Terms of service

These terms apply to every contract for OnSanctions. By creating an account, calling the API or buying quick checks, you accept them. If you accept for an organization, you confirm that you are authorized to bind it.

Your own general terms of business don't apply, even if we don't object to them, unless we agree to them in writing. A separate order form or agreement signed by both parties takes precedence over these terms where they conflict.

OnSanctions screens people and companies against sanctions lists, politically exposed person (PEP) data and other watchlists. Through the API you enroll a subject with its first screen, rescreen it by sending it again, and withdraw it when the relationship ends. Quick check screens one name once, without enrollment. The lists we cover and how often they refresh are on the coverage page.

Screening data comes from public authorities and third-party providers. We don't create or verify it, and its publishers can change, delay or withdraw it.

A screen is a point-in-time comparison against the dataset version shown on the response. A clear result means no possible match in those categories and that version. It is not a clearance, legal advice or a decision about a person. You review possible matches and decide what to do.

OnSanctions is a screening layer. It is not transaction monitoring, enhanced due diligence, adverse media screening or a complete compliance program, and it doesn't replace your own risk assessment.

Accounts are for businesses and professionals using OnSanctions for their work. You must be at least 18 and give accurate account and billing details, and keep them up to date. We may decline a registration without giving reasons.

The account owner can invite developers, who can create API keys. You are responsible for the people you invite and for all activity under your account and keys.

Keep passwords and API keys secret, use a separate key per system, and revoke a key you think is exposed. Live keys can be limited to specific IP addresses.

Test keys return mock results so you can build and test an integration. They are free, have daily limits, and must never be used for a compliance decision.

We provide test keys as they are, without any service level, and may change their limits at any time.

Registration and test keys are free. Plans are priced by the number of subjects you keep enrolled, as published on the pricing page when you subscribe, in the currency you select. Rescreens of an enrolled subject are included; each newly enrolled subject carries a one-time onboarding fee.

Prices exclude VAT, sales tax and similar taxes, which are added where they apply. If you are a business in a country where reverse charge applies, give us your tax ID at checkout.

Payment is by card or another method offered at checkout, processed by Stripe, in advance for each billing period. Monthly and annual plans renew automatically for the same period until cancelled.

We will give at least 30 days' notice of a price change by email. It takes effect at your next renewal, and you can cancel before then.

If a payment fails, or a payment is disputed or reversed, we may pause live API access after telling you, until it is resolved. Paid fees are not refundable except as these terms or the law require.

Quick checks are bought once, in packs, and are not a subscription. A pack is valid for one year from purchase, in the browser it was bought in and, if you were signed in, for your organization. Checks not used in that year expire.

A check that fails to complete is returned to your pack. Organizations on a paid plan also have 30 included checks a day.

If you buy as a consumer in the European Union or the United Kingdom, you can cancel within 14 days of purchase and get a refund for the checks you haven't used. By running a check, you ask us to provide it straight away and accept that the right to cancel ends for that check. To cancel, email hello@onsanctions.com with your receipt. This doesn't affect other rights you have under consumer law.

We own OnSanctions and its software. Our data providers and the publishing authorities keep their rights in the underlying lists.

While your contract runs, you may use screening results for your own compliance, risk and legal work, and show them to your staff, auditors and regulators. You may show a result to your own customer about that customer.

You must not:

• resell, sublicense or redistribute results or list data as a data product or screening service;
• scrape, bulk-query or otherwise try to extract or rebuild the underlying lists;
• make results publicly searchable or use them for marketing, profiling or unsolicited contact;
• use the service to build or benchmark a competing product;
• bypass rate limits, key restrictions or other technical limits.

You keep all rights to the data you send us, and we use it only to provide the service, as described in the DPA.

Before you rely on OnSanctions, check that its coverage, matching and frequency fit your regulatory obligations and risk appetite.

You are responsible for your integration, your systems and your internet connection, and for reviewing possible matches. Follow the API documentation, including idempotency keys and webhook signature checks.

Screen only people and companies you have a lawful reason to screen, give any notice the law requires, and comply with the acceptable use policy.

Report a fault promptly to hello@onsanctions.com, with the request ID and enough detail for us to reproduce it.

Support is by email at hello@onsanctions.com, in English, on South African business days from 09:00 to 17:00 (SAST, UTC+2). Security reports go to security@onsanctions.com at any time.

We aim to respond to a report that the live API is unavailable or returning errors for all requests within four business hours, and to other questions within two business days. These are targets, not guarantees, unless an order form sets a support level.

We aim for 99.9% availability of the live API in each calendar month, excluding planned maintenance and events outside our reasonable control. This is a target, not a guarantee, and no service credits apply unless an order form provides them.

Where we can, we announce planned maintenance that may interrupt the API for more than 30 minutes at least 48 hours ahead, by email to account owners.

We may improve or change features. We will tell account owners at least 30 days before a change that materially reduces the service or breaks a documented API behavior, unless a law, a data provider or a security issue requires faster action.

Each party keeps the other's non-public business, technical and security information confidential, uses it only for this contract, and protects it with reasonable care. This continues for three years after the contract ends, and for trade secrets for as long as they stay secret.

This doesn't cover information that is public, already known, independently developed, or that the law requires to be disclosed.

Our privacy policy explains how we handle personal data as a controller. For screening data you send through the API, you are the controller and we are your processor under the data processing agreement.

Send only the fields the API asks for. Don't send special categories of personal data, such as health, religion or biometric data, or data about criminal convictions.

Your account runs until you or we end it. You can close it at any time. A paid plan runs for its billing period and renews until cancelled; when you cancel in the billing portal, it stays active until the end of the period you paid for.

We may end an account without a paid plan on 30 days' notice. We may end or suspend any account immediately for a serious breach of these terms or the acceptable use policy, for non-payment that continues 14 days after a reminder, or where the law or a sanctions obligation requires it.

When the account ends, API keys stop working, and we delete account data within 30 days, as described in the privacy policy and the DPA. Sections that by their nature should survive, such as confidentiality, liability and governing law, continue.

If you are a bank, payment or e-money institution, investment firm, insurer or other regulated financial entity, your regulator may require specific contract terms for ICT and outsourcing arrangements, such as under the EU Digital Operational Resilience Act (DORA) or the EBA outsourcing guidelines.

On request, we will agree a written addendum covering access and audit rights for you and your regulator, incident notification, subcontracting, business continuity and exit assistance. Email hello@onsanctions.com.

We will provide the service with reasonable skill and care, and in line with the laws that apply to us.

We don't warrant that list data is complete, accurate or current, that every possible match will be found, or that the service will be uninterrupted or error-free. To the extent the law allows, all other warranties, including fitness for a particular purpose, are excluded.

To the extent the law allows, neither party is liable for indirect or consequential loss, or for lost profits, revenue, goodwill or data.

Our total liability for all claims in any 12-month period is limited to the fees you paid us in the 12 months before the event that gave rise to the claim. For free accounts and test keys, it is limited to USD 100.

Nothing in these terms limits liability for death or personal injury caused by negligence, fraud, gross negligence, wilful misconduct, or anything else that can't be limited by law.

You will cover our reasonable losses and costs from third-party claims that arise from your screening people without a lawful basis, from data you sent us unlawfully, or from your breach of the acceptable use policy.

Neither party is liable for a delay or failure caused by events outside its reasonable control, such as a failure of a public data source, a hosting or network outage, or an act of government. Payment obligations are not suspended.

We may change these terms for a valid reason, such as a change in law, in our data providers' terms or in the service. We will email account owners at least 30 days before a material change takes effect, and publish the new version here.

If you object, you can end your plan before the change takes effect and get a refund of prepaid fees for the unused period. If you keep using OnSanctions after that date, the new terms apply.

These terms are governed by the law of the Republic of South Africa, and the courts of South Africa have jurisdiction. If you are a consumer, you keep the protection of the mandatory laws of the country where you live and can bring a claim there.

These terms, with the documents they refer to and any order form, are the whole agreement about OnSanctions. Notices to us go to hello@onsanctions.com; notices to you go to the account owner's email.

If a provision is invalid, the rest stays in force, and the invalid provision is replaced by a valid one that comes closest to its purpose. Neither party may transfer the contract without the other's consent, except to a successor of its business.