API and sandbox terms

1. Sandbox

• Sandbox access is for building and testing an integration with Ridge Arc Network. It may be withdrawn at any time and data in it may be reset without notice.
• Do not load real personal data into the sandbox. Do not use it for load testing beyond the published rate limits without agreement.
• Sandbox keys are personal to the developer who requested them and must not be shared.

2. Keys and secrets

• You are responsible for keeping keys and webhook secrets confidential and for all requests made with them.
• Rotate immediately on suspected exposure and tell us within 24 hours.
• We may revoke a key at any time to protect customers, the platform or other partners, and will tell you why.

3. Data

• Data received through the API is provided for the purpose stated at intake and for no other purpose. It may not be sold, shared or combined with data about the same person from other sources for marketing.
• You delete it when the purpose ends, subject to legal retention, and honour erasure notices within 30 days.
• Where you receive personal data you sign the data processing terms before production keys are issued.

4. Acceptable use

• No attempts to access records outside your boundary, enumerate identifiers, bypass rate limits or reverse engineer other partners' integrations.
• No use of the platform's data or output to train models without written permission.
• Report vulnerabilities to us privately; good-faith research within your own sandbox company is welcome.

5. Availability and changes

• The API is provided as described in the docs and changelog. Breaking changes carry at least 90 days of overlap. Sandbox has no availability commitment; production availability is in the partner agreement.
• We may change these terms with notice to the technical contact on file; continued use after the effective date is acceptance.

6. Contact

[email protected]. For security matters put SECURITY in the subject.