2

I am developing a website for secure sharing credentials. Similar to https://www.cloak.sh/ .

How can I protect myself and hopefully eliminate all my liability, while still providing a service "without warranty"?

No user data would be sold or anything like that. A truly free service as long as the costs are low. I would put all best efforts into make the most secure solution, etc. However, I can't discount the possibility of there being a bug, or getting hacked, or something that otherwise compromises the data users have uploaded.

My concern is I could see a scenario where an employee unbeknownst to their company shares sensitive information using my website. My website is then compromised, or the company find out some other way, and attempts to go after me for damages or something.

Basically, I want to run this website and provide this service as a free best-effort offering, without the possibility of it affecting my life negatively. Is this even possible? Is this a reasonable concern?

My only steps so far have been to register an LLC and all work would be done under the LLC to shield my personal life from any issues.

Improve this question
6
  • 1
    Who in their right mind uses a random third party website to share credentials of all things?!?! Thats probably the most insane thing Ive seen in a long time (aside from US politics). The example website isnt even zero knowledge! They dont profess to encrypt your information either - just vaguely promise not to look at it. Utterly insane. – Moo Apr 26 '20 at 5:56
  • Your main issues here are technical and architectural, not legal - no one should be doing this, so there shouldnt be any questions about protecting ones self from legal liability. Its trivial to make a zero knowledge app which has end to end encryption and job done. PGP over email would be significantly better than this and removes all liability instantly. – Moo Apr 26 '20 at 5:58
  • 1
    @Moo Never heard of password managers? They're always written by someone (whether web or native), and the users have to either trust the authors or do not use them. I (and perhaps you too) do the latter but lots of users do the former. – Greendrake Apr 26 '20 at 6:03
  • @Moo Even making a "zero knowledge app" would open you up to liability. Suppose the client code has an issue which causes a breach, etc? End-to-end causes some other issues with the features of the service as well. For example, burn-after-reading is impossible to do if the server doesn't know the decryption was successful or not. There are other ways to compensate for the encryption happening on the server. I appreciate your input though, and agree it is a unique set of requirements. You're not completely wrong either, hence why I'm wanting to limit liability. – Caesar Kabalan Apr 26 '20 at 6:34
  • @Greendrake funnily enough, yes I have, and funnily enough, if the OP had used a credible one as the example of the type of thing they want to do, my response would have been very different. However, they didnt. They pointed to a website which should in all honesty should be held up as the thing not to do, which leads me to feel extremely safe in making the assumptions which led to the previous comments. And I stand by them - any company that uses such a website to share credentials should be referring themselves to their countries data protection regulator automatically. – Moo Apr 26 '20 at 6:51
-1

How can I protect myself and hopefully eliminate all my liability, while still providing a service "without warranty"?

Is this even possible?

In most jurisdictions it is — provided that you write your Terms of Service wisely and specifically for every jurisdiction where you plan to offer it. Do not be surprised if in some jurisdictions it may not be quite possible.

If you are not sure you can write such terms yourself your only recourse is to hire lawyer(s) to do it for you.

Improve this answer
9
  • Silent downvote is worse than silent fart. If something is wrong with the answer, the community should know. Even knowing that there is no good reason is better than not knowing the reason at all. – Greendrake Apr 26 '20 at 5:27
  • Not the downvoter, but in many jurisdictions there are laws requiring a certain amount of protection at least for certain kinds of data. For example in the EU if the site is designed to store healthcare information and it is found that a leak happened because the OP did not take proper measures to prevent it, it could easily be sued and fined. – SJuan76 Apr 26 '20 at 8:26
  • The EU is going to have something to say about any attempt to eliminate liability from GDPR violations... – Moo Apr 26 '20 at 20:11
  • @Moo and the NK would probably execute the OP... – Greendrake Apr 26 '20 at 21:02
  • @Greendrake you are stating that a well worded contract can eliminate all liability- this is just wrong. Many laws (e.g. consumer protection, data protection, privacy etc.) are explicitly not excludable by contract. Often, an attempt to do so amounts to deceptive and misleading conduct which is often an offence -see ACCC v Valve (No 3). – Dale M♦ Apr 26 '20 at 22:25
2

Insurance and diligence

While a well-written Terms of Service can mitigate your exposure, you cannot totally eliminate it because:

  1. There are legal obligations that cannot be excluded by contract. For example, if your supply is covered by Australian Consumer Law (provided in Australia at a price less than AUD40,000 - free is less than AUD40,000) then you are liable for compensation for damage or loss and you are bound by non-excludable warranties.
  2. Your contract cannot protect you against claims by third-parties. If your product causes harm to someone other than the person who agreed to your Terms of Service you might be liable and since they never agreed to your terms they are not bound by them.
  3. Privacy law is usually non-excludable and varies enormously by jurisdiction.
  4. You can always be sued. You might have no liability at all but going to court and proving that is expensive.

So, do your best and insure the rest.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.