OneXnect Terms of Service

Effective date: November 7, 2026

These Terms of Service ("Terms") are an agreement between Mfini Inc. and the business that uses OneXnect. They govern your access to and use of the OneXnect API, dashboard and website. Please read them carefully. By creating a tenant on the dashboard, issuing an API key, or otherwise using the Service, you agree to these Terms on behalf of your business.


1. The agreement

1.1 Who the parties are

OneXnect is a product of Mfini Inc., a Delaware corporation based in Texas ("Mfini", "we", "us", "our"). These Terms are between Mfini and the business that uses the Service ("Customer", "you", "your"). In the product and the API, the Customer is called a tenant.

1.2 Business use only

The Service is for businesses. It is not offered to consumers for personal, family or household use. If you accept these Terms, you represent that:

  • you are at least 18 years old;
  • you are accepting on behalf of a business, and you have authority to bind that business to these Terms; and
  • the business is not barred from receiving the Service under the laws of the United States or any other applicable jurisdiction.

1.3 Other documents that form part of these Terms

The following are incorporated into these Terms by reference:


2. Definitions

  • "OneXnect" or "Service" means the OneXnect API (https://api.onexnect.com), the dashboard (https://app.onexnect.com), the website (https://www.onexnect.com), and the related Documentation.
  • "Customer" means the business that accepts these Terms (a tenant in the product).
  • "Staff" means the people the Customer allows to sign in to the dashboard for it, as owners or developers.
  • "End User" means a person the Customer registers with the Service, for whom its Agents act (a user in the API).
  • "Agent" means a software agent the Customer registers with the Service, including any AI agent, that calls the Service on an End User's behalf. Agents are the Customer's, or chosen by the Customer; they are not ours.
  • "Third-Party Service" means a service on the other side of the Service: an API (such as Gmail), a website, or an MCP server.
  • "Connection" means an End User's account on a Third-Party Service, held by us for the Customer so that its Agents can use it.
  • "Grant" means a permission, set through the Service, that lets an Agent use an End User's Connections to a Third-Party Service, and the End User's setting for each write (granted, ask or denied).
  • "Tool Call" means one use, by an Agent through the Service, of something it can do through a Connection.
  • "Customer Data" means data that the Customer, its Staff, End Users or Agents submit to the Service, or that the Service obtains from Third-Party Services through Connections on their behalf. It includes End User identifiers and details the Customer provides, the credentials and sessions held for Connections, and the content of Tool Calls and browsing.
  • "Service Data" means data about the operation of the Service that does not include the content of Tool Calls, such as usage counts, the Activity log (who did what, with ids), and logs.
  • "Documentation" means the guides and API reference we publish for the Service.

3. The Service

3.1 What it does

OneXnect is an access and authorization layer between AI agents and the services, websites and tools they use for people. The Customer registers its End Users and its Agents. An End User connects an account once, creating a Connection. We keep the credentials or session for that Connection; let each Agent use only what it declared and what the End User allowed; run Tool Calls for Agents; and, unless the End User granted it, ask the End User (through the Customer's app) before a write runs. The Service reaches Third-Party Services through:

  • APIs, through official connectors (today, OAuth managed by Composio, API keys, and our own adapters for a few services), including a pass-through call to any endpoint of a connected service;
  • MCP servers an End User adds; and
  • websites without an API: the End User signs in once on our hosted sign-in page, which runs in a remote browser; Agents then browse and act on pages in a remote browser signed in as the End User.

3.2 What it does not do

We do not run AI models on Customer Data. We do not enter passwords on an End User's behalf: signing in to a website is the End User's own act, on the site's own page. We do not complete CAPTCHAs or defeat bot checks; a website that refuses the hosted browser is not reachable through the Service.

3.3 A new service

The Service is new. We add, change and remove features as it develops, and the API may change. We will tell owners by email before a change that materially reduces what the Service does for you, where practicable. Unless an Enterprise agreement says otherwise, we offer no service level agreement and no guaranteed uptime.

3.4 Before launch

Until we launch, signing up is by waitlist, approved by hand. We may decline or delay any request to join. Until billing launches, the Service is free of charge (Section 10.1).


4. Accounts, Staff and keys

4.1 Dashboard sign-in

Staff sign in to the dashboard through Clerk, our authentication provider. A second sign-in factor is optional. Anyone signed in may create a tenant and becomes its first owner. Others join by invitation from an owner.

4.2 Roles

Owners manage the tenant: its API keys, team, settings, limits, webhooks and billing. Developers can see the tenant's dashboard but not change these. A tenant always has at least one owner. You are responsible for whom you invite and the role you give them, and for all actions taken by your Staff.

4.3 API keys and user tokens

Owners issue and revoke the tenant's API keys on the dashboard. When you register an End User, the API returns a token for that End User once. We keep only a hash of each key and token (and a prefix, so you can tell keys apart), so we cannot show either again. You must keep keys and tokens secret, store them only on your servers, and revoke or replace any that may be compromised. You are responsible for all use of the Service under your keys and tokens. We email owners when a key is used from a new address.

4.4 Accurate information

You agree to give accurate information for your tenant and Staff and to keep it current, including the email addresses we use for notices (Section 20).


5. End Users and Agents

5.1 You vouch for your End Users

The Service relies on the Customer, not on the End User, to establish who an End User is and what they have authorized. You represent and warrant that, for each End User you register and each Connection they make:

  • the End User has authorized you, and your Agents, to act on the accounts they connect, to the extent your Agents use them;
  • you have given the End User every notice, and obtained every consent, that applicable law requires for your use of the Service with their accounts and data; and
  • you will stop using a Connection, and delete it or the End User through the API, when that authorization ends.

5.2 Telling End Users who is involved

Connecting an account involves Mfini and, depending on the route, our vendors (for example Composio for API connections it manages, Browserbase for remote browsers). We provide plain-language wording that names them (GET /connections/disclosure). Whether and how you show it is your decision, but you remain responsible for any notice the law requires (Section 5.1).

5.3 Your Agents and your decisions

You decide which End Users exist, which Agents you register, what each Agent declares and may use, the limits you set, and which writes your app asks End Users about. Your Agents decide which Tool Calls to make; we do not. You are responsible for your Agents' actions through the Service, and for how your app presents approval requests to End Users and relays their decisions to us. A Grant or an approval you send us is treated as the End User's own instruction.

5.4 End Users have no account with us

End Users do not sign up with us and have no agreement with us. Your relationship with your End Users, including any support they need, is yours. If an End User contacts us about the Service, we may refer them to you.


6. Third-Party Services

6.1 The End User's own accounts

A Connection is the End User's own account on a Third-Party Service, reached on the End User's instruction under that service's terms. Third-Party Services are not our subprocessors and are not part of the Service.

6.2 Your responsibility

You are responsible for ensuring that your and your Agents' use of each Third-Party Service through the Service complies with that service's terms and with applicable law. Some Third-Party Services restrict automated access; using the Service with them may breach their terms or lead them to restrict an End User's account. Whether to connect a given service is your and the End User's decision.

6.3 What we cannot control

We are not responsible for any Third-Party Service: its availability, its content, its accuracy, changes to its API or pages, or its decision to refuse, limit or block access (some websites refuse remote browsers). If a Third-Party Service ends a session or revokes access, the Connection may need the End User to reconnect.

6.4 Our vendors

We use vendors to provide the Service, including Composio (API connections and OAuth) and Browserbase (remote browsers). The current list, with what each receives, is at /legal/subprocessors. For API connections managed by Composio, the consent screen an End User sees may name Composio, and Composio holds the OAuth tokens on our behalf.


7. Custody of Connections

7.1 What we hold

To provide the Service, we hold, on your behalf, the credentials and sessions for your End Users' Connections: OAuth tokens (held by Composio for the connections it manages), API keys and tokens, MCP server tokens, and, for websites, the site's cookies and storage and the identity provider's cookies captured when the End User signed in. We do not keep website passwords. What we hold directly is stored encrypted.

7.2 How we use it

We use a Connection's credentials and session only to provide the Service, and only for Tool Calls and browsing that the Agent declared and the Grants allow. Credentials are added to requests at the network layer; they are not returned through the API, given to a model or written to a log. When a website session lapses, we may sign back in through the identity provider the End User used, in a browser that only our code drives, where we can. We do not load an End User's Google, Apple or Microsoft session into a browser that a person or an Agent drives.

7.3 Deleting

You can delete a Connection, or an End User, through the API at any time. Deleting an End User deletes everything we keep for that End User. When a Connection is deleted (directly or with its End User), we delete its credentials and session, and revoke it at Composio where Composio holds it; for a website, you may ask us to sign out on the site first. Because credentials and sessions are never returned through the API, they cannot be exported; End Users reconnect if they move elsewhere.

7.4 We relay; we do not monitor

The Service passes what a Third-Party Service returns to your Agent as it was sent, and what your Agent sends to the Third-Party Service. We do not read, judge or reshape it, and we do not monitor its content. Optional features you turn on (such as the sensitive-data screen, off by default) act on it only as you chose. We may still investigate reports of misuse and act under Section 11.3.

7.5 What is kept beyond a call

What passes through a Tool Call is not kept beyond the call, except: a write waiting for an End User's decision (its arguments, encrypted, until decided or for at most 7 days) and its result once run (handed over once and kept at most 24 hours, encrypted); and a browse's page copy (encrypted, removed when the browse closes). The Privacy Policy describes what else we keep and for how long.


8. Acceptable use

You must use the Service, and make sure your Staff, End Users and Agents use it, in accordance with the Acceptable Use Policy at /legal/acceptable-use. In short, it prohibits acting on an account without its owner's authorization, defeating a Third-Party Service's security, sending spam, harvesting data at abusive rates, attacking or overloading the Service, and anything unlawful. If the Acceptable Use Policy and these Terms conflict, these Terms control.


9. Customer Data and privacy

9.1 Ownership

As between you and us, you own Customer Data. End Users and Third-Party Services keep whatever rights they have in it. We claim no ownership of Customer Data.

9.2 Your licence to us

You grant us a non-exclusive, worldwide, royalty-free licence to host, store, transmit and otherwise process Customer Data, and to let our subprocessors do so, only as needed to provide, secure and bill the Service and to comply with law.

9.3 How we use it

We use Customer Data only to provide, secure and bill the Service, to support you when you ask, and to comply with law. We do not sell Customer Data, use it for advertising, or use it to train AI models or anything else.

9.4 We act on your instructions

For data about your End Users (the ids and details you give us, their Connections, credentials and sessions, what passes through Tool Calls, Grants and decisions), you decide and we act on your instructions, as a processor or service provider. These Terms, your use of the API and your settings are your instructions. A Data Processing Agreement is available on request at support@onexnect.com.

9.5 Privacy Policy

The Privacy Policy at /legal/privacy describes the personal data we handle, including the data for which Mfini decides (your Staff, billing contacts, site visitors and support email), and how long we keep it.

9.6 Legal requests

If a court or authority requires us to disclose Customer Data, we will tell you first unless the law forbids it, and disclose only what is required.

9.7 Service Data

We may use Service Data to operate, secure, support and bill the Service, and to comply with law.


10. Fees and billing

10.1 Until billing launches

Billing has not launched. Until it does, the Service is free of charge and nothing is charged. We will email owners at least 30 days before charging starts. The rest of this Section applies from then.

10.2 Plans

  • Free: no card needed; a monthly allowance of Tool Calls and browser minutes, and a ceiling on the Connections held at once. Past the allowance, the counted actions return the error payment_required (HTTP 402); nothing else stops and nothing is deleted. The allowance resets on the 1st of each month (UTC).
  • Pro: a monthly base fee that includes some Tool Calls, browser minutes and new API connections each month, and a price for each one used beyond them. In the first month, the base fee is charged by the days you were on Pro.
  • Enterprise: prices and invoicing agreed with us in writing.

The current prices, allowances and included amounts are on our website's pricing.

10.3 What is counted

  • Tool Calls: each Tool Call sent to a Third-Party Service, whatever it answers. Website browsing is counted in browser minutes, not Tool Calls.
  • Browser minutes: each remote browser we open for you (browsing, the sign-in page, automatic sign-in, signing out on deletion, the dashboard's console), measured as our browser vendor bills it: each browser's time rounded up to a whole minute, at least one minute.
  • New API connections: each new connection to an API (not an MCP server or a website). Reconnecting an existing Connection is not a new one.

Not counted: calls we refuse, writes waiting for a decision or declined, and our own errors.

10.4 When you are charged

Pro is charged monthly in arrears: on the 1st of each month, for the month before, to your primary card (Section 10.5). If your unbilled use passes $100 during a month, we charge it then, and deduct it from that month's charge.

10.5 Payment

Stripe, our payment processor, holds your cards; we never see a card number. An owner chooses one card as the primary card; the others are backup cards. By moving to Pro, you authorize Mfini, through Stripe, to charge your primary card for the amounts due under these Terms and, if it is declined, any other card saved for your tenant, newest first, until one is accepted. Each amount is charged once, to one card. Owners are emailed when a backup card is charged; the primary card stays as you set it. To have only one card charged, keep only one card. Mfini is the seller. Receipts and monthly statements are on the dashboard.

10.6 Failed payments

If every card is declined, we try again 1, 3, 7 and 14 days later, through the cards in the same order, and email owners each time. If the last retry fails, your tenant goes back to Free. The amount remains owed, and is charged when an owner adds a card again. Nothing is deleted.

10.7 Taxes

Prices exclude taxes. We collect sales tax where we are registered to do so: currently Texas, for Customers in Texas, shown as its own line. You are responsible for any other taxes that apply to your purchase, other than taxes on our income.

10.8 Cancelling

An owner can go back to Free on the dashboard at any time. The change takes effect at the end of the month, and that month is charged as usual. Nothing is deleted on cancelling.

10.9 Refunds

Use already billed is not refunded. Billing errors and unauthorized charges are refunded to the card charged. The Refund and Cancellation Policy at /legal/refunds has the details. Please contact support@onexnect.com about any charge before disputing it with your card issuer.

10.10 Price changes

We may change prices and allowances. We will give at least 30 days' notice by email to owners before a change takes effect. A change applies only to use after it takes effect. Enterprise prices change only as agreed in writing.


11. Limits and suspension

11.1 Your limits

Owners set the tenant's own limits and pauses on the dashboard (for example, rates per key, End User and Agent, daily totals, writes per End User a day, and open browses), each to block or only alert. They are set on the dashboard only, never through the API.

11.2 Our operational limits

We may apply limits needed to protect the Service, our vendors and other customers, such as the maximum length of a browse (by default 30 minutes, up to 2 hours). The Documentation describes them.

11.3 Suspension

We may suspend all or part of your access to the Service if:

  • your use, or a key or token, poses a security risk to the Service, other customers, End Users or Third-Party Services;
  • you, your Staff, End Users or Agents violate the Acceptable Use Policy or these Terms in a way that requires prompt action; or
  • the law requires it.

Unpaid amounts alone do not lead to suspension: after the last retry your tenant goes back to Free (Section 10.6), and the amount stays owed.

We will give notice before suspending where practicable, and otherwise as soon as we can afterwards. We will limit a suspension to what the reason requires and lift it once the reason is resolved. Suspension does not delete Customer Data.


12. Security

12.1 Our measures

We take reasonable measures to protect the Service and Customer Data, including: credentials encrypted, added to requests at the network layer, and never returned to a model or written to a log; row-level security in the database per tenant and per End User, with the application running as a restricted role; keys and user tokens stored only as hashes; sign-in links that are signed, expire after 30 minutes, open in the first browser only, and are spent when finished; writes that ask the End User by default; no browser run on our own servers; TLS for data in transit; and a weekly audit of our software dependencies. We do not currently hold security certifications such as SOC 2 or ISO 27001. No system is perfectly secure, and we do not promise that the Service will be free of vulnerabilities.

12.2 Your responsibilities

You are responsible for: keeping API keys and user tokens secret and on your servers; revoking and replacing any that may be compromised; securing your own app, servers and Agents; managing who has Staff access and which role; authenticating your End Users before your app acts for them or relays their decisions; and reviewing the Activity log and the alerts we email to owners.

12.3 Security incidents

If we become aware of unauthorized access to Customer Data in our custody, we will notify owners without undue delay, and within 72 hours of confirming it, tell you what we know, and take reasonable steps to contain it. You are responsible for any notices you owe your End Users or regulators, and we will give you reasonable help with them.

12.4 Reporting vulnerabilities

Please report suspected vulnerabilities to security@onexnect.com. Testing that would harm the Service, other customers or End Users, or access data that is not yours, is not permitted.


13. Confidentiality

Each party may receive non-public information from the other that is marked confidential or that a reasonable person would understand to be confidential, including your keys, tokens and Customer Data ("Confidential Information"). The receiving party will use it only to perform under these Terms, protect it with at least reasonable care, and share it only with its employees, contractors and subprocessors who need it and are bound to protect it. This does not apply to information that is public through no fault of the receiving party, was already known to it, is received lawfully from someone else, or is developed independently. A party may disclose Confidential Information when the law requires, after giving notice where permitted.


14. Intellectual property

14.1 Ours

Mfini owns the Service, including its software, design, Documentation and the knowledge it accumulates about how to reach Third-Party Services. These Terms grant you no rights in it except those in Section 14.2.

14.2 Your right to use the Service

Subject to these Terms, we grant you a non-exclusive, non-transferable right, during the term, to access and use the Service and Documentation to build and run your own products, and to make the Service available to your Staff, End Users and Agents as part of those products.

14.3 Restrictions

You will not, and will not let anyone else: copy, modify or create derivative works of the Service; reverse engineer it, except where the law allows despite this restriction; resell or sublicense access to the Service on its own, except as part of your products; get around its security, limits or billing; or use it in breach of the Acceptable Use Policy.

14.4 Feedback

If you send us suggestions or feedback, we may use them without restriction or obligation to you.

14.5 Publicity

We will not use your name, logo or trademarks to identify you as a customer without your prior permission.


15. Term and termination

15.1 Term

These Terms apply from when you accept them until they end under this Section.

15.2 By you

You may stop using the Service at any time. You can delete End Users and Connections through the API yourself. To close your tenant, email support@onexnect.com from an owner's address; we close it and delete its data as Section 15.4 says.

15.3 By us

We may end these Terms or close your tenant:

  • if you materially breach these Terms and do not cure the breach within 30 days after our notice, or immediately for a breach that cannot be cured or for a serious violation of the Acceptable Use Policy;
  • if the law requires it; or
  • if we discontinue the Service, with at least 30 days' notice by email to owners.

15.4 Effect

When these Terms end: your right to use the Service ends; all unpaid fees for use up to that date become due; and we delete Customer Data, including all Connections (revoked at Composio where it holds them), within 30 days. We keep billing and usage records for 7 years, for tax. Copies in our hosting provider's database backups expire as that provider keeps them under its standard terms (see the subprocessors page).

15.5 Survival

Sections 5.1, 9.6, 10 (for amounts owed), 13, 14.1, 14.3, 14.4, 15.4, 15.5 and 16 to 22 survive the end of these Terms.


16. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY LAW, MFINI DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT.

Without limiting the above, we do not warrant that: the Service will be uninterrupted, error-free or secure; any Third-Party Service will remain reachable through the Service, or that a website will accept our remote browsers or a lapsed session can be restored; or what a Third-Party Service returns is accurate or complete. We do not verify End Users' identities or authorizations; we rely on yours (Section 5.1). We are not responsible for what your Agents do through the Service, including writes that an End User granted or approved.


17. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

  • NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, EVEN IF ADVISED OF THEIR POSSIBILITY.
  • MFINI'S TOTAL LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF THE FEES YOU PAID US IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR $100.

These limits do not apply to your obligation to pay fees, or to your obligations under Section 18.1.


18. Indemnification

18.1 By you

You will defend Mfini and its officers, directors and employees against any third-party claim, and pay the resulting damages, costs and reasonable attorneys' fees, to the extent the claim arises from:

  • your Agents' actions through the Service;
  • a lack of authorization, notice or consent from an End User that you represented under Section 5.1, or any claim by an End User about your use of their accounts or data;
  • your or your Agents' use of a Third-Party Service in breach of its terms;
  • Customer Data you or your Agents supplied; or
  • your violation of these Terms, the Acceptable Use Policy or applicable law.

18.2 By Mfini

We will defend you against any third-party claim that the Service, as we provide it, infringes that third party's United States patent, copyright or trademark or misappropriates its trade secret, and pay the resulting damages and costs finally awarded or agreed in settlement. We have no obligation for a claim arising from Customer Data, a Third-Party Service, your Agents, your products, a combination of the Service with anything we did not provide, or use in breach of these Terms. If such a claim is made or appears likely, we may obtain the right for you to keep using the Service, modify it so it no longer infringes, or, if neither is reasonably possible, end your use of the affected part, after which you owe no fees for it. This Section 18.2 states our entire obligation for infringement claims.

18.3 Procedure

The party seeking defence will notify the other promptly, give it sole control of the defence and settlement (though no settlement may admit fault by, or impose obligations on, the defended party without its consent), and provide reasonable help at the defending party's expense.


19. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict-of-law rules. Any dispute arising out of or relating to these Terms or the Service will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, seated in Austin, Texas. Either party may seek injunctive or other equitable relief in a court of competent jurisdiction to protect its intellectual property, Confidential Information or the security of the Service.


20. Notices

We send notices to the email addresses of your tenant's owners, and may also post notices on the dashboard. Notices to us go to support@onexnect.com, or by mail to Mfini Inc., 1401 Lavaca St, Ste 558, Austin, TX 78701. A notice by email is given when sent.


21. Changes to these Terms

We may update these Terms. We will post the new version on the website with its effective date and, for a material change, email owners at least 30 days before it takes effect. A change does not apply to a dispute that arose before it. If you do not agree to a change, stop using the Service before it takes effect; continuing to use the Service after that date means you accept the updated Terms.


22. Miscellaneous

22.1 Entire agreement

These Terms, with the documents in Section 1.3, are the entire agreement between you and Mfini about the Service, and replace any earlier agreement on the subject.

22.2 Order of precedence

If documents conflict, this order applies: a signed Enterprise agreement; a signed Data Processing Agreement (for the processing of personal data); these Terms; then the other documents in Section 1.3.

22.3 Assignment

Neither party may assign these Terms without the other's written consent, except that either party may assign them to a successor in a merger, acquisition or sale of all or substantially all of its relevant business or assets, with notice to the other.

22.4 Force majeure

Neither party is liable for a delay or failure caused by events beyond its reasonable control, including outages of Third-Party Services, vendors or networks. This does not excuse an obligation to pay.

22.5 No third-party beneficiaries

These Terms give no rights to anyone other than you and Mfini. In particular, End Users are not third-party beneficiaries.

22.6 Independent parties

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship.

22.7 Export and sanctions

You will comply with United States export control and sanctions laws in using the Service, and will not use it in, or make it available to anyone in, a country or to a person barred by those laws.

22.8 Severability and waiver

If any provision is found unenforceable, it will be enforced to the extent possible and the rest remain in effect. Not enforcing a provision is not a waiver of it.

22.9 Electronic agreement

You agree that these Terms may be accepted, and notices given, electronically.


23. Contact

Questions about these Terms, billing or privacy:

Mfini Inc.

Email: support@onexnect.com

Security: security@onexnect.com

Address: 1401 Lavaca St, Ste 558, Austin, TX 78701