Evidence and disputes

What counts as evidence

• Anis’s sealed records are evidence of the content and time of the requests and answers they record.
• A signed answer you kept, together with the signed request that produced it, is evidence of what Anis answered. It must pass every check in Verifying answers. Where it conflicts with Anis’s records about what Anis answered, your signed answer prevails.
• Anis’s records prevail for what you requested and for wallet entries.
• An unsigned answer is not evidence of an order’s outcome. Never base a financial decision on one.

What Anis keeps and how it is sealed

For every admitted order, reveal and self-service stop, Anis keeps your request exactly as verified: its signature, the signed content, the public key used, the network address it came from and, for orders, the exact order body. For every answer, Anis keeps its status, code, a SHA-256 fingerprint of its body and Anis’s signature, and it keeps the order’s final outcome. Card codes are never kept in these records. A self-service stop is never delayed or refused because its record cannot be written; in that rare case Anis relies on its account records for the time of the stop.

At least every five minutes Anis seals all new records: it computes a fingerprint over them, links it to the previous seal, and obtains an RFC 3161 time stamp from an independent time-stamp authority (DigiCert, with Sectigo as fallback). A seal proves the sealed records existed, unchanged, no later than its time stamp. The records are held in a ledger database that keeps a permanent history of every change, and are kept for at least seven years. In a dispute, Anis provides the relevant records, seal data and time-stamp tokens so that you, or an expert you appoint, can check them with standard tools such as OpenSSL.

Your key and your orders

Every signed request Anis admits with your key before the key or application is stopped is your instruction, whoever sent it. Anis is responsible for anything admitted after the stop, for anything admitted without a valid signature by your key, and for any charge above a spending cap that was in force at the time. If you suspect a compromise, use self-service stop at once: the stop time is the time in Anis’s signed answer confirming it.

Raising a dispute

Raise a dispute within 90 days of the event by writing to support@anis.ly. Give the operation id, invoice number and request ids, and attach the signed answers you rely on. Never send private keys or card codes. Anis checks its own signature and key state, your request signature, and its operation, invoice, sold-card and wallet records, and replies in writing within 10 business days of receiving a complete claim.

When Anis corrects the ledger

Anis refunds or credits the wallet charged, within 5 business days of its reply, when its records or a signed answer you kept show:

• a charge for an order reported failed or refused;
• a charge above a completed order’s total;
• fewer cards delivered than listed, or a code that is invalid at delivery;
• an order or reveal admitted after the stop time, or without a valid signature by your key;
• a charge above a spending cap in force at the time.

An answer that reports an order as processing or recovery exhausted is not an error: resume the order.

Statements after a key is revoked

After any key revocation, by you or by Anis, and on your reasonable request, Anis sends your technical contact a statement covering up to the previous 90 days within 5 business days. It lists every order, reveal, amount, card id (never codes), invoice and wallet movement, with the key used, and each file carries an independent time stamp. You have 30 days to object to specific lines; lines not objected to are final.

Signing-key compromise and retirement

Anis announces a compromise of its signing key within 24 hours by email and through revoked[] in the signing-key document. The entry identifies the key by kid and gives compromisedAt. An answer signed with an Anis key is not accepted as evidence if it was signed before that key’s notBefore, after its retiredAt, or by a key in revoked[], unless it matches the fingerprint and signature in Anis’s records. The signed answer’s created time is used for this comparison. Retired public keys remain listed for 90 days after retiredAt; compromised keys are excluded from keys[] and listed in revoked[] for 90 days after compromisedAt. Anis bears your direct loss from acting on an answer forged with its compromised key that you received before its notice and before the key appeared in revoked[]. Anis never re-signs past answers with a new key.

What you must keep and do

• Keep every signed answer for orders, order reads, reveals and self-service stops exactly as received, with the signed request that produced it, for at least 90 days.
• Verify every signed answer before acting on it, following Verifying answers; unsigned information answers are protected by TLS.
• Protect your private key, use self-service stop when you suspect a compromise, and report it to support@anis.ly at once. If you no longer hold the private key, contact support immediately: Anis acts on a stop request within 2 hours, at any time.