For a firm deciding whether to route work here
Engaging Kerne as a subcontractor.
There is no company here. An engagement is a services agreement with a named co-founder, personally. An operations lead needs that before anything else, so it is the opening line here rather than a clause near the bottom of a terms page.
An established security firm has already contracted with him as an individual, with no entity anywhere in the document, and its own legal process accepted it. The rest of this page is the arrangement in full: the counterparty, what transfers if an entity is ever formed, who signs, what is committed in writing, how payment works, and the things it deliberately does not settle.
1. Who you are contracting with
Kerne has not incorporated a company, and it is not in the process of incorporating one. That is a decision, taken on 14 August 2026, rather than a step still pending. No company is registered in any jurisdiction, none is being formed, and no governing law is asserted. It is stated in full in our terms, and it is deliberately not buried: if your process requires an incorporated counterparty in a named jurisdiction, Kerne does not meet it, and you should find that out on this page rather than three calls in.
The person who answers, scopes the work and signs is Liam Lakevold, a co-founder. Write to liam@kerne.fi and he is who replies, from kerne.systems@protonmail.com, because the first address forwards and is not a sending address. The fuller version, including what is deliberately not claimed about headcount, is on who runs Kerne.
What is not one person is the money path inside the protocol. Administration is a 2-of-3 Safe on Base at 0x52d3E450bA6c299B1B07298F1E87DD74732D4877, and every signature made under it is recovered from chain on the Safe queue page.
2. A firm has already done this
Personal execution is not a workaround invented for you. Kerne's external security audit was contracted the same way, with the founder signing as an individual and no entity anywhere in the document, and the firm's own legal process accepted it. The agreement is executed and was countersigned on July 7, 2026. Fieldwork ran from July 13, 2026 and the final report published on July 31, 2026, in full and unedited, including the findings that were not flattering.
What that evidences is narrow and worth stating precisely: a sophisticated counterparty put a personal, entity-less agreement through its own legal process and signed it. It is not an endorsement, a partnership, a reference, or any statement by that firm about Kerne, and Kerne will not present it as one. The same engagement status is recorded, in the same words, in the data room.
One thing that agreement does not contain is a novation clause. It is a plain service contract. The clause in the next section is Kerne's own term, offered to you, and the two are separate.
3. What happens if an entity is ever formed
You are not stuck with a personal counterparty forever. The agreement carries a novation clause: if and when a Kerne entity is incorporated, the agreement transfers to it on the same terms, with your consent given in advance in the agreement itself. It is offered rather than waiting to be asked for, and it costs you nothing to take.
No incorporation is scheduled, and nothing on this page should be read as a representation that one is. No jurisdiction has been chosen and none is named, here or in section 14 of the terms, which stays unfilled on purpose until there is something true to put in it.
4. Who does the work
The named individual above does the work, or, where a scope suits the Whitehat Desk, an independent researcher who has consented to that specific piece of work does it and Kerne coordinates. Researchers are engaged per engagement and each one is free to pass. Kerne does not keep a bench sitting idle and will not describe one.
The supply side is published rather than asserted. Kerne records 19 distinct submitters, 12 publicly credited, and 2 who have given the separate written yes to take paid work. Consent to be credited is not consent to be advertised as available, which is why those are different numbers. How the count is kept, including the response windows Kerne has missed, is on the Desk's supply page, whose figures these are.
Kerne is not an audit firm and does not present itself as one. It has had one external audit, on its own code, and it publishes what that report found. Where a full audit is the right answer for a team, the routes and the disclosures behind them are laid out side by side on audit introductions.
There is a conflict surface here and it is ours to raise. Kerne issues its own synthetic dollar and publishes a comparative index of other issuers, so a scope can touch something Kerne has already written about in public. Where it does, we say so before accepting the work.
5. What is committed in writing
Scope and price are agreed in writing before anything starts, and the delivery clock runs from that agreement rather than from your payment. These are the published windows, in the words of the pages that carry them:
One fixed-scope report reviewing whether your public claims match your on-chain reality, across advertised versus realized yield, document and address consistency, and oracle and attestation posture, with an EIP-191 signed findings summary you may publish. Delivered within 72 hours of scope confirmation, or the fee comes back.
This is disclosure review. It does not certify your security, your solvency or your compliance, and it is not a security audit.
An independent adjudication of a findings report you already hold, up to 25 findings, delivered within 3 business days of scope confirmation.
It is an opinion on someone else's report, re-read against the chain. It is not a fresh audit of your code, and it does not clear or condemn the firm that wrote the report.
A focused adversarial pre-audit sweep, up to 12 hours of researcher time, report within 5 business days of scope confirmation. The clock starts when scope and price are agreed in writing AND a researcher has accepted the specific work, not when you pay.
A sweep, not an audit, and not a guarantee. A time-boxed best-effort review by independent researchers; a clean result is not proof the code is safe and must never be presented as one.
An extended adversarial pre-audit sweep, up to 24 hours of researcher time, report within 10 business days of scope confirmation. The clock starts when scope and price are agreed in writing AND a researcher has accepted the specific work, not when you pay.
A sweep, not an audit, and not a guarantee. A time-boxed best-effort review by independent researchers; a clean result is not proof the code is safe and must never be presented as one.
Those four are the ones a firm routing security work here is most likely to need. Every one of the 12 services a company can buy against an invoice carries the same pair, a written window and a written boundary, each quoted from the page that publishes it, and each reproduced on the invoice itself. The full catalogue with prices is at /pricing.
If a date that was ours to hold is missed, you can cancel before delivery and owe nothing, and anything already paid comes back. That, and the refund, is the whole of what is recoverable for a late deliverable: liability on an engagement is capped at the fee for that engagement, and there is no warranty that a review is complete. Those terms are published in plain language on the product pages rather than held back for a dispute.
6. How payment works
Settlement is USDC on Base. There are no bank transfers and no cards. If your finance function cannot pay from a wallet, /invoice issues a real invoice with a reference number, payment instructions, an optional purchase-order reference and the terms, and asking for one commits you to nothing.
No sales tax, VAT or GST is charged, because there is no registered entity anywhere to register for any of them and no tax identifier to quote. If your process requires a tax invoice from a registered company, Kerne cannot issue one today, and you should know that now rather than after a purchase order exists.
7. What this page does not settle
Three things a firm asks that have no published standing answer, named here rather than invented: whether Kerne can sign your paper unaltered, who owns the work product and any tooling written for the engagement, and what cover sits behind the liability cap. Each is settled in writing per engagement, before work starts, so raise them while you are scoping.
Everything else is above. The counterparty is named, the entity position is stated rather than hedged, the novation term is offered before it is asked for, and a firm has already put the same structure through its own legal process. Write to liam@kerne.fi with the scope and the paperwork your process needs.