Terms for Kantega Lommebok

About the wallet solution

Kantega Lommebok is a digital wallet where you can receive, store and share digital credentials. It is built according to the EU's Architecture and Reference Framework for digital wallets (ARF) and the standards it refers to: OpenID4VCI 1.0 for issuance, OpenID4VP 1.0 for presentation, and the OpenID4VC High Assurance Interoperability Profile (HAIP) 1.0.

The purpose of the wallet is learning. We want to give you a good tool for testing against the Norwegian Digitalisation Agency's sandbox for digital credentials, or for building a proof of concept, and to learn more ourselves about how digital credentials work in practice.

Important: Kantega Lommebok is not a production service and not a certified EUDI wallet. The credentials in it are not valid identification.

Who provides the solution

The wallet provider is Kantega AS, organisation number 985 815 534, Bassengbakken 4, 7042 Trondheim, Norway.

Send questions about the wallet solution or these terms to post@kantega.no. You can also call us on +47 73 80 68 00.

For testing and the sandbox only

Although the wallet follows the ARF and current security standards, it is a testing and learning tool. This means:

• Do not use real or sensitive data. Use test data, and do not add credentials that are valid in real life.
• The solution may be changed, reset or shut down without notice, and content may be deleted.
• We promise no uptime, and we offer no support with response times.
• The issuers and relying parties you meet in the wallet are usually test environments run by others. They process what you send them under their own terms.

Access

The apps can be downloaded from the App Store and Google Play.

We may refuse or close access for anyone, for example in case of misuse or when a test programme has ended. The solution is free of charge.

What you are responsible for

When you use the wallet, you must:

• keep your device to yourself;
• only share credentials with recipients you have reason to trust, and read what they ask for before you share;
• not try to circumvent the security of the solution, or use it to make others believe a test credential is real;
• tell us at post@kantega.no if you find a security flaw.

What Kantega vouches for as wallet provider

When the wallet fetches a credential from an issuer, it may attach attestations signed by Kantega:

• The wallet attestation (Wallet Instance Attestation) states that the wallet is an instance of Kantega's wallet solution. It contains no identifier that tells your wallet apart from others, and it lives for less than a day.
• The key attestation states which keys the credential is to be bound to, and that the keys were created by the wallet.
• Both are signed with a key used for nothing else, and its certificate chains to a CA that only issues certificates for Kantega as wallet provider.

We claim no security level for the keys. The key attestation says nothing about storage level or user authentication, and an issuer that requires it will not accept it.

Kantega is not certified as a wallet provider under the eIDAS Regulation.

Withdrawal

Kantega may stop issuing attestations for a single wallet or for the whole solution, for example if a key is compromised or the solution is misused.

Because the attestations are short-lived, they stop working on their own shortly after we stop. A status list for the attestations is in progress, and once it is in place we can also revoke attestations that have not yet expired.

Personal data

The apps store your credentials and their keys locally on your device. You can delete credentials yourself in the app.

How we process personal data is described in our privacy policy and in the privacy policy for the Kantega Lommebok app.

Liability

The wallet is provided as is, without warranties. It may contain errors and defects, and to the extent mandatory law allows, Kantega accepts no liability for errors or defects in the solution, or for any loss resulting from your use of it, from it not working, or from content being lost.

Nor is Kantega liable for what issuers and relying parties do with information you share with them.

Feedback and collaboration

We would love to hear from you. If you find a bug, miss something, or have ideas for how the wallet can get better, email us at post@kantega.no.

We are also happy to collaborate with others testing digital credentials in the sandbox, whether you are building an issuer service, a relying party or a proof of concept. Get in touch and we will figure it out together.

Changes to these terms

We may change these terms. The current version is always on this page, dated at the top.

If a change is material, we will tell you in the wallet before it applies, where possible.

Governing law

These terms are governed by Norwegian law.