TrustNet
Print / Save PDF
Legal · Draft

Operator Terms

The terms an organization accepts when it registers a relying party and uses TrustNet as its identity provider.

Document: TrustNet-Operator-Terms-v0.2 Version: 0.2 Updated: 2026-10-21 Status: Draft — counsel review pending Audience: RP operators
Print / Save PDF Back to homepage

1Parties

These Operator Terms are between SMILE SERVICES SRL (TrustNet), Bdul. Decebal 84, Piatra Neamț, Neamț, Romania, and the organization that accepts them when registering an RP.

2Definitions

  • RP — the relying party (your application) that signs users in through TrustNet.
  • Tenant — the grouping entity that owns one or more RPs in the portal.
  • Claim — a named identity attribute the RP declares it needs.
  • PPID — the pairwise, pseudonymous subject identifier an RP receives.
  • DPA — the data processing agreement that applies to any personal data TrustNet processes on your behalf.

3Registration and credentials

  • You must be authorized to bind the organization and provide accurate registration data.
  • You must verify ownership of every production redirect host.
  • You are responsible for keeping the client secret and any portal credentials confidential.
  • Tell us immediately if a credential is compromised.

4Claims and purposes

  • Declare only the claims you actually need, each with a specific and lawful reason.
  • Have a lawful basis for the processing you carry out after disclosure.
  • Do not request special-category data without an Art. 9 GDPR condition and prior written agreement with TrustNet.
  • Do not use claims for unlawful discrimination, hidden tracking or re-identification.

5Your obligations

  • Publish your own privacy notice and honor consent and withdrawal.
  • Retain disclosed data only as long as your lawful purpose requires.
  • Handle the signed purge webhook and stop using a revoked subject identifier.
  • Keep your systems and credentials secure and notify us of a relevant incident without undue delay.
  • Do not attempt to correlate PPIDs across sectors or RPs.

6Our obligations

  • Provide the OIDC, consent and audit functionality described in the documentation.
  • Disclose only the claims the user approves.
  • Keep the consent/audit trail and make the agreed exports available.
  • Apply the security measures described in the DPA and Trust Center.
  • Not sell personal data or use it for advertising.

7Data protection

The parties are independent controllers for the data each decides on. Where TrustNet processes personal data on your behalf, we will enter into a Data Processing Agreement (DPA) before that processing begins. The current processors and transfer position are on the Subprocessors page.

8Fees, service levels and support

During the MVP the service is provided free of charge and without a service-level commitment. Support is by email at privacy@trustnet.app. A service-level commitment applies only if a signed order or SLA says so.

9Audit and verification

You may use the audit exports to verify disclosures to your RP. We may audit compliance with these terms and suspend an RP that creates a security, legal or abuse risk.

10Suspension and termination

Either party may terminate as agreed in the order. We may suspend immediately for a security incident, unlawful use, or a material breach. On termination, the RP is disabled and the relevant data is purged as described in the DPA and Privacy Policy.

11Liability

To the extent permitted by law, neither party is liable for indirect or consequential loss, loss of profit or loss of data. Nothing in these terms limits liability that cannot be limited by law.

12Intellectual property and brand

TrustNet and its marks remain ours. You may display the “Sign in with TrustNet” button and the TrustNet name factually to describe the integration. You grant us a limited licence to display the RP name and logo you upload for the consent and access-proof screens.

13Confidentiality

Each party protects the other's confidential information with reasonable care and uses it only to perform these terms, except where disclosure is required by law.

14Governing law and disputes

These terms are governed by Romanian law. The courts of Bucharest have jurisdiction, unless a mandatory rule says otherwise. The EU Online Dispute Resolution platform was shut down in July 2025.

15Changes and acceptance

We publish a new version with a date and version number. A material change requires the RP owner to accept the new version before the next registration or renewal. The acceptance record names the version.

16Contact

SMILE SERVICES SRL, Bdul. Decebal 84, Piatra Neamț, Neamț, Romania.
Privacy, legal and DPA: privacy@trustnet.app