OneXnect
Sign inJoin the waitlist

OneXnect Acceptable Use Policy

Effective date: November 6, 2026

This Acceptable Use Policy ("Policy") says what you may not do with OneXnect, a service of Mfini Inc. ("Mfini", "we", "us"). It is part of the Terms of Service, and the terms it uses ("Customer", "End User", "Agent", "Connection", "Third-Party Service", "Service") mean what they mean there. "You" is the Customer.

1. Who this applies to

  • The Customer, its staff on the dashboard, its Agents, and anything else that acts through its API keys or End User tokens.
  • Agents act for you. What an Agent does through the Service under your keys, your settings and the grants your End Users gave is your use of the Service. This holds when the Agent acts later on standing instructions, with no person watching. Setting up an Agent to do something this Policy forbids breaks the Policy as much as doing it yourself.
  • What you bring in counts too: an MCP server an End User adds, a webhook endpoint you set, a tool your Agent calls through the pass-through request.
  • You make sure your staff, your Agents and anyone you let use your keys follow this Policy.

2. Act only with the End User's authorization

The Service rests on one promise from you: every End User you register has authorized you, and your Agents, to act on the accounts they connect (see the Terms). So you may not:

  • connect or use an account the End User does not own or is not entitled to use;
  • register an End User, or act for one, without that person's authorization, or beyond what they authorized;
  • impersonate an End User or anyone else, or present an Agent's actions as a person's own where that would deceive;
  • share one End User's Connection with another person, or register one End User for several people;
  • keep using a Connection after the End User withdraws their authorization: when they do, revoke the Agent's grant, or delete the Connection or the End User, without undue delay.

3. Third-Party Services and websites

The services, websites and MCP servers your End Users connect belong to others, and each has its own terms. The Service reaches them as the End User, on the End User's instruction; it does not change what those terms allow. You may not use the Service to:

  • break a Third-Party Service's terms of use, API terms or rate limits;
  • get past a site's access controls: a login, a CAPTCHA, bot detection, a paywall, a rate limit, a geographic or device restriction. We do not do this either: we solve no CAPTCHAs, run no stealth or disguised browsers and rotate no identities. A site that refuses our hosted browser is simply not reachable through it;
  • get into an account by anything but its owner's own sign-in: no credential stuffing, password spraying, brute force, session theft or account takeover;
  • scrape or harvest data at a rate or in a way that breaches a site's terms or harms its operation;
  • create accounts on a Third-Party Service in bulk or by automation, or operate fake accounts;
  • use a Third-Party Service in a way that would breach the acceptable-use terms our own providers apply to us: Composio's (API connections) and Browserbase's (the hosted browser).

4. Content and conduct

Whatever an Agent sends, posts, buys or reads through a Connection, you may not use the Service to:

  • break any law or regulation that applies to you, your End Users or the Third-Party Service;
  • send spam or bulk unsolicited messages, or messages that break anti-spam law (such as CAN-SPAM);
  • phish, defraud, scam, or launder money;
  • harass, threaten, stalk or intimidate anyone;
  • create, store, send or seek child sexual abuse material, or anything that sexualizes minors;
  • send or host malware, or anything designed to harm a system or its data;
  • impersonate a person, brand or organization to deceive;
  • infringe anyone's intellectual property, privacy or publicity rights;
  • watch, track or profile people unlawfully, including tracking a person's location, messages or accounts without their knowledge and consent;
  • process personal data you have no right to process, or without the notice and consent the law requires you to give your End Users.

5. Regulated and sensitive uses

Some uses need more than the Service provides. You may not use the Service to:

  • let an Agent make decisions with legal or similarly significant effects on a person (credit, employment, housing, insurance, education, access to essential services) without the human review the law requires;
  • carry out regulated financial activity, such as money transmission, lending, trading or payments for others, that you are not licensed or permitted to carry out;
  • handle protected health information as a covered entity or business associate under HIPAA. We do not sign business associate agreements;
  • register an End User under 13, or under the age of digital consent where the End User lives, or collect children's personal information in breach of laws such as COPPA;
  • run a business our payment processor does not allow (Stripe's list).

6. The Service itself

You may not:

  • access, or try to access, another Customer's data, keys, End Users or Connections;
  • try to extract the credentials, cookies, sessions or sign-in links the Service holds, or direct an Agent to, including by reverse engineering, decompiling or inspecting the Service or its browsers;
  • get around the Service's keys, End User tokens, grants, limits or pauses, or open several accounts to get around a limit, the free allowance or a suspension;
  • share your API keys or End User tokens outside your own organization and systems;
  • resell, sublicense or give a third party direct access to the Service, your keys or a Connection. Building your own product on the Service for your End Users is what it is for; handing someone else the keys to it is not;
  • add an MCP server or a webhook endpoint designed to attack the Service, its providers or other Customers (for example, to return malicious tool results or prompt-injection payloads);
  • interfere with the Service: overload it, flood it, or run load or performance tests without our written agreement;
  • probe, scan or attack the Service or its providers (Composio, Browserbase, Render, Vercel, Clerk and the others on the subprocessors page).

Security research is welcome within these limits:

  • test only your own account, keys, End Users and Connections;
  • never access, keep or change anyone else's data; if you come across it, stop and tell us;
  • never disrupt the Service or degrade it for others, and never test our providers' systems;
  • report what you find to security@onexnect.com before telling anyone else, and give us reasonable time to fix it: 90 days, unless we agree otherwise.

We will not pursue legal action against research done in good faith within these limits.

7. What we do and don't watch

We are a custodian, not a guardian. The Service relays what Third-Party Services return and what your Agents send, and keeps none of it beyond what the Privacy Policy describes. We do not monitor, read or judge the content that passes through it (the optional sensitive-data screen masks card, bank and password data only when your owners turn it on), and we set no business rules for you: which Agents act, what they do with what End Users allow, and which writes your app asks about are your decisions. The limits and approvals in the Service are your own settings.

What we do see is what running the Service needs: counts, timings, errors, ids and your Activity log, never content. We act on that, on reports from others, and on what the law requires of us.

8. Enforcement

Reporting. Report abuse of the Service to support@onexnect.com. Include what you can: the site or service affected, dates and times, and what happened. Report vulnerabilities to security@onexnect.com.

What we may do. When we learn of a likely breach of this Policy, we may look into it and ask you to explain or fix it. Depending on how serious it is, we may:

  • ask you to stop or correct it by a date;
  • revoke an API key, or pause an Agent or an End User;
  • remove a Connection, signing out of the site where we can;
  • suspend some or all of the Service for your account, or end your account under the Terms;
  • report it to law enforcement, or cooperate with it, where the law requires or allows. We report child sexual abuse material as the law requires.

How. We act in proportion to the harm, and we tell your owners first and give you a chance to fix it where we practically can. When something is causing active harm (an attack, fraud, an account taken over, abuse of a Third-Party Service, a risk to the Service or to others), we may suspend first and tell you right after. Fees for use already made stay owed during a suspension.

Appeals. If you think we acted in error, write to support@onexnect.com within 30 days. We review it and answer within 10 business days.

9. Changes

We may update this Policy. We tell your owners about material changes by email at least 30 days before they take effect, except changes the law or an urgent risk requires, which take effect at once. Earlier versions stay available on request. Using the Service after a change takes effect means you accept it.

10. Contact

Mfini Inc.
1401 Lavaca St, Ste 558, Austin, TX 78701
Abuse, support and legal: support@onexnect.com
Security: security@onexnect.com