Sandbox terms of service

1. What sandbox is

• A fully-independent deployment of the Adeva Pro Public API at sandbox.adevapro.com.au.
• Stripe runs in test mode. Outbound SMS and email (other than this developer-tooling channel) are disabled.
• Every sandbox tenant is provisioned with a deterministic, fake dataset (5 debtors, 8 debts). None of it is real.
• Data is wiped and reseeded after 7 days of inactivity. API keys persist; data does not.

2. No service level

• No availability target. We may take sandbox offline at any time, including indefinitely, with no notice.
• No performance target. Rate limits, response times, and quotas can change without warning.
• No backward-compatibility commitment. Endpoints, response shapes, error codes, and event payloads may change at any time as we iterate.
• Support is best-effort. We don't operate an incident process for sandbox.

3. We reserve the right to revoke without notice

We may, at our sole discretion and without prior notice or right of cure:

• Revoke any or all of your ak_test_… keys.
• Suspend, lock, or delete your sandbox tenant.
• Block your account, IP address, IP range, ASN, or referring domain.
• Refuse any new sign-up linked to an account we have previously revoked.
• Lower, raise, or eliminate any rate limit applied to your tenant.
• Disable any webhook receiver if its target host repeatedly errors, exceeds latency budgets, or appears to be probing us.

We have no obligation to explain the reason. We will generally log enough that X-Request-Id traces back to the reason, and we'll share it on good-faith request — but that's a courtesy, not an obligation.

4. Acceptable use

• Building, debugging, and smoke-testing integrations with the Adeva Pro Public API.
• Demonstrating Adeva Pro to your stakeholders using the seeded fake data.
• Running automated test suites that exercise the API surface in isolation.
• Generating client SDKs from the OpenAPI document.

5. Prohibited use

You must not, and must not attempt to:

• Use real customer data. Sandbox is a shared system. Don't load anyone's name, email, phone, address, ID number, or financial details into it. If you need a customer to test against, fabricate one or use the seeded personas.
• Conduct load or stress testing without prior written approval. Coordinate with engineering@adevapro.com.au first — we'll either OK a window or stand you up an isolated instance.
• Probe infrastructure outside the documented API surface. No port-scans, no fingerprinting, no attempting to enumerate other tenants, no scraping unauthenticated pages at volume.
• Use the sandbox as a transport or relay for unrelated traffic, including chained-API workflows that put unrelated services in front of our receiver, crypto-mining, scraping pipelines, or anything that turns us into your infrastructure.
• Share, embed, or commit ak_test_… secrets publicly. If we find one of your keys in a public repo, paste site, npm package, mobile app bundle, or browser console, we may revoke every key under your tenant and notify the publisher.
• Reverse-engineer, decompile, or otherwise attempt to derive non-public Adeva implementation details. The OpenAPI doc is the contract; everything else is incidental.
• Bypass, disable, or interfere with rate limiting, idempotency enforcement, webhook signing, or any other security mechanism — including by rotating between multiple sandbox tenants to multiply quota.
• Violate any law applicable to you, us, or the people whose data you place in the sandbox.

6. Data you put in the sandbox

• Treat sandbox as public to other Adeva engineers. We may inspect any payload, log line, or stored row to diagnose abuse, debug issues, or improve the platform. Don't store secrets, credentials, or anything you wouldn't email us directly.
• We may delete your sandbox data at any time — including before the 7-day reset window — without notice and without a backup.
• If you accidentally upload real personal information, contact engineering@adevapro.com.au immediately and we will assist with deletion as a courtesy. This courtesy does not constitute a data-processor relationship.

7. Webhooks

• We may disable your configured webhook URL at any time if it repeatedly fails, times out, returns invalid TLS, or appears to be a relay.
• We retry failed deliveries on the documented 1m / 5m / 30m / 2h / 12h / 24h schedule, then drop. We don't replay older events on request.
• We do not deliver to private network ranges or IP addresses; only routable public hosts.

8. No payment, no refund

Sandbox is free. It will remain free as long as we feel like keeping it free. There is no refund mechanism because there is nothing to refund. Free does not entitle you to anything beyond what's written here.

9. Indemnity

You indemnify, defend, and hold Adeva Pro and its affiliates harmless from any claim arising out of: (a) your use of the sandbox in breach of these terms; (b) data you placed in the sandbox; (c) anything you built using sandbox output that you then deployed elsewhere; or (d) your interaction with third parties using credentials you minted here.

10. Termination

You may stop using sandbox at any time by ceasing all calls and (optionally) deleting your tenant from the dashboard. We may terminate your sandbox access at any time under §3. On termination, your tenant, keys, and data are deleted. We retain audit logs for as long as is reasonable to defend against claims.

11. Changes to these terms

We may update these terms by replacing this page. Continued use of the sandbox after a change constitutes acceptance. We will not notify you individually of changes; this is sandbox.

12. Governing law

These terms are governed by the laws of New South Wales, Australia, and any dispute will be heard in the courts of Sydney. To the extent permitted by law, any claim must be brought within 6 months of the act giving rise to the claim or it is waived.

13. Contact

Questions, abuse reports, coordinated load-testing requests: engineering@adevapro.com.au. For the full Adeva Pro commercial agreement, see adevapro.com.au/terms-of-service.

Privacy policy applies to both surfaces and lives at www.adevapro.com.au/privacy. General Adeva Pro terms at www.adevapro.com.au/terms-of-service.