API Terms

These terms apply to anyone who builds on the Zung APIs — the Banking API, the Member Mobile API, webhooks and the open-source client libraries ("the APIs"). They add to your institution's subscription agreement with Zung.AI ("Zung", "we"); if the two conflict, the subscription agreement wins.

1. Who may use the APIs

• API access is granted to an institution on a plan that includes it. Developers and vendors may use the APIs only on behalf of an institution that has authorised them, and only for that institution's own data.
• If you build for several institutions, keep each one's credentials and data separate, and stop using an institution's access as soon as it withdraws its authorisation.

2. Credentials

• Banking API tokens act with the permissions and branch access of the staff user they belong to. Create dedicated API users with only the permissions your integration needs.
• Keep tokens secret: never put them in mobile apps, browser code, public repositories or support emails. Rotate them when people with access leave, and revoke any token you believe is exposed.
• Member Mobile API tokens belong to the member who signed in. Use them only to serve that member, and never store members' passwords.

3. Member data

• You must handle members' personal and financial data lawfully, securely and only for the purpose the institution authorised — following the data protection law that applies, such as Kenya's Data Protection Act 2019, Uganda's Data Protection and Privacy Act 2019, Nigeria's Data Protection Act 2023, the Philippines' Data Privacy Act 2012 or India's Digital Personal Data Protection Act 2023.
• Collect only the data you need, keep it no longer than you need, and protect it in transit and at rest.
• Don't sell member data, use it to market to members, or combine it into credit scores or profiles for anyone other than the authorising institution.

4. Money movement

• Send a unique client_ref with every repayment, deposit and withdrawal and reuse it on retries, so a transaction is never posted twice.
• Reconcile what you post against Zung, and give the institution a way to review and reverse mistakes. You are responsible for transactions your integration posts.

5. Fair use and limits

• Respect the published rate limits (currently 600 requests a minute per Banking API token, with tighter limits on sign-in, 2FA, transfers and applications) and back off on HTTP 429.
• Don't try to bypass permissions, branch scoping or institution isolation, and don't load-test or security-test production systems. Use a sandbox, and follow the Security page to report issues.

6. Security incidents

If you suspect a token, system or dataset connected to the APIs has been compromised, revoke the affected credentials, tell the institution and email dev@mfidoc.com without undue delay.

7. Changes to the APIs

• We announce breaking changes in the changelog and its RSS feed before they take effect wherever we reasonably can. Urgent security fixes may apply immediately.
• Features marked Planned or Beta are not covered by these commitments and may change or be withdrawn.

8. Branding and plugins

You may say your product "works with Zung" when it does. Don't imply Zung built, certified or endorses it unless we've agreed in writing. Plugins listed in the Zung Store or on MFI Market are also subject to those marketplaces' terms.

9. Suspension

We may suspend or revoke API access that breaches these terms, threatens the security or stability of the platform, or puts members' data at risk. Where possible we'll contact the institution first.

10. Liability

The APIs are provided under your institution's subscription agreement, and the warranties and limits of liability in that agreement apply. For anyone else, the APIs and libraries are provided as is, to the fullest extent the law allows.

11. Governing law and contact

These terms are governed by the laws of Kenya. Questions: dev@mfidoc.com.