A8 Core™ API Terms

These A8 Core™ API Terms (the “Terms“) are entered into between Financial Infrastructure, Inc. d/b/a A8 Core™ (“A8 Core™,” “we,” “us”) and the company or individual accepting them (“you,” “Developer,” or “Customer“), and govern access to and use of the A8 Core™ application programming interfaces, sandbox and production environments, developer credentials, documentation, SDKs, webhooks, and related services (collectively, the “API“), which form part of the A8 Core™ (the “A8 Core™ Platform“).

By requesting credentials, accessing, or using the API, you agree to these Terms. If you accept on behalf of an entity, you represent that you are authorized to bind it. A signed order form or written agreement, if any, controls over these Terms, which control over the documentation.

1. Definitions. “Credentials” means the keys, tokens, and secrets A8 Core™ issues to authenticate access. “Sandbox” means the non-production test environment using simulated data. “Production” means the live environment operating on real accounts and funds. “End User” means a person or entity for whom you open or service an account. “End User Data” means data relating to End Users that you submit to or receive through the API. “Account” means a financial account opened, funded, serviced, or recorded through the API, including demand-deposit, retirement, taxable, trust, custodial, and private-fund types.
2. License grant and scope. Subject to these Terms, A8 Core™ grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access the API solely to develop, test, and operate your own application that integrates with the A8 Core™ Platform (your “Application“). Sandbox access is for development and evaluation only and must not be used with real End User Data or live funds. Production access requires A8 Core™’s prior written approval following the review in Section 5. All rights not expressly granted are reserved.
3. Credentials and security. You are responsible for all activity under your Credentials. Keep secrets confidential and do not embed production secrets in client-side code, public repositories, or mobile binaries. You will maintain safeguards appropriate to the sensitivity of financial data, including encryption in transit and at rest, access controls, and audit logging. Notify api@a8core.com promptly, and no later than seventy-two (72) hours, after discovering any actual or suspected compromise. A8 Core™ may rotate or revoke Credentials at any time to protect the Platform or End Users.
4. Acceptable use and restrictions. You will not, and will not permit any third party to: (a) exceed published rate limits or circumvent authentication, throttling, or security mechanisms; (b) resell, rent, sublicense, or provide the API as a standalone service that competes with or replicates the A8 Core™ Platform; (c) reverse engineer or attempt to derive non-public aspects of the API, except where this restriction is prohibited by law; (d) scrape or bulk-extract data outside documented endpoints, or use A8 Core™ data to train machine-learning models without A8 Core™’s prior written consent; (e) use the API in violation of any law, including securities, banking, money-transmission, consumer-financial-protection, sanctions (OFAC), anti-money-laundering (BSA/AML), and privacy laws; (f) introduce malware or interfere with the integrity, security, or performance of the API; (g) use the API for any business or activity identified in A8 Core™’s Prohibited & Restricted Businesses policy; or (h) misrepresent your identity, your Application, or your authority to act for an End User.
5. Customer obligations and regulatory compliance. You are solely responsible for your own legal and regulatory status and your relationship with your End Users, including any licensing, registration, disclosures, and consents your Application requires. You will perform all customer-identification, eligibility, suitability, and anti-money-laundering obligations applicable to you, and provide accurate End User information to the API; A8 Core™’s provision of account infrastructure does not transfer those obligations to A8 Core™. You will obtain and maintain all consents required to submit End User Data to, and instruct account activity through, the API. Before granting Production access, A8 Core™ may review your Application, intended use, compliance posture, and security controls, and may condition, limit, or decline access in its reasonable discretion.
6. Data, privacy, and confidentiality. As between the parties, you retain ownership of your Application and your End User Data; A8 Core™ retains ownership of the A8 Core™ Platform, the API, and A8 Core™-generated, aggregated, and de-identified data. Each party will comply with applicable data-protection laws, and where A8 Core™ processes End User Data on your behalf the parties will execute a Data Processing Addendum governing that processing. Each party will protect the other’s non-public information with at least reasonable care, use it only to perform under these Terms, and not disclose it except to personnel and advisors bound by confidentiality; Credentials, non-public documentation, and pricing are A8 Core™ Confidential Information. A8 Core™ may use usage metrics and de-identified, aggregated data to operate, secure, and improve the Platform.
7. Fees. Fees, if any, for Production access, volume tiers, and premium features will be set out in an order form. Unless an order states otherwise, Sandbox access is provided at no charge and may be modified or discontinued. Fees exclude taxes, which are your responsibility other than taxes on A8 Core™’s net income.
8. Availability, changes, and deprecation. A8 Core™ may modify, enhance, or discontinue features of the API. For backward-incompatible changes to generally available Production endpoints, A8 Core™ will use commercially reasonable efforts to give at least ninety (90) days’ notice and a documented migration path, except for changes required for security, legal, or regulatory reasons. Any availability commitment applies only to Production and only as expressly stated in an order or published service-level terms; Sandbox is provided “as available.” A8 Core™ may suspend access immediately where it reasonably believes there is a security risk, unlawful use, a violation of Section 4, or a risk to End Users or the Platform, and will restore access promptly once resolved.
9. Intellectual property. The A8 Core™ Platform, API, documentation, and the marks A8 Core™ and A8 Core™, and all related intellectual property, are and remain the exclusive property of A8 Core™ and its licensors; related intellectual property remains solely with Todd Yancey. Except for the limited license in Section 2, no ownership is transferred. If you provide suggestions or feedback, you grant A8 Core™ a perpetual, irrevocable, royalty-free license to use it without restriction.
10. Warranties and disclaimer. Each party represents it has authority to enter into these Terms. Except as expressly stated in a signed order, the API is provided “as is” and “as available.” To the maximum extent permitted by law, A8 Core™ disclaims all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement, and does not warrant that the API will be uninterrupted, error-free, or secure. A8 Core™ is not your broker-dealer, bank, investment adviser, or fiduciary, and provides technology infrastructure only.
11. Indemnification. You will defend, indemnify, and hold harmless A8 Core™ and its affiliates, officers, and personnel from any third-party claim, and related losses, arising out of (a) your Application; (b) your or your End Users’ use of the API; (c) your violation of these Terms, applicable law, or the rights of a third party; or (d) your handling of End User Data.
12. Limitation of liability. Neither party is liable for indirect, incidental, special, consequential, or exemplary damages, or for lost profits, revenue, or data, even if advised of the possibility. Except for your indemnification obligations, your breach of Section 4, or a party’s breach of confidentiality, each party’s total aggregate liability arising out of or related to these Terms will not exceed the greater of (a) the fees you paid A8 Core™ in the twelve (12) months preceding the event, or (b) one thousand U.S. dollars (US$1,000). [Liability cap to be confirmed by counsel.]
13. Term, termination, and effect. These Terms apply from your first access until terminated. Either party may terminate for convenience on thirty (30) days’ notice; A8 Core™ may terminate or suspend immediately for your material breach (including any breach of Section 4), security risk, or as required by law. On termination, your license ends, you must cease using the API and securely delete Credentials and A8 Core™ Confidential Information, and provisions that by nature should survive (including Sections 4, 6, 9–12, and 14) survive.
14. General. These Terms are governed by the laws of the State of California without regard to conflict-of-laws rules, and the state and federal courts located in San Mateo County, California have exclusive jurisdiction, to which the parties consent. You may not assign these Terms without A8 Core™’s prior written consent; A8 Core™ may assign to an affiliate or in connection with a merger or sale of assets. A8 Core™ may update these Terms, with reasonable advance notice of material changes to Production terms, and continued use after the effective date constitutes acceptance. Neither party is liable for failures caused by events beyond its reasonable control. Legal notices to A8 Core™: legal@a8core.com and PO Box 1410, Menlo Park, California 94026-1410; operational notices: api@a8core.com. These Terms, with any order and incorporated documents, are the entire agreement on this subject and supersede prior understandings; if any provision is unenforceable the remainder stays in effect; no waiver is effective unless in writing; and the parties are independent contractors.