Navoka Developer Terms

1. Parties and scope

1.1 These terms are between Wirex Holdings Limited, company number 12323130, registered office 9th Floor, 107 Cheapside, London, EC2V 6DN, United Kingdom ("Navoka", "we") and you, the person or entity accessing the Developer Platform ("you"). If you accept for an entity, you confirm you are authorized to bind it. The Developer Platform is for business use; you are not a consumer in relation to it.

1.2 "Developer Platform" means the Navoka MCP endpoint, sandbox, REST API, SDKs, webhooks, documentation and credentials we make available to developers. "Agent" means software you build or operate that calls the Developer Platform. "Holder" means the natural or legal person who holds the Navoka account your Agent acts on and who has set its Policy. "Policy" means the Holder's limits and rules, enforced at the account.

1.3 We provide software access only. Accounts, IBANs, cards, payments, exchange and trading are provided to the Holder by a separate Wirex group company (the "Provider") under the Provider's terms. You acquire no rights against the Provider and no interest in any Holder's funds.

1.4 By accessing the Developer Platform you agree to these terms, the Navoka Agent Terms as they apply to Holders you serve, and the documentation at navoka.com/developers.

2. Access and credentials

2.1 Holder authorization. Production access is granted per Holder through OAuth 2.1 with PKCE. The Holder authorizes once; your Agent receives a token scoped to the Holder's Policy and the granted scopes. There is no credential that grants more than the Policy allows, and we will not issue one.

2.2 Your responsibilities. Keep tokens, client secrets and webhook secrets confidential; store them encrypted; never log or transmit them to third parties; rotate on suspicion of compromise and tell us at security@navoka.com without delay. You are responsible for all activity under your credentials.

2.3 Sandbox. The sandbox uses synthetic rails and test Holders. It is free, carries no availability commitment, may be reset or changed without notice and must not receive real personal data or real payment credentials.

2.4 Rate limits and versioning. We may apply rate limits and quotas. We will give at least 30 days' notice before removing or materially changing a production tool or endpoint, except for security or legal reasons.

3. Rules for Agents

Your Agent must:

(a) act only on instructions from the Holder or within the Holder's Policy, and present held actions to the Holder with the returned reason_code;

(b) treat held, declined and frozen as final outcomes of a request — not retry, split amounts, change payees or otherwise attempt to bring a request under a threshold or around a hold; such attempts are logged and are grounds for suspension;

(c) send a truthful, human-readable reason on every write call that reflects the Holder's actual instruction; the reason is stored on the ledger and read by the Holder at approval and in disputes;

(d) never request, capture, store or display a full card number, CVV, PIN or full IBAN; use only the token references and masked values the tools return;

(e) never attempt to call holder-only tools (including set_policy) from an agent session, or to induce a Holder to change the Policy by deception;

(f) not act for a Holder who has disconnected or revoked access, and honor revocation immediately;

(g) comply with applicable law, including sanctions, anti-money-laundering, consumer-protection and data-protection law, and with card-scheme rules as they apply to agent-initiated transactions;

(h) not use the Developer Platform for gambling, adult content, weapons, controlled substances, unlicensed money services, market manipulation or any activity prohibited under the Provider's terms;

(i) not probe, overload, reverse-engineer or benchmark the Developer Platform for publication without our written consent.

4. Data

4.1 You receive only what the tools return: masked identifiers, amounts, status, rule, approver, reason and timestamps. You may use Holder data solely to provide your Agent to that Holder.

4.2 For personal data you process in your Agent you are an independent controller. You must have a lawful basis, a privacy notice that covers the Holder and keep the data secure. We process data on our side under the Wirex group Privacy Policy at https://www.wirexapp.com/legal/one/privacy. Neither party is the other's processor unless a separate agreement says so.

4.3 You must not combine Holder data with other datasets to profile a Holder, sell it, or use it to train models without the Holder's explicit consent.

5. Fees

Access to the Developer Platform is free. Rail and card fees are charged to the Holder by the Provider and are returned to your Agent as a quote on write calls so you can show them to the Holder before execution. We may introduce developer fees on 60 days' notice.

6. Intellectual property and marks

6.1 We own the Developer Platform. We grant you a non-exclusive, non-transferable, revocable license to use it to build and operate Agents under these terms. You own your Agent. You grant us a license to use feedback you give without obligation.

6.2 You may state that your Agent "works with Navoka" using the name in plain text or marks we supply, in line with our brand guidelines. You may not use our marks in your product name, imply endorsement, or suggest that you provide banking, payment or card services.

7. Security incidents

Notify security@navoka.com within 24 hours of becoming aware of any unauthorized access to credentials, Holder data or your Agent's control path (including prompt-injection incidents that caused an unintended request). We may suspend affected credentials while we investigate.

8. Suspension and termination

8.1 Either party may end these terms on 30 days' notice. We may suspend or end your access immediately if you breach section 3, create a security, fraud or legal risk, or if the Provider requires it.

8.2 On termination your credentials are revoked and Holder tokens issued to your Agent are invalidated. Sections 4, 6.1 (as to our ownership), 9, 10 and 11 survive.

9. Disclaimers and liability

9.1 The Developer Platform is provided "as is". We do not warrant that it will be uninterrupted, error-free or that any instruction will be executed by the Provider.

9.2 Nothing limits liability for death or personal injury caused by negligence, fraud, or anything that cannot be limited by law.

9.3 Subject to 9.2, neither party is liable for indirect or consequential loss, loss of profit, business or data. Our total liability under these terms in any 12-month period is limited to the greater of £1,000 and the developer fees you paid us in that period.

9.4 You indemnify us and the Provider against third-party claims, regulatory fines and losses arising from your Agent's breach of section 3 or 4, or from instructions your Agent sent that were not the Holder's.

10. Confidentiality

Non-public information about the Developer Platform (including unreleased tools, sandbox behavior and security measures) is confidential. Do not disclose it except to staff and contractors who need it and are bound by equivalent obligations.

11. General

11.1 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

11.2 We may change these terms on 30 days' notice by email or at navoka.com/developers; continued use after the effective date is acceptance. We may assign these terms to another Wirex group company. You may not assign without our consent. If any provision is unenforceable the rest stands. These terms and the documentation are the entire agreement for the Developer Platform.