

2.1 Refunds

Refunds are issued only in the case of platform defects, such as:

• Inability to receive verifiable credentials due to platform error/inability to successfully verify your company for a prolonged period of time exceeding 7 days.
• Prolonged, unplanned downtime impacting core features.

2.2 How to Request a Refund

You can:

• Submit a request via the SOTRU support chat or info@sotru.io email with:
  • a clear description of the issue; and
  • supporting evidence (screenshots, logs, timestamps).

Refunds will be reviewed and processed within 7–10 business days.

2.3 Refund Exclusions

Refund exclusions include, but are not limited to:

• User error (e.g., deleted credentials, forgotten passwords);
• Mid-cycle cancellations;
• Incompatibility due to unsupported networks or devices; and
• All refunds must be approved by the SOTRU management team.

When you submit an order to us on our SOTRU Platform, you will receive an email to confirm that we are processing your order, including estimated timescale for installation and access to the goods. You should check this communication for accuracy and let us know immediately if there are any errors. The communication does not constitute acceptance of the order by us. Your order has been successfully completed upon receipt of order confirmation.

If you qualify as a consumer under the CPA, you are entitled to the cooling off period of 5 days, subject to your purchase being concluded as a result of direct marketing.

3. Processing Your Orders and Payment

3.1 Free Trials

We may offer eligible new subscribers a free trial for the period specified at the time of sign-up. Unless otherwise stated, a valid payment method is required when starting a Free Trial.

No subscription fee will be charged during the Free Trial. Unless the subscription is cancelled before the Free Trial ends, the selected paid subscription will begin automatically at the end of the Free Trial and the applicable subscription fee will be charged to the stored payment method.

Free Trials may be limited to one per subscriber or organisation. We reserve the right to refuse, withdraw or terminate a Free Trial where we reasonably believe that it is being misused.

3.2 Subscription Billing and Automatic Renewal

Paid subscriptions are billed monthly in advance and automatically renew at the end of each monthly billing period unless cancelled before the next renewal date.

By subscribing to a paid plan or commencing a Free Trial that requires a payment method, you authorise us and our payment service providers to store the relevant payment authorisation and automatically charge the applicable subscription fee to your selected payment method when payment becomes due.

You may cancel your subscription at any time before the next renewal date. Unless otherwise stated, cancellation will take effect at the end of the then-current billing period and you will retain access until that date.

3.3 Prices and Price Changes

The subscription price payable will be the price displayed and accepted at the time of sign-up, subject to any applicable promotional or founding customer pricing.

We may change our subscription plans, fees or pricing structure from time to time. Any increase to the recurring subscription fee of an existing subscriber will be communicated in advance and will apply from a future billing date stated in the notice.

You may cancel your subscription before a notified price increase takes effect. Any express fixed-price or founding customer commitment made by us will continue to apply in accordance with its stated conditions.

Whilst it is our intention to keep our SOTRU Platform up to date and error free, product description or pricing errors may occur. You may then either cancel your order or re-confirm it based on the correct information. If we are unable to contact you via the contact details provided by you, we will treat your order as cancelled.

Please note that fees may be applicable for additional users, usage, verification services or other paid features beyond those included in your selected subscription plan. Any applicable charges will be disclosed before they are incurred.

4. Defective Goods

Should the SOTRU platform fail to:

• be reasonably suitable for the purposes for which they are generally intended;
• be of good quality, in good working order and free of any defects; or

you may request a refund of the goods within 14 days of use of goods, subject to your use of the goods in the first month's use. Please note that should you have been satisfied with the goods during your free-trial, you are not entitled to request a refund and have to follow your termination rights without refund.

5. Prices, VAT and Other Taxes

All prices are stated in South African rand unless otherwise indicated.

SOTRU is not currently registered as a vendor for value-added tax and VAT is therefore not charged on subscription fees.

If SOTRU becomes registered for VAT or is otherwise required by law to charge any tax, that tax may be added to future charges from the applicable date. Where reasonably practicable, subscribers will be notified in advance of any resulting change to the amount payable.

Subject to these terms, the price displayed for a subscription or service is the amount payable, except for separately disclosed charges for additional users, usage, verification services, optional features or custom development.

6. Privacy

Our company electronically collects, stores and uses information provided when you create an account, place an order or use the SOTRU Platform. We use this information to provide, administer, secure and improve our services.

Subscription billing and payment services are provided with the assistance of third-party service providers, including Chargebee and Paystack. Chargebee assists with subscription management, billing and related communications, while Paystack processes card payments and related payment transactions.

Payment card information is submitted to and processed by the relevant payment service providers. SOTRU does not directly store complete payment card details.

We may disclose information to service providers and other parties where reasonably necessary to provide the SOTRU Platform, process payments, perform identity or business verification, comply with legal obligations, prevent fraud or protect our rights and users.

Any processing of personal information will also be governed by our Privacy Policy and applicable data-protection legislation.

We may require the following information from you in order to process your order before any goods are made available to you:

• Your full names, telephone number, email address, optional profile photo, user ID, postal address, whichever is applicable;
• Your business name, logo, registered address, organisationID and organisational wallet detail if you purchase the goods on behalf of a business;
• Business identity credentials;
• Verifiable credentials;
• Sensitive data;
• Bank details;
• Connection metadata;
• Audit trails; and/or
• Other information as may be required to provide services to you.

We have included strong encryption, at rest and in transit, but we do not guarantee that data breaches can't occur and do not accept any liability for data exposure and/or losses. Your use of the SOTRU Platform is at your own risk.

6.1 User Security Responsibilities

While SOTRU employs comprehensive security measures to safeguard data, users are also responsible for maintaining the security and confidentiality of their information by adhering to the following practices:

• Strong Passwords: Users shall create and retain strong, unique passwords for accessing their organisational wallet via the asymmetric passwords mechanism. Passwords must be a minimum of 12 characters and incorporate a combination of letters, numbers, and symbols.
• Secure Device Management: Users shall ensure that their devices and browsers are protected with up-to-date antivirus software, robust passwords, and biometric authentication (where applicable), to prevent unauthorised access to private keys stored within IndexedDB.
• Confidentiality of Credentials: Users shall exercise caution when reviewing and approving data-sharing requests, utilising SOTRU's selective disclosure feature to share only the information necessary with counterparties.
• Regular Account Monitoring: Users shall periodically review audit logs and connection records within the SOTRU platform to identify and report any suspicious activity. It is also recommended that users export such data on a regular basis for record-keeping.
• Prompt Notification of Changes: Users shall promptly inform SOTRU of any changes to their business details (such as banking information or directors) to facilitate necessary credential re-verification or revocation, thereby ensuring data accuracy and security.

You must immediately notify SOTRU if you suspect that your password has been compromised or if there has been unauthorised access to your account. SOTRU shall not be liable for any loss or damage arising from your failure to keep your password secure. You are allowed to create or accept invitations to external contacts, but we do not accept any liability in this regard.

6.2 Prohibited Activities

You agree and warrant not to:

• Access or attempt to access any part of the Application by any means other than through the interface provided by us;
• Engage in any activity that interferes with, or disrupts, the Application or the servers and networks that host the Application;
• Use data mining, robots, screen scraping or similar data gathering and extraction tools on the Application;
• Copy, reproduce, republish, upload, post, transmit or distribute any information in, from or connected to the Application or its services;
• Frame or utilise framing techniques to enclose any trade mark, logo, or other proprietary information (including images, text, page layout, or form) belonging to The Companies and its affiliates without our prior written consent;
• Attempt to circumvent, disable or interfere with the security related features of the Application or features that prevent or restrict use of copying any content or enforce limitations on the use of the Application or content therein.

You agree to comply with all applicable laws, statutes, ordinances and regulations pertaining to your access to and/or use of the Application, the services, and/or use of your customer profile, or any part of these, and/or your posting of content and material (including text, files, images and photographs).

You may not yourself or through a third party:

• Use the Application for harmful, unlawful or illegal purposes, including, without limitation to:
  • Impersonate any other person or use a false or unauthorised name so as to create a false identity and/or e-mail address or to misrepresent the origin or identity of any communications;
  • Collect, harvest or otherwise obtain Personal Information (including personal information as defined in POPI and Personal Data as defined in GDPR), relating to other users;
  • Create, store and/or send unsolicited commercial communications; or conduct any fraudulent activity including any "pyramid scheme", "ponzi scheme" or "chain letter".
• Use any customer profile in a manner so as to advertise or promote your or any third party's products or services and/or impersonate another person;
• Copy (other than for backup, archival or disaster recovery purposes), reproduce, translate, adapt, vary, modify, distribute, lease, license, sub-license, encumber or in any other way deal with any portion of the Application for any reason and in any manner, unless it is consistent with the intent and purpose of these Terms;
• Decompile, disassemble or reverse engineer any portion of the Application;
• Collect service listings, descriptions or other information displayed on the Application;
• Write and/or develop any derivative of the Application or any other software program based on the Application;
• Adapt, modify or enhance the Application. In the event of a user effecting any adaptation(s), modification(s) or enhancement(s) to the Application in breach of this clause, such adaptation(s), modification(s) and enhancement(s) hereby vest exclusively in us and you hereby assign all rights in and to, and waive any and all moral rights in and to, such adaptation(s), modification(s) and enhancement(s), which assignment we accept;
• Without our prior written consent, provide, disclose, divulge or make available to or permit the use of or give access to the Application by persons other than you;
• Remove any identification, trade mark, copyright or other notices from the Application and/or any personalised item, it being specifically recorded, acknowledged and agreed that trademarks proprietary to or licensed to us will automatically be incorporated in all customer profiles;
• Establish a hyperlink, frame, metatag or similar reference, whether electronically or otherwise (collectively "linking"), to the Application or any subsidiary pages;
• Use the Application and/or any personalised item to transfer files that contain viruses, Trojans, bombs, time-locks, phishing programmes or other harmful programmes; and/or penetrate or attempt to penetrate the Application's security measures.

6.3 Data Handling

We are entitled to keep required information and essential personal information of your transactions as permitted by law in terms of the timelines permitted in law. All other information held by you on SOTRU Platform shall be destroyed upon termination of your subscription, except past verified information within your audit trail. You are further prompted to delete any sensitive personal information on your account subsequent to termination of your subscription.

By using this website, you acknowledge and agree that we reserve the right to delete any user data at our sole discretion.

SOTRU shall only transfer the Personal Data outside of a country border in the event that such action is required for the fulfilment of its rights and obligations as imposed by these terms and conditions.

SOTRU may use information gathered from third parties and other public resources as reasonably required for the provision of Services and Client shall not hold SOTRU liable for any wrongful information.

7. Security

Our company excludes its liability if the SOTRU Platform is hacked. Our company will not be liable if your information is stolen by hackers and distributed to any third parties.

We will take all reasonable precautions to keep the details of your order and business information secure, but, unless we are negligent, we cannot be held liable for any losses caused as a result of unauthorised access to information provided by you.

8. Pricing

We reserve the right to apply CPI increases to the goods. Should the price change you will be informed of the change via communication before payment is processed and offered the opportunity to cancel the order.

9. Termination

• You may cancel anytime via the platform or by contacting support before the next billing cycle.
• Upon cancellation, you retain access until the end of the paid period.
• No pro-rata refunds for mid-month cancellations unless related to defective service.

10. Software Terms

Should you purchase software, you are bound to complying with the end-user license terms of such software. You agree to familiarise yourself with such terms. Should you breach such terms, you confirm that you will indemnify and hold our company harmless against any claims for damages caused by your non-compliance of such terms.

11. Back-ups

SOTRU shall not be responsible for maintaining backups of the information you store on the SOTRU Platform. You are solely responsible for keeping copies of your data and shall not hold SOTRU liable for the loss of any confidential or personal information.

We provide an exportable audit trail of verified information shared with and by each organisational contact. It is highly recommended that you regularly store and export this data to support any compliance-related processes.

12. General

The use of our site and any contracts formed are governed by South African Law.

We reserve the right to update these terms periodically. Changes will be communicated on the SOTRU Platform over SOTRU Support as well as giving email notice of the changes. By continuing to use the platform after changes are posted, you accept the revised terms.

We shall not be responsible to you for incidental, special, indirect or consequential loss or damage, any loss of profit (direct or indirect), loss of sales, loss of goodwill or reputation, loss of business, third party claims, pure economic loss arising out of or in connection of the performance or non-performance of our obligations under these terms and conditions including such damage as may be reasonably foreseeable at the date you order the goods. Such liability is excluded irrespective of whether it arises in contract, delict, statute or otherwise.

Nothing in these terms and conditions shall exclude or restrict our liability for death or personal injury caused by our negligence directly to you.

Our liability for any claim for loss or damage shall be limited to the sum paid by you for the goods during the last month preceding your claim.

Security and Limitation of Liability. While SOTRU implements and maintains appropriate security measures and processes to safeguard businesses against fraud and unauthorised activities, it is expressly acknowledged that SOTRU does not provide any guarantee or warranty regarding the security or integrity of the information provided through the SOTRU Platform. The organisation is empowered to request and utilise verified information about other entities; however, it remains the sole responsibility of the organisation to evaluate and interpret such information and to make informed decisions based on it.

The data and verified information provided by the SOTRU Platform pertain solely to the identity of the entity in question and do not constitute a guarantee or assurance that the entity is not malicious or does not pose a risk. The organisation shall bear all responsibility for assessing the suitability and trustworthiness of any entity they choose to engage with.

Credential Issuance and Liability. In the unlikely event of a mis-issuance of a credential, whether due to error, technical failure, or other circumstances, SOTRU shall not be liable for any consequences arising from such mis-issuance. The organisation acknowledges that, while SOTRU takes reasonable measures to prevent such occurrences, absolute security and accuracy cannot be guaranteed, and the organisation agrees to accept such risks.

If any provision of these terms and conditions is found to be invalid or unenforceable by a court the invalidity or unenforceability of such provision shall not affect the other provisions of these terms and conditions.

We may assign or transfer any of our rights or sub-contract any of our obligations under these terms and conditions to any third party.

You may not assign or transfer any of your rights or sub-contract any of your obligations under these terms and conditions except with our specific permission in writing.

We reserve the right to change these terms and conditions from time to time and any such changes will be communicated on our SOTRU Platform. You will be bound by the terms on this SOTRU Platform as at the date you place an order.

There may from time to time be links on our SOTRU Platform to third party websites. We do not have any control over the content of these websites nor can we be liable in respect of anything contained on these websites.

All intellectual property rights (including use of trade marks) shall be solely owned by us. You are permitted only to use material on this SOTRU Platform as expressly authorized by us.

Any unauthorized use of material on this site is strictly prohibited.

These Terms and Conditions supersede all previous Terms and Conditions, representations, undertakings and agreements.

13. Third Party Terms, Errors and Omissions Excepted

In respect of any information provided on this SOTRU Platform or any order, errors and omissions are excepted by you. The SOTRU Platform may incorporate third-party open-source software and external services. SOTRU accepts no responsibility for outages, errors, or disputes arising from the use of such third-party providers or services. Users are advised to review the terms and conditions of each third-party provider.

In the event that a critical provider becomes unavailable or implements material changes, SOTRU will make reasonable efforts to provide prior notice and to address and rectify any issues promptly upon such notice. However, SOTRU shall not be liable for any damages, losses, or disruptions resulting from reliance on or integration of third-party services or software.

13.1 Third-Party Service Providers

14. Disclosures Required in Terms of Section 43 of the Electronic Communications and Transactions Act 25 of 2002