Software License Agreement (Self-Hosting) – evidona

Draft – pending legal review. The German version is authoritative; this English version is a non-binding translation.

The licensor of the evidona software is SimplyConnect GmbH, Schulstrasse 2b, 5426 Lengnau, Switzerland (UID CHE-160.031.708), represented by Daniel Baumann (hereinafter “SimplyConnect”, “we” or “us”). General contact: office@simplyconnect.ch; data protection: datenschutz@simplyconnect.ch.

1. Parties, Subject Matter and Scope

This Software License Agreement (hereinafter “License Agreement”) governs the granting and exercise of usage rights in the evidona software in self-hosting operation, i.e. the operation of the software in what is referred to as ENTERPRISE_MODE on the Customer’s own infrastructure. Under this License Agreement, SimplyConnect acts solely as the licensor of the software and does not provide any operating or cloud service.

This License Agreement applies exclusively to self-hosting operation. It expressly does not cover the cloud offering provided via *.evidona.ch; that offering is governed by the GTC (evidona Cloud) and the Data Processing Agreement (DPA) and is not the subject of this License Agreement. In self-hosting operation, no DPA is concluded (see Section 9). By obtaining, installing or using the software, the Customer accepts this License Agreement. Any conflicting terms and conditions of the Customer shall not become part of the contract.

2. Definitions

  • Customer / Organisation: the legal or natural person who operates the software in self-hosting on its own infrastructure. With regard to the Documents and personal data processed by it, the Customer is the sole controller and sole operator (see Section 9).
  • Authorised User: a person who is assigned to the Customer’s organisation and registered by name.
  • Signer or Guest Signer: a person invited to sign; a Guest Signer has no account and accesses via a secure link.
  • Document: a file provided by the Customer for signing (typically a PDF).
  • Evidence Bundle: the sealed proof generated per signing run, with a qualified timestamp, SHA-256 integrity hash, Signer metadata and signing log.
  • signature level: the level achieved per signature of a simple (SES) or advanced (AES) electronic signature (see Section 7).
  • Software: the evidona application delivered in machine-readable form (in particular as a container image), including the scripts, configuration templates and documentation supplied with it, but excluding open-source or third-party components insofar as these are subject to their own license terms (see Section 19).

3. Grant of License

For the term of the contract, SimplyConnect grants the Customer a non-exclusive, non-transferable, non-sublicensable, revocable and time-limited right to install the software in self-hosting on the Customer’s own infrastructure and to use it for the Customer’s own internal business purposes. The license is contingent on compliance with this License Agreement, in particular on the ongoing installation of updates and security patches (Section 5) and on payment of the agreed remuneration (Section 12).

No transfer of ownership in the software takes place; only the usage right described above is granted. All rights not expressly granted remain with SimplyConnect (see Section 11).

Legal review: bindingly define the scope of the license (number of instances, authorised users, tenants) as well as the conditions for revocation or ordinary termination, and align with Section 12.

4. Permitted Use and Restrictions

The Customer shall use the software only within the scope of the granted license. The following are prohibited in particular:

  • the decompilation, disassembly or other reverse engineering of the software as well as any reconstruction of the source code, with the exception of the measures permitted under mandatory law to establish interoperability with other programs (Art. 21 CopA or Art. 6 of Directive 2009/24/EC; to that extent the restriction does not apply);
  • the resale, rental, leasing, lending, hosting for third parties or any other provision of the software to third parties for consideration or free of charge;
  • the sublicensing or transfer of the license without SimplyConnect’s prior written consent;
  • the circumvention, deactivation or manipulation of license, activation or function controls as well as of integrity or security mechanisms of the software;
  • the removal or alteration of copyright, trademark or other proprietary rights notices.

The Customer shall not use the software for unlawful, fraudulent or infringing purposes. The Acceptable Use Policy applies in addition.

Legal review: examine the scope and wording of the mandatory interoperability exception (Art. 21 CopA / Art. 6 Directive 2009/24/EC) as well as the admissibility of a contractual reverse-engineering prohibition in self-hosting.

5. Delivery and Updates

The software is delivered in machine-readable form via the container registry docker.simplyconnect.ch; handover of the source code is not owed. The Customer receives the access credentials required to obtain it.

The Customer is obliged to install updates and security patches provided by SimplyConnect without undue delay, but at the latest within the following periods:

  • ordinary updates: within 30 days of being made available;
  • security-critical updates (security patches): within 7 days of being made available.

This update obligation is a material contractual obligation of the Customer. SimplyConnect is entitled to exclude or discontinue support, warranty and any statements as to suitability, security or validity for outdated versions (versions for which the foregoing installation periods have expired).

Legal review: bindingly define the installation periods (30 days ordinary / 7 days security-critical) and the legal consequences of non-compliance (exclusion of support/warranty, revocation of the license).

6. Customer’s Sole Operating Responsibility

In self-hosting operation, the entire operation of the software rests solely with the Customer. The Customer is, in particular, solely responsible for:

  • the hosting and provision of the required infrastructure;
  • a correct and trustworthy system clock or time source (decisive for timestamps and the Evidence Bundle);
  • backup, restore and all data storage;
  • the retention, archiving and timely deletion of Documents and data;
  • security, hardening and patching (see Section 5) of the software and the surrounding systems;
  • monitoring, operation and availability (see Section 10).

Scripts, configuration templates and tools supplied with the software are provided “as is” and without warranty; the Customer examines their suitability for its environment on its own responsibility. SimplyConnect does not operate the Customer’s instance and at no time accesses the Customer’s Documents, personal data or other data in self-hosting operation.

7. Signatures, Evidence Bundle and Evidentiary Value

The software makes it possible to define signing workflows and to obtain electronic signatures; the identity of the Signer is confirmed during the signing process by means of a one-time code (OTP) delivered by email or SMS, and an Evidence Bundle is generated per signing run. In self-hosting operation, the time source, signing log and integrity sealing are determined by the Customer’s infrastructure.

SimplyConnect does not warrant or guarantee that signatures generated on the Customer’s infrastructure are legally valid, attain a particular signature level (in particular an advanced electronic signature, AES) or are admissible in court or vis-à-vis third parties. The Customer is solely responsible for this, in particular for the correct time source, the integrity of the environment and the choice of a signature level appropriate to its use case and any formal requirements. evidona does not offer a qualified electronic signature (QES) and does not warrant one.

Insofar as a signature level is technically determined, the same logic applies as in cloud operation (AES for a registered, authenticated user with an account and OTP confirmation; SES for mere email/phone confirmation of Guest Signers). The level actually achievable and provable in self-hosting is currently SES; AES is not warranted, as the framework conditions decisive for this lie outside SimplyConnect’s control.

Legal review: robustness of the signature level and evidentiary value in self-hosting under ZertES/eIDAS; include the reference to Art. 59a CO only as a review note, not as a warranty.

8. Higher Signature Level / Document Verification

A future higher level (the planned “legal document verification” or identity verification) is – insofar as it is provided at all – cloud-only or requires a connection to the evidona services operated by SimplyConnect. In pure self-hosting operation, this function may not be available. SimplyConnect does not warrant its availability in self-hosting.

Legal review: treat the future IDV/KYC processor for document verification as a placeholder (not yet selected); assess whether a Connected-Service DPA is triggered by phone-home functions (see Section 9).

9. No DPA; Customer as Sole Controller and Operator

As long as the Customer operates the software purely in self-hosting and no personal data is thereby transmitted to SimplyConnect, the Customer is the sole controller in the data-protection sense and the sole operator; in this case a Data Processing Agreement (DPA) is not concluded and is not required, as SimplyConnect does not process any of the Customer’s personal data on its behalf. The Swiss Data Protection Act (revFADP) and, to the extent applicable, the GDPR apply; compliance is the Customer’s sole responsibility.

However, as soon as a function is activated in which personal data is transmitted to SimplyConnect or to a service engaged by SimplyConnect – in particular the document verification described in Section 8 that requires a connection to evidona (“phone-home”) –, a processing relationship arises to that extent. In this case, a separate data processing agreement for the relevant connected service (Connected-Service DPA) must be concluded before activation.

Legal review: precisely define the dividing line between pure self-hosting (no DPA) and connected services (Connected-Service DPA); document the trigger, scope and processor of the transmission.

10. No SLA / No Availability Guarantee; Support

In self-hosting operation, SimplyConnect owes no service level (SLA) and no availability guarantee. The operation, availability and performance of the instance rest solely with the Customer (Section 6). Support is provided, if at all, only optionally and for a fee under a separate agreement; without such an agreement there is no entitlement to support. Support may be excluded for outdated versions (Section 5).

11. Intellectual Property

All rights in the software, the platform, the source code, the documentation and the evidona trademark remain with SimplyConnect or its licensors. The Customer receives only the usage right described in Section 3; no transfer of rights beyond that takes place. The Documents processed by the Customer and their contents remain the property of the Customer.

12. Remuneration and Term

The license fees stated in the order or in the chosen license model apply (net, plus any value-added tax). Payment processing is carried out in accordance with the order. The License Agreement begins with the provision of the means to obtain the software or with the order and runs for the agreed license term; it is extended, where agreed, by the respective term unless terminated beforehand.

Both parties may terminate for good cause, in particular in the event of a material breach of contract (notably a violation of the usage restrictions under Section 4 or of the update obligation under Section 5), in the event of payment default or insolvency. Upon termination of the License Agreement, the usage right lapses; the Customer must take the software out of operation and delete all copies. Fees already paid are not refunded upon ordinary termination; set-off against counterclaims is excluded.

Legal review: finalise the license model, prices, term, renewal and payment service provider (Mollie/Payrexx) as well as the VAT treatment before publication.

13. Exclusion of Warranty

The software is provided “as is” and “as available”. To the extent permitted by law, SimplyConnect excludes any express or implied warranty, in particular for freedom from defects, merchantable quality, fitness for a particular purpose, uninterrupted or error-free operation, as well as for the validity or evidentiary value of the signatures generated with the software (Section 7). The Customer bears the risk of the suitability and operation of the software in its environment.

14. Liability

SimplyConnect is liable solely for damage based on intent or gross negligence. Liability for slight negligence is excluded. Excluded in particular is liability for indirect and consequential damage, loss of data, lost profit, third-party claims and damage resulting from delayed performance. The limitation of liability also applies to persons and third parties whom SimplyConnect engages to render performance. Insofar as there is liability, it is limited in amount to the license fees paid in the preceding twelve (12) months. Liability for personal injury as well as further mandatory statutory liability remain unaffected. In particular, SimplyConnect is not liable for the Customer’s operation of the software (Section 6), for the validity or evidentiary value of signatures generated on the Customer’s infrastructure (Section 7), or for data loss resulting from missing or faulty backups of the Customer.

Legal review: define the liability cap (12 monthly fees vs. the previous “triple annual amount”) consistently across all documents.

15. Indemnification by the Customer

The Customer shall indemnify SimplyConnect against all third-party claims as well as fines, damages, costs and expenses (including reasonable legal defence costs) arising from the Customer’s operation of the software or from a breach of this License Agreement by the Customer, in particular in connection with:

  • the hosting, operation, monitoring and availability of the instance;
  • the security, hardening and timely patching (Section 5);
  • backup, restore, data storage as well as retention and deletion;
  • the validity and evidentiary value of signatures generated on the Customer’s infrastructure (Section 7);
  • data-protection violations for which the Customer is answerable as the sole controller (Section 9).

16. Confidentiality

The parties shall treat non-public information of the other party confidentially; the obligation continues beyond the end of the contract. The software, its structure and the associated access credentials are deemed confidential information of SimplyConnect. Disclosure is permitted to engaged third parties under an equivalent confidentiality obligation and to the extent required by law.

17. Assignment, No Partnership, Severability Clause, Amendments

The Customer may neither assign nor transfer this License Agreement or the granted license without SimplyConnect’s prior written consent; SimplyConnect may engage third parties. The parties do not establish a simple partnership (Art. 530 CO). Should a provision be invalid, the remaining provisions remain unaffected; the invalid provision is to be replaced by a valid one that is as economically equivalent as possible. SimplyConnect may amend this License Agreement with reasonable advance notice; material amendments will be communicated. Force majeure releases from the obligation to perform for its duration.

18. Applicable Law and Place of Jurisdiction

Swiss law applies exclusively, to the exclusion of conflict-of-laws rules and the Vienna Sales Convention (CISG). The exclusive place of jurisdiction is the registered seat of SimplyConnect (Lengnau AG; competent District Court of Baden/Zurzach AG), unless mandatory law provides otherwise.

Legal review: verify the exact designation of the competent court.

19. Open-Source / Third-Party License Notices; Imprint and Status

The software may contain open-source and third-party components that are subject to their own license terms; for the components concerned, these prevail over this License Agreement. An overview of the components used and their licenses is provided with the software or on request.

Licensor: SimplyConnect GmbH, Schulstrasse 2b, 5426 Lengnau, Switzerland (UID CHE-160.031.708), represented by Daniel Baumann. Contact: office@simplyconnect.ch; data protection: datenschutz@simplyconnect.ch.

The German version is authoritative; the English version is a non-binding translation. French and Italian versions will follow. Status: see the version information at the bottom of the page.

Legal review: define the complete open-source / third-party license list (SBOM) and its delivery method before publication.

← Back to home