Terms of service

1. The agreement, and who it is between

These terms form a binding agreement between you — the person or organisation that registers an account, referred to as you or the customer — and IDEX, referred to as we, us or the platform.

By creating an account, signing in, funding a wallet, submitting a verification or calling the API, you confirm that you have read and accept these terms, our privacy policy, our acceptable use policy and our data protection terms. Those documents are incorporated into this agreement by reference. If you do not accept them, do not use the platform.

If you are accepting these terms on behalf of an organisation, you confirm that you have authority to bind that organisation, and "you" then means that organisation.

IDEX is an independent technology platform. It is not the National Identity Management Commission, the Nigeria Inter-Bank Settlement System, the Central Bank of Nigeria or any other government body, and is not affiliated with, endorsed by, licensed by or acting on behalf of any of them. Nothing in this agreement should be read as conferring any official or governmental status.

2. Definitions

• Service — a verification product offered on the platform, such as a NIN or BVN check.
• Verification or lookup — a single request you submit to a service, identified by a unique reference.
• Provider — a third party that supplies the data behind a service.
• Wallet — the prepaid balance held on your account and used to pay for verifications.
• Ledger — the append-only record of every movement in your wallet.
• API key — the credential pair, consisting of a key identifier and a secret, used to authenticate machine requests.
• Data subject — an individual whose personal data is processed, including a person whose identifier you submit.

3. Eligibility

To register and use an account you must:

• be at least 18 years old and legally capable of entering into a binding contract;
• register in your own name, or in the name of an organisation you are authorised to represent;
• provide accurate registration details and keep them current;
• not be barred from receiving services under any applicable law, sanctions regime or a previous termination by us; and
• use the platform for a lawful purpose, in accordance with section 5 and our acceptable use policy.

We may ask you to verify your identity, your business registration or your authority to act before we activate a service, raise a limit or release a balance. We may decline or close an account where we cannot satisfy ourselves on any of these points, and we may close new registrations entirely for a period.

4. Your account and its security

You are responsible for everything that happens under your account, including anything done by a member of your staff or by a system using your API key. Keep your password and your API secrets confidential, use a password you do not use anywhere else, and enable two-factor authentication.

Do not share one account between people who should have separate accountability, do not embed an API secret in a mobile application, a browser page or a public code repository, and revoke a key immediately if you suspect it has been exposed. You can revoke a key, sign out every session and change your password from your account at any time.

Tell us promptly if you suspect unauthorised access. We will help you contain it, but we cannot reverse a verification that has already been performed and paid for, and charges properly incurred through your credentials remain your responsibility unless the loss was caused by our failure.

5. Lawful basis and consent

This is the most important obligation in this agreement. When you submit somebody's identifier for verification, you are processing that person's personal data, and you decide why. In relation to that decision you are the controller and we act on your instruction.

You warrant, for every verification you submit, that:

• you have a lawful basis under the Nigeria Data Protection Act 2023 for the check;
• where the lawful basis is consent, you have obtained the data subject's consent, it was freely given, specific and informed, and you can evidence it;
• you have told the data subject, or are otherwise permitted not to tell them, that a verification will be carried out;
• the check is for the purpose you have described to the data subject and to us; and
• you will not retain, disclose or re-use the result beyond that purpose.

We may ask you to demonstrate your lawful basis for a specific verification or a pattern of verifications, and to do so promptly. We may suspend a service, an account or an individual key while we do. We are not obliged to police your basis, and our not asking is not approval.

6. Acceptable use

Our acceptable use policy forms part of these terms and sets out in detail what you may not do with the platform. In summary, you must not use it to stalk, harass or locate a person, to discriminate unlawfully, to run background checks without a lawful basis, to harvest identifiers in bulk, to resell access without a written agreement with us, or to attack the platform or anybody else's account.

You must also not attempt to circumvent a rate limit, a price, an availability control or an authentication check, whether by automation, by creating multiple accounts or by any other means.

7. The services and their availability

A service is available only when a provider connection has been mapped to it and activated. Until then it is shown as awaiting activation and cannot be submitted; the platform will not take payment for a service it cannot perform. The status shown on the services page and in your dashboard is authoritative.

We may add, change, suspend or withdraw a service, and we may change the fields a service requires, where a provider changes what it accepts or returns. Where a change materially affects a service you actively use, we will give you reasonable notice.

We do not guarantee the result of any verification. Results come from third-party records that we do not maintain and cannot correct. A verification may return no record, an incomplete record or a record that is out of date, and none of those outcomes is a defect in the platform. We cannot create, amend, suspend or cancel an identity record — only the issuing authority can.

A result is evidence of what a provider returned at the moment of the check. It is not certification of a person's identity, and you must not present it as such.

8. Wallet, pricing and payment

• The platform is prepaid. You fund a wallet, and each verification is charged against that balance at the moment you submit it.
• The wallet is a prepaid usage balance held for the purpose of paying for services on this platform. It is not a deposit account, it is not a payment service offered to third parties, it earns no interest, and it is not insured as a bank deposit.
• The price of a service is the price displayed to you before you submit — on the pricing page, on the service form and, for API requests, in the pricing endpoint. Where a specific rate has been agreed for your account, that rate is what you are charged.
• Prices may change. A change takes effect prospectively; a verification already submitted is charged at the price quoted at submission.
• Funding is subject to a minimum amount shown on the funding page, and to any limit we apply to your account.
• A funding payment is credited when the payment processor confirms it, or when an administrator confirms a bank transfer. Each payment carries a unique reference; a repeated confirmation of the same reference credits your wallet once and once only.
• Where a payment processor charges a fee for a funding transaction, that fee is not part of your balance.
• Every movement is written to an append-only ledger with the balance before and after it. A correction is recorded as a new opposing entry, never as an edit. The ledger is the authoritative record of your balance.
• You are responsible for any tax applicable to your use of the platform, other than tax on our own income.
• An unused balance is refundable to the funding source on request, less any amount already spent and any fee properly incurred, once we have verified your identity and ownership of the account. We may decline a refund request where fraud is suspected, where the balance is subject to a legal hold, or where a refund would breach a legal obligation.

9. Charging, failed lookups and refunds

You are charged when a verification is submitted, not when it completes. What happens next depends on the outcome:

A refund is credited to your wallet, not to your card or bank account. Every refund carries an idempotent reference, so a repeated refund attempt for the same verification credits you once.

A correct result you did not want is not a refundable failure. A verification that returns the record you asked for has been performed, even if the record contradicts what you expected. Equally, a lookup you submitted against the wrong identifier has still consumed a provider request.

If you believe you have been charged incorrectly, tell us within 30 days, quoting the verification reference. We will trace the request through the ledger and the audit trail and correct any error on our side by a ledger entry, which will appear in your transaction history.

10. API terms

• API keys are issued to your account and are personal to it. Each key has scopes; a request outside a key's scopes is refused.
• A secret is displayed once, at creation, and stored only as a hash. We cannot recover a lost secret; we can only issue a replacement.
• Requests are rate limited per key. Limits are published in the documentation and may be adjusted for your account. Repeatedly exceeding a limit, or engineering around it, is a breach of these terms.
• Send requests over HTTPS only, and treat a key exposed in a client application, a public repository or a log file as compromised — revoke it immediately.
• Do not use the API to build a competing verification service, to cache and resell results, or to create a general-purpose search interface over identity data.
• Automated retries must respect the reference we return. Re-submitting a verification is a new billable request; re-reading one is not.
• We may change response fields additively and will version the API before making a breaking change. Treat unknown fields as safe to ignore rather than as an error.
• Webhook and callback endpoints you register must be reachable over HTTPS and must validate the signature we send.

11. Support and service levels

Support is provided by email and through the contact form during the support hours published on this site. We aim to acknowledge an enquiry within one business day. Security reports are triaged ahead of the rest of the queue.

Unless we have signed a separate service level agreement with you, the platform is provided without a guaranteed uptime figure and without a guaranteed response time for a specific verification. We carry out maintenance where possible outside business hours and will give notice of planned work that will interrupt the service.

12. Intellectual property

The platform, its software, its interface, its documentation, its brand and its content belong to us or to our licensors. Nothing in these terms transfers any of that to you. We grant you a non-exclusive, non-transferable, revocable right to use the platform in accordance with these terms for the duration of your account.

You must not copy, decompile, reverse engineer, resell, sublicense or create a derivative work from the platform, nor remove or obscure any notice on it, except to the extent the law expressly permits despite this restriction.

Data you submit remains yours. A result returned to you is yours to use for the purpose you lawfully obtained it, subject to the rights of the data subject and to any restriction the underlying provider imposes. We may use aggregated, de-identified statistics about platform usage — volumes, error rates, response times — to operate and improve the service. Such statistics never identify you or any data subject.

If you send us feedback or a suggestion, we may use it without obligation to you.

13. Confidentiality

Each of us may receive information from the other that is confidential. Neither will disclose the other's confidential information except to people who need it in order to perform this agreement and who are bound by equivalent obligations, or where disclosure is legally required. Your API secrets and our non-public technical and commercial information are confidential by default.

14. Data protection

Our handling of personal data is described in the privacy policy, and the controller and processor roles, security measures, breach notification and sub-processor arrangements are set out on the data protection page. Those terms apply to this agreement.

In summary: where you submit a third party's identifier, you are the controller for that decision and we act as your processor for the verification itself; we are controller in our own right for your account, your billing records and our security and audit logs. Each of us will comply with the Nigeria Data Protection Act 2023 in respect of the roles it holds.

15. Suspension and termination

We may suspend or restrict access to an account, a service or an API key, with or without prior notice where the circumstances require it, if:

• we reasonably suspect a breach of these terms or of the acceptable use policy;
• we reasonably suspect fraud, money laundering, unauthorised access or use of stolen credentials;
• we reasonably suspect verifications are being run without a lawful basis;
• your use threatens the stability or security of the platform, a provider or another customer;
• a provider, a regulator or a court requires it; or
• your account balance cannot cover amounts properly due.

Where we suspend, we will tell you as soon as we reasonably can and what you can do about it, unless telling you would be unlawful or would defeat the purpose of the suspension. A suspension for suspected abuse is a protective measure, not a penalty, and we will lift it promptly once the concern is resolved.

You may close your account at any time from your account settings or by writing to us. Closing an account does not refund amounts already spent. We may terminate this agreement on 30 days' notice, or immediately for a material breach that is not capable of remedy or that is not remedied within 14 days of notice.

On termination your right to use the platform ends. Any unused balance is returned in accordance with section 8, we will retain records we are legally required to keep, and the sections that by their nature should survive — including 12, 13, 16, 17, 18 and 22 — survive.

16. Warranties and disclaimers

We warrant that we will provide the platform with reasonable skill and care, and that we will apply the security measures described in our privacy policy.

Beyond that, and to the fullest extent the law permits, the platform is provided "as is". We do not warrant that it will be uninterrupted or error free, that a provider will be available, that any verification will succeed, that any record exists, or that a result is accurate, complete or current — a result reflects what a third-party source returned at that moment and nothing more.

You are responsible for deciding whether a verification result is sufficient for your purpose, and for any decision you take on the basis of one. Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, or for fraud.

17. Limitation of liability

Subject to the final paragraph of section 16:

• Neither party is liable for indirect or consequential loss, loss of profit, loss of revenue, loss of business, loss of anticipated savings, loss of goodwill or loss of or corruption of data, however arising.
• Our total aggregate liability arising out of or in connection with this agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of (a) the total amount you paid us in the three months immediately before the event giving rise to the claim, and (b) ₦50,000.
• We are not liable for a loss caused by your failure to keep your credentials secure, by your instruction to us, by your use of a result for a purpose it does not support, or by the accuracy or availability of a third-party provider's data.
• A claim must be brought within 12 months of the date you became aware, or ought reasonably to have become aware, of the circumstances giving rise to it.

These limits reflect the price of the services and the fact that we do not control the underlying identity records. They are a fair allocation of risk between us.

18. Indemnity

You will indemnify us against any claim, demand, penalty, loss or reasonable cost arising from your breach of these terms or of the acceptable use policy, from your processing of a data subject's personal data without a lawful basis, from your use of a verification result, or from a claim by a data subject or a regulator relating to a check you instructed. We will tell you promptly about any such claim and will not settle it without your agreement, which you will not unreasonably withhold.

19. Events outside our control

Neither party is in breach of this agreement, nor liable for a delay or failure to perform, because of an event beyond its reasonable control — including the failure or withdrawal of a third-party provider, a failure of a public telecommunications or power network, an act of a government or regulator, an industrial dispute, a natural disaster or a widespread internet outage. If the event continues for more than 30 days, either party may terminate on written notice, and we will refund any unused balance.

20. Changes to these terms

We may amend these terms. The date at the top of this page shows when they were last revised. Where a change is material — a change to pricing structure, to refund treatment, to liability or to your obligations — we will give you at least 14 days' notice by email or by a notice in your dashboard before it takes effect.

If you do not accept a change, you may close your account before it takes effect and request the return of any unused balance under section 8. Continuing to use the platform after the effective date means you accept the revised terms. Changes required by law or necessary to protect the security of the platform may take effect immediately.

21. General

• Entire agreement. These terms, together with the policies they incorporate and any signed order form, are the whole agreement between us and replace anything said or written beforehand. Nothing here excludes liability for fraudulent misrepresentation.
• Assignment. You may not assign or transfer your rights without our written consent. We may assign to an affiliate or to a successor of our business.
• No partnership. Nothing in these terms creates a partnership, joint venture, agency or employment relationship between us.
• Severability. If a provision is held unenforceable, the rest continues in force and the provision is treated as modified to the minimum extent necessary to make it enforceable.
• Waiver. A delay in enforcing a right is not a waiver of it.
• Third parties. Nobody other than you and us has any right to enforce these terms.
• Notices. We give notice by email to the address on your account or by a notice in your dashboard; you give notice to us at the address in section 23. A notice by email is treated as received on the next business day.
• Language. These terms are written in English, and English governs their interpretation.

22. Governing law and disputes

This agreement, and any dispute or claim arising out of or in connection with it — including a non-contractual one — is governed by the laws of the Federal Republic of Nigeria.

If a dispute arises, we ask you to raise it with us first: most are resolved once we can see the reference in the ledger. If it cannot be settled within 30 days of being raised in writing, the parties submit to the exclusive jurisdiction of the courts of the Federal Republic of Nigeria. Nothing in this section prevents either party from seeking urgent injunctive relief, or you from complaining to the Nigeria Data Protection Commission about a data protection matter.

23. How to contact us

Related documents: privacy policy, data protection, acceptable use policy.