Terms

Terms of service

Last updated: 08/07/2026

These Terms of Use govern the use of the LOCUS service (locus.acquisizioniforensi.com) and of the LOCUS mobile app. Access to the service implies full acceptance of these terms.

1. Parties

Provider: Giovanni Carrieri, Via Camillo Rosalba 49, 70124 Bari (BA), Italy, VAT IT07669810728, taxpayer under the Italian flat-rate regime (Law 190/2014, art. 1, paragraphs 54-89), certified e-mail (PEC) acquisizioniforensi@pec.it, e-mail locus@acquisizioniforensi.com.

User: adult natural person (≥ 18 years old) acting for professional or business purposes who registers for the service (court-appointed experts, party experts, law enforcement, security managers, law firms, IT security operators and similar).

2. Definitions

  • Service: the LOCUS mobile app, the locus.acquisizioniforensi.com website, the certification backend endpoints (/app-locus/) and the User's reserved area.
  • Account: User's personal profile created at registration, identified by a unique e-mail address and protected by password.
  • Acquisition: capture of a photo or video via the LOCUS app, including the entire cryptographic sealing pipeline (NTP sync, watermark, EXIF read, MD5/SHA-256/SHA-512 hashing, RFC 3161 timestamp, Ed25519 signature, CASE/UCO sidecar, BagIt RFC 8493 archive).
  • Bundle: BagIt archive produced by the app at the close of each acquisition, containing the original media, the watermarked media, the signed manifest, the PDF report, the sidecars and the timestamp.
  • Slot: prepaid credit unit required to perform an acquisition (see § 5).
  • Validator: standalone desktop application (Win/Mac/Linux) that allows offline verification of a bundle received from third parties, without upload and without need of an account.
  • Privacy policy: separate document available at /legal/privacy, which integrates these Terms.

3. Registration and eligibility

Registration is reserved for adults engaged in professional or business activity. To register, the User must provide accurate personal data, a valid e-mail address and accept these Terms and the Privacy policy. Only one account per User is permitted. The Provider reserves the right to suspend or cancel accounts created with false or duplicate data.

The User is responsible for safeguarding their access credentials and for any operation performed from their account. In case of suspected unauthorised access, the User must immediately change the password and notify the Provider.

4. Subject of the Service

The LOCUS Service includes:

  1. Forensic acquisition of photos from the User's mobile device, with end-to-end cryptographic sealing according to ISO 27037:2012, SWGDE 18-F-002/23-I-001, RFC 3161 (timestamp), RFC 8493 (BagIt), LOCUS-PROV provenance inspired by C2PA (not standard C2PA) and CASE/UCO 1.3 (interoperability) standards.
  2. Forensic acquisition of videos with native overlay (timestamp, GPS, UUID, heading, NTP-offset) burned in at the moment of recording.
  3. RFC 3161 timestamp applied to every bundle, generated by enterprise-grade Time Stamping Authorities (Sectigo, DigiCert, GlobalSign in fallback cascade).
  4. eIDAS-qualified timestamp by InfoCert, optional on request, applied alongside the standard seal (+2 slots per acquisition).
  5. Acquisition record (metadata, hashes, timestamp, signature and histogram image — not the actual evidence content, which stays in the bundle held by the User) stored on Provider servers (EU) and public permalink verification via the URL /verify/<short_code>.
  6. Standalone desktop Validator, freely downloadable, for offline bundle verification by anyone (opposing party consultant, prosecutor, judge).

5. Fees and payment

Access to the Service is by purchase of prepaid slot packs (pricing at /pricing). Per module:

  • LOCUS photo: 1 slot (+ 2 optional slots for qualified InfoCert)
  • LOCUS video: 2 slots (+ 2 optional slots for qualified InfoCert)

Payment is processed exclusively through Stripe Payments Europe Ltd. by credit card or SEPA transfer. Card data does not transit LOCUS servers. Upon payment confirmation, slots are credited instantly to the User's account.

Operation performed by an Italian flat-rate taxpayer pursuant to art. 1, paragraphs 54-89, of Law 190/2014; not subject to Italian VAT. A PDF receipt of the purchase is sent by e-mail to the User within a few minutes of payment. Remaining slots do not expire and are not refundable in cash (except in cases of malfunction attributable to the Provider, see § 9).

The User's slot pool is shared with the CERTO service (acquisizioniforensi.it): purchased slots may be consumed indifferently on the two services.

6. User rights and obligations

The User undertakes to:

  • use the Service in compliance with applicable law (Italian and of the country of residence), with morality and with third-party rights (confidentiality, image rights, intellectual property);
  • acquire only material for which they have the legitimate right to do so (e.g. consent to portrait of people filmed, owner authorisation for private scenes, client mandate for professional activities);
  • not use the Service for illicit purposes, unauthorised surveillance, stalking, defamation or violation of others' privacy;
  • diligently safeguard access credentials (e-mail and password);
  • not attempt to alter, decompile or reverse-engineer the app or the server-side software beyond the limits permitted by law;
  • not reproduce or redistribute LOCUS or Validator software except for the verification purposes allowed by these Terms;
  • before acquisition, verify device battery, available storage, permissions (camera, microphone, GPS) and the connectivity required for upload.

7. Provider obligations

The Provider undertakes to:

  • keep the app and backend infrastructure available within the normal uptime limits of a cloud service (target ≥ 99% monthly, with possible maintenance windows announced in advance where possible);
  • store the User's acquisition record (metadata, histogram, report) for the duration of the contractual relationship and provide consultation and public verification mechanisms; the full BagIt bundle with the media is generated on the device and remains in the User's possession;
  • apply the security measures described in the Privacy policy (in-transit encryption, Argon2ID hashed passwords, HttpOnly/Secure sessions, rate-limit, anti-brute-force);
  • ensure the Service's technical conformity with the declared standards (RFC 3161, RFC 8493, ISO 27037, SWGDE 18-F-002/17-V-002, CASE/UCO 1.3, provenance LOCUS-PROV);
  • make the desktop Validator available for offline independent verification by third parties.

8. Retention and deletion

The acquisition record (metadata, hashes, timestamp, signature, histogram and PDF report) remains available in the User's reserved area as long as the account is active. The actual evidence content and the full BagIt bundle are not stored by the Provider: they are generated on the device at each acquisition and remain in the User's possession, who must keep them safe. In case of account closure (at the User's request or for violation of these Terms), the User has 30 days from notification to export their data (reports and metadata) before final deletion. After this period, data will be deleted with no possibility of recovery. Remaining slots are not refunded.

Upon documented request (e.g. judicial need with order of the Authority) prolonged retention beyond standard terms may be agreed with the Provider.

9. Disclaimer and limitation of liability

The Provider warrants the Service's technical conformity with the declared international standards but, within the limits permitted by applicable law, does not warrant:

  • the courtroom admissibility of any individual bundle, which depends on the judge's evaluation in the specific case, on the operator's compliance with chain-of-custody procedures, on the qualification of the person performing the acquisition and on the applicable procedural law;
  • the lawfulness of the User's use of the Service: responsibility for the content acquired and for the purposes of the acquisition remains solely with the User;
  • continuity of the Service in case of force majeure, unforeseeable events, legislative acts, cyber attacks, third-party provider interruptions (Hostinger, Stripe, InfoCert, TSA), telecom network failures, malfunctions of the User's device or exhaustion of its hardware resources (battery, memory, GPS, etc.).

The Service is provided "as is" and "as available". The Provider's total liability for any claim arising from the use of the Service is limited, where the law allows, to the amount actually paid by the User for slots not yet consumed at the time of the triggering event.

10. Intellectual property

Bundles produced through the Service are the exclusive property of the User, who holds all rights of use and disposal.

The following remain the exclusive property of the Provider: the LOCUS software (mobile app, desktop validator, server-side code), the "LOCUS" trademark, the logo and its graphic elements, the documentation, the website and any editorial content published thereon. Use of the Provider's trademark or materials for purposes other than normal use of the Service requires written authorisation.

11. Personal data protection

Processing of the User's personal data is carried out in accordance with the privacy notice, which forms an integral part of these Terms. The User, acting as Owner of any data contained in the bundles (e.g. images of third parties), undertakes to comply with the applicable data-protection regulations.

12. Changes to the Terms

The Provider reserves the right to modify these Terms at any time, giving prior notice by e-mail to the address registered on the account or by notice published on the site. Changes take effect 15 days after notification. In case of substantially adverse changes, the User has the right to withdraw from the contract within 30 days without penalty, receiving a refund of unconsumed slots.

13. Withdrawal and termination

The User may withdraw at any time by requesting account deletion via e-mail to locus@acquisizioniforensi.com. Remaining slots are not refunded, except in the cases referred to in § 12. The Provider may terminate the contract for just cause in case of serious violation of these Terms by the User (in particular § 6), with written notice via e-mail.

14. Governing law and jurisdiction

These Terms are governed by Italian law. For any dispute relating to the interpretation, performance or termination of the contract, the Court of Bari shall have exclusive jurisdiction, except for cases of mandatory jurisdiction in favour of consumers provided for by the law applicable to consumers resident in another State of the European Union.

Last revised: 2026-07-08