Version 2026-11-03. Draft, to be checked before the first outside company goes live. These terms apply when a company ("you") uses Zoi ID, a service of ZOI LABS LLC ("we"), through the partner dashboard or the partner API. The Data Processing Agreement is part of these terms; if they conflict, the DPA wins for personal data. A signed order form wins over both for what it covers (prices, service levels, liability).
1. The service
Zoi ID verifies the identity of your users and tells you the result
through the API and webhooks. Test mode (keys starting with zid_test_)
is for building and testing only: it never checks a real person or
document, and its data is deleted after 7 days. Live mode (keys starting
with zid_live_) checks real people and documents.
2. Your account
- The person who accepts these terms must be allowed to sign for your company.
- Keep your API keys and webhook secrets on your servers and secret. Tell us at once at support@zoi.network if one leaks, and revoke it in the dashboard.
- You are responsible for what your team members do in the dashboard. Protect owner accounts with a passkey or an authenticator app.
3. How you may use it
- Only for the use case you described when you went live, and only within the law of the countries you serve.
- You must have a lawful reason to verify each user and give them the notice the DPA describes. Users can always ask for a person to review a decision.
- Do not try to break, overload, copy or reverse engineer the service, and do not use it to build lists of people, to monitor people, or to decide things a verification is not meant for.
- Data scopes beyond eligibility (status, validity, over 18) are given only for a stated need, and you use that data only for it.
- You are not on a sanctions list (for example the US OFAC SDN list) and are not owned or controlled by anyone who is. You do not use the service for people or business in places under comprehensive US sanctions; our checks block those places too (sanctions notice).
4. Your compliance stays yours
- Zoi ID gives you evidence and a result. It is a tool for your own decision, not a decision taken for you. If laws such as anti-money laundering, know-your-customer or age rules apply to you, you remain responsible for meeting them: your risk assessment, the level you ask for, which results you accept, ongoing monitoring and reporting to authorities.
- Every result tells you how the person was verified (
captureMethod: a signed wallet credential, a document chip read over NFC, or photos of the document) and whether a person reviewed it (manualReview). Chip and wallet checks verify the issuer's digital signature. A photo check cannot prove a document is genuine in every case. Choose what you accept for your risk: for example, requirenfcorwalletfor high-risk users. - Sanctions and politically exposed person screening uses public lists and name matching. Matches go to a person at Zoi ID, but your own sanctions and PEP obligations stay with you.
- Unless we agree otherwise in writing, we do not act as a third party you rely on under anti-money laundering law, and you may not tell a regulator that we do.
5. Fraud we miss
- No verification service catches every forged document or impostor. If someone deceives checks that we ran as described in our documentation, that loss is not ours.
- Tell us when you learn that a verified user was not who they claimed: one call to the fraud report API or one button on the session in the dashboard. We review every report, use it to improve the checks, and tell you what we found when it affects you.
- We tell you without undue delay if we find that a check did not work as described (for example a defect that approved sessions it should have sent to review), which of your sessions it touched, and what we fixed.
6. Our part
- We run the checks described in our public documentation, keep the data as the DPA and our retention schedule say, and keep the service secure.
- We may suspend keys or an organisation at once if we see abuse, a security risk, a sanctions concern, or a breach of these terms, and we tell you why unless the law forbids it.
- The service is offered as it is. We do our best to keep it available, but there is no uptime commitment unless an order form says so. We do not promise that every verification succeeds or that an approved person is who they claim to be in every case.
7. Fees
Test mode is free. Live prices and any free allowance are shown in the dashboard or agreed in writing before you are charged. Until then live use is free. Prices do not include taxes. We may suspend live mode if an invoice is more than 30 days late, after a reminder.
8. Confidentiality
Each side keeps the other's non-public information (API keys, prices, security reports, business plans) confidential and uses it only for this service. This does not cover information that is public, was already known, or must be disclosed by law. Personal data is covered by the DPA.
9. Liability
- Neither side is liable for indirect, special or lost-profit damages, or for loss of business or reputation.
- Our total liability for everything under these terms and the DPA in any 12 months is limited to the fees you paid us in that period, or 100 USD if you paid nothing. An order form can set a different cap.
- We are not liable for losses caused by a user who deceives checks we ran as described (section 5), by results you chose to accept, or by your own breach of these terms or of the law.
- You are responsible for claims against us that come from your unlawful use of the service, for example verifying people without a lawful reason or without the notice the DPA requires.
- Nothing here limits liability that the law does not allow to be limited, such as for fraud or wilful misconduct.
10. Changes and ending
- We tell owners by email and in the dashboard 30 days before a change that is worse for you. You accept the new version in the dashboard to keep using live mode.
- You can stop at any time: revoke your keys and delete your users through the API. We can end these terms with 30 days' notice, or at once under section 6.
- After the end, the DPA says what happens to your users' data.
11. Other terms
- Neither side is liable for delays caused by events outside its reasonable control (for example a hosting or network outage, war, or a change in law).
- You may not transfer these terms without our written consent; we may transfer them to a company that takes over the service and tell you.
- These terms, the DPA and any order form are the whole agreement. Sections 4, 5, 8 and 9 and the DPA survive the end of these terms.
12. Law
These terms are governed by the laws of the State of New York, USA, and the courts of New York County decide disputes, unless the DPA or the law of your country requires otherwise.
13. Contact
ZOI LABS LLC, 26 Broadway, Suite 934, New York, NY 10004, USA, support@zoi.network.