Last updated: February 2025
These terms govern your use of RefPassport. By creating an account or using the service, you agree to these terms. If you do not agree, please do not use RefPassport.
RefPassport is a web-based service that allows employers to issue cryptographically signed employment references anchored to their DNS domain. References can be verified by anyone without an account, using Ed25519 digital signatures and DNS TXT records. The service is provided by John Parkinson, contactable at john.parkinson@hrgo.co.uk.
To register a domain with RefPassport, you must have a valid email address at the domain you are registering and the authority to add DNS TXT records to that domain. You are responsible for keeping your signing password secure. We cannot recover your private key if you lose your password.
You may only register domains that you are authorised to represent. Registering a domain you do not control is a violation of these terms and may result in account termination.
You agree not to:
When you create a reference, it is signed with your Ed25519 private key and stored on our servers. The signature is a mathematical proof that the reference was created by someone in possession of the private key associated with your domain. RefPassport does not verify the factual accuracy of references. You are solely responsible for the content of any reference you issue.
Once a signed reference has been shared (as a PDF or verification link), the cryptographic signature remains valid independently of RefPassport. Deleting your account will remove references from our servers, but copies already shared will still contain valid signatures.
The RefPassport name, logo, website design, and underlying software are the intellectual property of RefPassport. The reference content you create remains your intellectual property. By using the service, you grant RefPassport a limited licence to store, process, and display your reference content as necessary to provide the service.
The RefPassport protocol specification (the "Standard") is published openly and may be implemented by third parties. We encourage adoption of the protocol and welcome interoperable implementations.
We process personal data in accordance with our Privacy Policy, which forms part of these terms. By using RefPassport, you acknowledge that you have read and understood the Privacy Policy.
If you issue references containing personal data about candidates (names, job titles, employment dates), you are a data controller for that data under UK GDPR. You are responsible for ensuring you have a lawful basis to process and share that information.
RefPassport is provided on an "as is" and "as available" basis. We aim to keep the service running reliably, but we do not guarantee uninterrupted access. We may perform maintenance, updates, or changes to the service at any time.
Verification of references depends on DNS infrastructure outside our control. If your domain's DNS is unavailable or your TXT record is removed, verification may return a "Silver" status (signature valid but DNS unverified) rather than "Gold".
To the fullest extent permitted by law, RefPassport shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or business opportunities, arising from your use of the service.
RefPassport does not verify the accuracy of reference content and accepts no liability for decisions made based on references issued or verified through the service. Employers and recruiters should exercise their own judgement when evaluating candidates.
Nothing in these terms excludes or limits our liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be excluded under the laws of England and Wales.
You agree to indemnify and hold harmless RefPassport from any claims, losses, or damages (including legal fees) arising from your use of the service, your breach of these terms, or any reference content you create or distribute.
You may delete your account at any time through the account settings page. We may suspend or terminate your account if we reasonably believe you have violated these terms.
On termination, your references, tenant data, and cryptographic keys will be deleted from our servers within 30 days. Copies of references already shared externally (PDFs, verification links cached by third parties) are outside our control and may continue to exist.
These terms are governed by and construed in accordance with the laws of England and Wales. Any disputes arising from these terms or your use of the service shall be subject to the exclusive jurisdiction of the courts of England and Wales.
We may update these terms from time to time. If we make significant changes, we will notify you by email or by placing a notice on the site. Continued use of the service after changes take effect constitutes acceptance of the updated terms.
For questions about these terms, contact us at john.parkinson@hrgo.co.uk.