# Get Started ## Definitions Term | Condition ---------|---------- **API** | Application Programming interface. A set of definitions, protocols, and tools that can be used to create applications, interact with other applications, and exchange data. **ASPSP** | Account Servicing Payment Service Provider. Payment service provider providing and maintaining a payment account for a payer. **AISP** | Account Information Service Provider. Provides account information services as an online service with consolidated information on one or more payment accounts held by a payment service user with one or more payment service provider(s). **eIDAS** | Electronic Identification, Authentication and trust Services. A set of standards for electronic identification and trust services for electronic transactions in the European Single Market. **Provider** | Represents the ASPSP. A bank or financial institution that offer payment accounts with online access. **PSD2** | The Second Revised Payment Services Directive. The directive of the European Parliament and of the Council of the European Union which requires ﬁnancial institutions within the European Economic Area to provide access to their customers' accounts (XS2A), to Third Party Providers to provide account information and payment initiation services. **PSU** | Payment Service User. Natural or legal person making use of a payment service as a payee, payer or both. **PISP** | Payment Initiation Service Provider. Provides an online service to initiate a payment order at the request of the payment service user with respect to a payment account held at another payment service provider. **PIISP** | Payment Issuer Instrument Service Provider. Provides information about the funds availability of payment transactions based on the payment cards. The related services supplied can be identified as CAF/FCS (Confirmation on the Availability of Funds Service). **QSEAL** | Qualified Electronic Seal Certificate is a qualified digital certificate under the trust services defined in the eIDAS Regulation. **QWAC** | Qualified Certificate for Website Authentication - Used for two purposes: the verification of the parties, and their secure communications using Transport Layer Security Encryption. **SCA** | Strong Customer Authentication. Authentication based on the use of two or more elements designed in such a way as to protect the confidentiality of the authentication data. **TPP** | An entity authorised to access accounts on behalf of customers but that does not operate those accounts themselves. TPPs include PISPs, AISPs, and PIISPs. **XS2A** | Access to Account. The provision of secure access to accounts operated by ASPSPs using APIs. ### Scopes Definition Type | Description ---------|---------- **accounts** | grants TPP access to Customer's accounts data **transactions** | grants TPP access to transactions which belong to Customer's account **balances** | grants TPP access to Customer's balances data ## Registration Endpoint Endpoint | Verb | Purpose ---------|----------|---------- /api/v1/tpps | **POST** | Used for registration in Salt Edge PSD2 Compliance Dashboard. After registration, you will receive a letter of confirmation on your representative email. ## API Endpoints Endpoint | Verb | Purpose ---------|----------|---------- /api/v1/oauth/tokens | **POST** | Generate access and refresh tokens. /api/v1/consents | **POST** | This method creates a consent resource, defining access rights to dedicated accounts of a given `PSU-ID`. These accounts are addressed explicitly in the method as parameters as a core function. /api/v1/consents/{consent_id} | **GET** | Returns the content of an account information consent object. This returns the data for the TPP especially in cases, where the consent was directly managed between ASPSP and PSU e.g. in a redirect SCA Approach. /api/v1/consents/{consent_id}/status | **GET** | Read the status of an account information consent resource. /api/v1/consents/{consent_id} | **DELETE** | This method deletes a consent. /api/v1/accounts | **GET** | Read the identifiers of the available payment account together with booking balance information, depending on the consent granted. It is assumed that a consent of the PSU to this access is already given and stored on the ASPSP system. The addressed list of accounts depends on the PSU ID and the stored consent addressed by consentId. Returns all identifiers of the accounts, to which an account access has been granted to through the `/consents` endpoint by the PSU. In addition, relevant information about the accounts and hyperlinks to corresponding account information resources are provided if a related consent has been already granted. **Remark**: Note that the `/consents` endpoint optionally offers to grant an access on all available payment accounts of a PSU. In this case, this endpoint will deliver the information about all available payment accounts of the PSU at this ASPSP. /api/v1/refresh/consents/{consent_id} | **PUT** | This endpoint is responsible for starting the process of refreshing account information data on Bit PSD2 side. Due to asynchronous nature of this action, TPP has to poll the status of this process untill receive the status failed or finished /api/v1/refresh/consents/{consent_id} | **GET** | This endpoint is responsible for returning the current status of fetching account information process. /api/v1/accounts/{account_id} | **GET** | Reads details about an account, with balances where required. It is assumed that a consent of the PSU to this access is already given and stored on the ASPSP system. The addressed details of this account depends on the stored consent addressed by `consentId`. /api/v1/accounts/{account_id}/transactions | **GET** | Read transaction reports or transaction lists of a given account addressed by `account_id`, depending on the steering parameter `bookingStatus` together with balances. /api/v1/accounts/{account_id}/transactions/{transaction_id} | **GET** | Reads transaction data from a given account and transaction addressed by `account_id` and `transaction_id`. /api/v1/accounts/{account_id}/balances | **GET** | Reads account data from a given account addressed by `account_id`. ## All Errors During any request or flow originating either on TPP or Salt Edge PSD2 Compliance side, a number of errors may appear. In order to standardize errors while still giving some degree of freedom in explaining an error callback, parameters should include both `error_text` and `error_code`. Error message serves the purpose of communicating the issue to the Customer, whereas error class should be used by TPPs in order to be able to handle various scenarios. Contents of the error_code are entirely up to the Provider, they may even be localized. However, values sent within `error_text` parameter should be from the standardized list. This list may and will be extended over time. Class | Code | Description ---------|----------|---------- **FormatError** | 400 | Invalid input. More info in `error_message`. **DigestInvalid** | 400 | Header 'Digest' invalid. **SignatureInvalid** | 400 | Given signature is invalid. **SignatureMissing** | 400 | This request cannot be performed without Signature header. **SignatureMalformed** | 400 | Given signature is malformed. **CertificateInvalid** | 401 | Given certificate is invalid. **ConsentStatusForbidden** | 403 | Consent is not valid. **AccessDenied** | 403 | The resource owner or authorization server denied the request. **TppNotFound** | 404 | Requested TPP cannot be found. **ConsentNotFound** | 404 | Requested consent cannot be found. **AccountNotFound** | 404 | Requested account cannot be found. **TransactionNotFound** | 404 | Requested transaction cannot be found. **RouteNotFound** | 404 | Requested url does not exist. ## Useful Links and Contact Information You can find below the following useful links and assistance channel: 1. You can find the full documentation for the [BOI NextGenPSD2 Implementation Guidelines](https://www.boi.org.il/roles/supervisionregulation/bank-sup/open-banking/) on the official BOI website. 2. In case you have any questions on integration with this dedicated interface please contact us at: compliance@saltedge.com or use the Help Desk from TPP Dashboard. ## Account Information Flow 1. Request consent from the Bank BIT account's owner to share with you information on one or more of their accounts. 2. **Customer Authentication and Customer consent approval**: Consent is created once the bank's customer authenticates himself on the Bank BIT login page and explicitly approves the consent sent by you to a dedicated screen. Changing the user's password during the customer consent process, is not applicable. **When the customer is authenticated and the consent is approved, you will receive an authorisation code, which must be immediately replaced with an Access Token.** 3. **Retrieve account information**: You can retrieve the bank customer's account data as long as the consent is valid and has not expired, and by providing the valid Access Token. 4. **Consent Renewal**. If the consent has expired or been revoked for any reason, your customer can give you a new consent. ## Consent statuses |Description|Berlingroup Status| |---|---| |The consent data have been received and are technically correct.
The data is not authorised yet.|received| |The consent data have been rejected e.g. since no successful
authorisation has taken place.|rejected| |The consent is accepted and valid for GET account data calls
and others as specified in the consent object.|valid| |The consent expired.| expired | |The consent has been revoked by the PSU towards the ASPSP.| revokedByPsu | |The corresponding TPP has terminated the consent by
applying the DELETE method to the consent resource.| terminatedByTpp| |The consent has been suspended by the ASPSP, according
to requirements that are detailed in BoI's directive.| suspendedByASPSP | ## Payment statuses |Description|Berlingroup Status| |---|---| |Payment initiation or individual transaction included in the payment
initiationis pending. Further checks and status update will be performed.|PDNG| |All preceding checks such as technical validation andcustomer profile
were successful and therefore the payment initiation has been accepted
for execution.|ACSP| |Settlement on the debtor’s account has been completed.|ACSC| |Payment initiation has been received by the receiving agent.|RCVD| |Payment initiation or individual transaction included in the payment initiation has been rejected.| RJCT | |Beneficiary did not respond. Ordered expired within 3 days payment
initiation hasbeen rejected.| EXPD | |Payment initiation has been cancelled before execution.| CANC | # Authorization Security ## OAuth2 URLs URL | Description ---------|---------- `https://www.bitpay.co.il/app/open-banking` | Authorization URL `https://open-banking.bitpay.co.il/api/v1/oauth/token` | Token URL `https://open-banking.bitpay.co.il/api/v1/oauth/token` | Token Refresh URL > In accordance with the relevant RFCs, the token and token revocation URLs will only accept a content type of `application/x-www-form-urlencoded`. JSON content is not permitted and will return an error. ## OAuth2 Scopes Name | Description ---------|---------- `AIS:{consentId}` | Allows to consume the resources referenced to Consent with specified `Id` `PIS:{paymentId}` | Allows to consume the resources referenced to Payment with specified `Id` ## State and Security Before we dive into the semantics of the different OAuth2 grants, we should stop and discuss security, specifically the use of the state parameter. Cross-site request forgery, or CSRF, and Clickjacking are security vulnerabilities that must be addressed by individuals implementing OAuth. This is typically accomplished using the state parameter. state is sent in the authorization request and returned back in the response and should be a value that binds the user's request to their authenticated state. For example, state could be a hash of the user's session cookie, or some other nonce that can be linked to the user's session. When a user begins an authorization flow on the client, a state is generated that is unique to that user's request. This value is stored somewhere only accessible to the client and the user, i.e. protected by the same-origin policy. When the user is redirected, the state parameter is returned. The client validates the request by checking that the state returned matches the stored value. If they match, it is a valid authorization request. If they do not match, it's possible that someone intercepted the request or otherwise falsely authorized themselves to another user's resources, and the request should be denied. ## Authorization Code Grant The authorization code grant is what most developers will recognize as "standard OAuth2" and involves retrieving an access code and exchanging it for a user's access token. It allows the authorization server to act as an intermediary between the client and the resource owner, so the resource owner's credentials are never shared directly with the client. ## PKCE PKCE modifies the standard authorization code grant. Before starting the authorization code grant, a random string called `code_verifier` is generated using the characters: `[A-Z], [a-z], [0-9], "-", ".", "_"` and `"~"`, with a minimum length of 43 characters and a maximum length of 128 characters. Additionally to the `code_verifier` a `code_challenge` is created. We supports `code_challenge_method` `S256` the code_challenge is the SHA256 Hash value of the code_verifier url safe base64 encoded (without trailing "=" compare to: [https://tools.ietf.org/html/rfc7636#appendix-A](https://tools.ietf.org/html/rfc7636#appendix-A)) ## Authorization URL Example ``` https://www.bitpay.co.il/app/open-banking?response_type=code&client_id=org-identifier-123456&scope=AIS:2345&state=15773059ghq9183habn&redirect_uri=https%3A%2F%2Ftpp.website&code_challenge=XEuwH6eFPlLDoVB7vL3KpC6T3WYaEGDyXGb7tpNJCZA&code_challenge_method=S256 ``` `client_id` is TPP's organization identifier.`scope` is a scope specified in [OAuth2 Scopes](#section/Authorization-Security/OAuth2-Scopes). `redirect_uri` is whatever URL you registered when creating your application, url-encoded. `state` is the unique string mentioned in [State and Security](#section/Authorization-Security/State-and-Security). `code_challenge` and `code_challenge_method` described in [PKCE](#section/Authorization-Security/PKCE) ## Redirect URL Example ``` https://tpp.website/?code=NhhvTDYsFcdgNLnnLijcl7Ku7bEEeee&state=15773059ghq9183habn ``` `code` is now exchanged for the user's access token by making a POST request to the [Token URL](#tag/OAuth2/operation/post-api-oauth-tokens) ## Signature Headers #### Instruction to create BerlinGroup Signature To register as a TPP, the first thing you must do is get a valid EIDAS certificate.
The required headers for this call are: - `X-Request-ID`: [A Universally Unique IDentifier (UUID) URN Namespace](https://datatracker.ietf.org/doc/html/rfc4122) - example: `79c851ce-f543-4c27-a8e4-f9aad20724ba` - `Digest`: Base64 request body encoded SHA256 - Example: ```bash > export BODY="{}" > echo -n $BODY | openssl sha256 -binary | base64 RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o= # Digest value: "SHA-256=RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o=" ``` - `Date`: [Date/Time Format](https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.1.1) - Example: `Fri, 04 Feb 2022 17:16:59 GMT` - `TPP-Signature-Certificate`: Base64 strict encoded certificate in PEM format. - Example: ```bash > export PEM="-----BEGIN CERTIFICATE-----\nMB0wFgIBADAAMAAwBB8AHwAwADAFMAADAQAwAAMBAA==\n-----END CERTIFICATE-----\n" > echo -n $PEM | base64 LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1CMHdGZ0lCQURBQU1BQXdCQjhBSHdBd0FEQUZNQUFEQVFBd0FBTUJBQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K ``` - `Signature`: Is the signed value of the message, and has the following regexp structure: ```bash /keyId=\"SN=(?.+),CA=(?.+)\",algorithm=\"(?.+)\",headers=\"(?.+)\",signature=\"(?.+)\"/ ``` - `keyId` that must be formatted as `SN={serial},CA={issuer}` - `algorithm` could be (`"rsa-sha-256"` or `"rsa-sha-512"`) - `headers`.
Create a string to be using a set of request headers: `date`, `digest`, `x-request-id`, `psu-id`, `psu-corporate-id` and `tpp-redirect-uri` in this example, we will just use the mandatory ones: `x-request-id`, `digest` and `date`, the final result will be: `"x-request-id digest date"` - `signature`
Create a string to be signed built using a set of request headers: `date`, `digest`, `x-request-id`, `psu-id`, `psu-corporate-id` and `tpp-redirect-uri` in this example, we will just use the mandatory ones: `x-request-id`, `digest` and `date`, the final result will be: `"digest date x-request-id"`.
Here the order of these fields in the signing string matters and they need to be on separate lines. The order has to be exactly as in `headers`.
You should generate a signature value that must be base-64 encoded: ```bash # // order as in 'headers' ("x-request-id digest date") > export SIGNING_STRING="x-request-id: 79c851ce-f543-4c27-a8e4-f9aad20724ba\ndigest: SHA-256=RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o=\ndate: Fri, 04 Feb 2022 17:16:59 GMT" > printf $SIGNING_STRING | openssl dgst -sha256 -sign certificate_private_key.pem | openssl base64 -A XWyngnV7vT9ALgfBdTP5JYJumS3m5hxZa8ryx96XdJ3h6xGrrKMQg2u86qf8+YtVCZj/XpTq+POKOGFkdNQpxTrMeicP0pQKQ2S2ny/0DpFokC6QcXzyj25nazicIYmTqMBQKoNL9DvMtcWG4xTdxVsFLU51xhrqD0Bi4l4NmX73fq4J7VLjYDfiYCldaoSlu3K/p5QOOxzORGWDidRoOvpsELFleppu4Btt8CjPff6QM9oDRFmaOoxbnwBkFu0om7pLEmk5OUD711d9LGnFp65MaljEitpZfYbkNjSCJMsbyfRiYuSpwN34O7sZwzSiRYV9j72BN2C66tXxL0UZAg== ``` - As result the signature value should be as: ```json "Signature": keyId="SN=B83852160,CA=FIRMA PROFESIONAL",algorithm="rsa-sha-256",headers="x-request-id digest date",signature="XWyngnV7vT9ALgfBdTP5JYJumS3m5hxZa8ryx96XdJ3h6xGrrKMQg2u86qf8+YtVCZj/XpTq+POKOGFkdNQpxTrMeicP0pQKQ2S2ny/0DpFokC6QcXzyj25nazicIYmTqMBQKoNL9DvMtcWG4xTdxVsFLU51xhrqD0Bi4l4NmX73fq4J7VLjYDfiYCldaoSlu3K/p5QOOxzORGWDidRoOvpsELFleppu4Btt8CjPff6QM9oDRFmaOoxbnwBkFu0om7pLEmk5OUD711d9LGnFp65MaljEitpZfYbkNjSCJMsbyfRiYuSpwN34O7sZwzSiRYV9j72BN2C66tXxL0UZAg==" ``` **The signed request should be as:** ```http POST /api/berlingroup/v1/tpp/certificates HTTP/1.1 Host: priora.saltedge.com Content-Type: application/json Date: Fri, 04 Feb 2022 17:16:59 GMT Digest: SHA-256=RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o= X-Request-ID: 79c851ce-f543-4c27-a8e4-f9aad20724ba Signature: keyId="SN=B83852160,CA=FIRMA PROFESIONAL",algorithm="rsa-sha-256",headers="x-request-id digest date",signature="XWyngnV7vT9ALgfBdTP5JYJumS3m5hxZa8ryx96XdJ3h6xGrrKMQg2u86qf8+YtVCZj/XpTq+POKOGFkdNQpxTrMeicP0pQKQ2S2ny/0DpFokC6QcXzyj25nazicIYmTqMBQKoNL9DvMtcWG4xTdxVsFLU51xhrqD0Bi4l4NmX73fq4J7VLjYDfiYCldaoSlu3K/p5QOOxzORGWDidRoOvpsELFleppu4Btt8CjPff6QM9oDRFmaOoxbnwBkFu0om7pLEmk5OUD711d9LGnFp65MaljEitpZfYbkNjSCJMsbyfRiYuSpwN34O7sZwzSiRYV9j72BN2C66tXxL0UZAg==" TPP-Signature-Certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1CMHdGZ0lCQURBQU1BQXdCQjhBSHdBd0FEQUZNQUFEQVFBd0FBTUJBQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K {} ``` # Legal information ## Term of use Welcome to Bit Developers Portal by Bank Hapoalim (together with its subdomains, Content, Marks, Documentation and services, the **“Site”**). Please read the following Terms of Use carefully before using this Site so that you are aware of your legal rights and obligations with respect to Bit (**"Bit"**, **"we"**, **"our"** or **"us"**). By accessing or using the Site, you expressly acknowledge and agree that you are entering into a legal agreement with us and have understood and agreed to comply with, and be legally bound by, these Terms of Use, together with the Privacy Policy (the "Terms"). You hereby waive any applicable rights to require an original (non-electronic) signature or delivery or retention of non-electronic records, to the extent not prohibited under applicable law. If you do not agree to be bound by these Terms, please do not access or use the Site. 1. **The Site**. The Site is intended to allow its registered users access to BIT's Developers Portal (the "Portal") and to the documentation and materials with respect to BIT's various products, as may be provided from time to time (the "Documentation" and "Bank Products") as well as enabling registered users that are authorized representatives of an established company, to perform certain activities in the Portal, as may be applicable from time to time and subject to the terms set forth in these Terms. 2. **Additional Agreements and Approval**. For clarification, access and use of certain parts and/or services provided by the Bank with respect to Company's use of the Portal and the API Market, shall be subject to additional approvals and agreements to be provided by the Bank. The Bank retains sole and exclusive discretion to determine whether to approve an application submitted by a user, or to engage in an agreement with a company pursuant to these Terms. Without derogating from the generality of the above, Company's use of the API shall be subject to the terms of the License and Services Agreement to be executed between the Company and the Bank in this respect (**"License Agreement"**). 3. **Modification**. We reserve the right, at our discretion, to change these Terms at any time. Such change will be effective ten (10) days following posting of the revised Terms on the Site, and your continued use of the Site thereafter means that you accept those changes. 4. **Site Access**. For such time as these Terms are in effect, we hereby grant you permission to visit and use the Site provided that you comply with these Terms and applicable law. 5. **The Services** a. Documentation. The Site allows its registered users to view the Documentation on the Site and to experience the mockup provided on the Site. In order to use these services, you are required to create an account (**"Account"**). You agree not to create an Account for anyone else or use the account of another without their permission. When creating your Account, you must provide accurate and complete information. You are solely responsible for the activity that occurs in your Account, and you must keep your Account password secure. You must notify BIT immediately of any breach of security or unauthorized use of your Account. If you wish to delete your Account, you may send an email request at compliance@saltedge.com b. API Market Services. The Site also allows its users, representing a legal established entity ("Corporation"), to perform certain activities in the API Market on behalf of such Corporation. The scope and ability to perform such activities are conditioned on receiving our initial approval to the identity of the Corporation, as well as to additional requirements set forth in the License Agreement, as well as additional legal restrictions that may apply with respect to certain services from time to time. c. Availability. We strive to maintain the Portal's availability and performance in accordance with the service levels detailed in our Service Level Agreement (SLA) available at Appendix A. While we employ commercially reasonable efforts to meet these service levels, you acknowledge that the Portal's performance may vary, and occasional disruptions or downtime may occur. The service levels specified in the SLA represent our operational targets, and any deviation from these targets shall be handled as set forth in the SLA. Your continued use of the Portal constitutes acceptance of these service level terms. We reserve the right to modify the SLA from time to time, with any such modifications becoming effective upon posting to the Portal. 6. **Restrictions**. You shall not: (i) copy, distribute or modify any part of the Site without our prior written authorization; (ii) use, modify, create derivative works of, transfer (by sale, resale, license, sublicense, download or otherwise), reproduce, distribute, display or disclose Content (defined below), except as expressly authorized herein; (iii) disrupt servers or networks connected to the Site; (iv) use or launch any automated system (including without limitation, "robots" and "spiders") to access the Site; and/or (v) circumvent, disable or otherwise interfere with security-related features of the Site or features that prevent or restrict use or copying of any Content or that enforce limitations on use of the Site. 7. **Payments to BIT**. Except as expressly set forth in the Terms, your general right to access and use the Site is currently for free, but BIT may in the future charge a fee for certain access or usage. You will not be charged for any such access or use of the Site unless you first agree to such charges, but please be aware that any failure to pay applicable charges may result in you not having access to some or all of the Site. 8. **Intellectual Property Rights**. a. Content and Marks. The (i) content on the Site, including without limitation, the Documentation, text, articles, brochures, descriptions, products, software, graphics, photos, sounds, videos, interactive features, and services (collectively, "Content"), and (ii) the trademarks, service marks and logos contained therein ("Marks"), are the property of BIT and/or its licensors and may be protected by applicable copyright or other intellectual property laws and treaties. We reserve all rights not expressly granted in and to the Site and the Content. b. Use of Content. The Content on the Site is provided to you for your internal use only and may not be used, modified, copied, distributed, transmitted, broadcast, displayed, sold, licensed, de-compiled, or otherwise exploited for any other purposes whatsoever without our prior written consent. If you download or print a copy of the Content, you must retain all copyright and other proprietary notices contained therein. 9. **Information Description**. We attempt to be as accurate as possible. However, we cannot and do not warrant that the Content available on the Site is accurate, complete, reliable, current, or error-free. We reserve the right to make changes in or to the Content, or any part thereof, in our sole judgment, without the requirement of giving any notice prior to or after making such changes to the Content. Your use of the Content, or any part thereof, is made solely at your own risk and responsibility. 10. **Privacy**. We will use any personal information that we may collect or obtain in connection with your use of the Site in accordance with our privacy policy. The Privacy Policy attached hereto as Appendix B constitutes an integral part of these Terms of Use. Your use of the Website and Services constitutes acceptance of the Privacy Policy and all of its terms. You agree that we may use personal information that you provide or make available to us in accordance with the Privacy Policy. 11. **Copyright Policy**. It is our policy to respect the legitimate rights of copyright and other intellectual property owners. If you have encountered an alleged copyright infringement, please contact us by sending an email to: poalimdevelopersportal@poalim.co.il (**"Copyright Notice"**). 12. **Warranty Disclaimers.** a. HE SITE AND ANY CONTENT PROVIDED THEREUNDER ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, AND WITHOUT WARRANTIES OF ANY KIND EITHER EXPRESS OR IMPLIED. BIT HEREBY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND THOSE ARISING BY STATUTE OR FROM A COURSE OF DEALING OR USAGE OF TRADE. BIT DOES NOT GUARANTEE THAT THE SITE WILL BE FREE OF BUGS, SECURITY BREACHES, OR VIRUS ATTACKS. THE SITE MAY OCCASIONALLY BE UNAVAILABLE FOR ROUTINE MAINTENANCE, UPGRADING, OR OTHER REASONS. YOU AGREE THAT BIT WILL NOT BE HELD RESPONSIBLE FOR ANY CONSEQUENCES TO YOU OR ANY THIRD PARTY THAT MAY RESULT FROM TECHNICAL PROBLEMS OF THE INTERNET, SLOW CONNECTIONS, TRAFFIC CONGESTION OR OVERLOAD OF OUR OR OTHER SERVERS. b. EXCEPT AS EXPRESSLY STATED IN OUR PRIVACY POLICY, BIT DOES NOT MAKE ANY REPRESENTATIONS, WARRANTIES OR CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE SECURITY OF ANY INFORMATION YOU MAY PROVIDE OR ACTIVITIES YOU ENGAGE IN DURING THE COURSE OF YOUR USE OF THE SITE. 13. **Limitation of Liability**. TO THE FULLEST EXTENT PERMISSIBLE BY LAW, BIT SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, EXEMPLARY, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES OF ANY KIND, OR FOR ANY LOSS OF DATA, REVENUE, PROFITS OR REPUTATION, ARISING UNDER THESE TERMS OR OUT OF YOUR USE OF, OR INABILITY TO USE, THE SITE AND ANY CONTENT PROVIDED THEREUNDER, EVEN IF BIT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES AND IN ANY EVENT SHALL BE LIMITED TO $100. 14. **Term and Termination**. These Terms are effective until terminated by BIT or you. BIT, in its sole discretion, has the right to terminate these Terms and/or your access to the Site, or any part thereof, immediately at any time and with or without cause (including, without any limitation, for a breach of these Terms). BIT shall not be liable to you or any third party for termination of the Site, or any part thereof. If you object to any term or condition of these Terms, or any subsequent modifications thereto, or become dissatisfied with the Site in any way, your only recourse is to immediately discontinue use of the Site. Upon termination of these Terms, you shall cease all use of the Site. This Section ‎14 and Sections ‎8 (Intellectual Property Rights), ‎10 (Privacy), ‎12 (Warranty Disclaimers), ‎13 (Limitation of Liability) and ‎15 (Independent Contractors) to ‎17 (General) shall survive termination of these Terms. 15. **Independent Contractors**. You and BIT are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between you and BIT. You must not under any circumstances make, or undertake, any warranties, representations, commitments or obligations on behalf of BIT. 16. **Assignment**. These Terms, and any rights and licenses granted hereunder, may not be transferred or assigned by you but may be assigned by BIT without restriction or notification to you. Any prohibited assignment shall be null and void. 17. **Governing Law**. These Terms and the relationship between you and BIT shall be governed by and construed in accordance with the laws of the State of Israel, without regard to its principles of conflict of laws. Any dispute with respect to these Terms shall be resolved exclusively by the courts of Tel Aviv-Yafo, Israel. 18. **General**. These Terms shall constitute the entire agreement between you and BIT concerning the Site. If any provision of these Terms is deemed invalid by a court of competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of these Terms, which shall remain in full force and effect. No waiver of any term of these Terms shall be deemed a further or continuing waiver of such term or any other term, and a party's failure to assert any right or provision under these Terms shall not constitute a waiver of such right or provision. **Last updated: December 2024** ## Service Level Policy 1. **Support services and inquiry handling** a. The support center for BIT's third-party providers (TPPs) operates from Monday to Friday between 09:00 to 18:00 (‘business hours'), in the support channels detailed in this section. Support is provided during the business hours detailed in this section. Inquiries outside the support channels detailed in this section will not be answered in accordance with the policy detailed in section 5. b. The email address to open a request to the support center is compliance@saltedge.com, or you submit the request directly via TPP Dashboard > Support Center. c. Support services will be provided to third party providers who are active in the Sandbox or Production environment. 2. **Handling of new inquiries from third party providers** a. To make an inquiry, the applicant must provide the following two identifiers: (1) the serial number of the certificate they received from the regulator, and (2) the company number (ח.פ) of the third-party provider. After proper identification, the support center will ask for the contact's name and phone number to record who contacted on behalf of the third-party provider (by phone or email, as the case may be). b. The initial response to an inquiry via email as described in section 4 'Classification of inquiries and their treatment' period following the inquiry as defined in the section 'Support services and inquiry handling'. c. Support services and the handling of inquiries received by email outside of 'business hours' will be handled at the beginning of the next business day, as described in section 'Support services and inquiry handling'. d. The initial response to an inquiry will be sent to the applicant via email and will include the ticket number opened for this inquiry. 3. **Contacting Third Party Providers: Financial Information Service Providers ("Service Providers") or Payment Originators to Report a Serious Security Incident** As defined in section 55a of the “NABAT 368" instruction section 55a. Contact us by email incident@saltedge.com 4. **Classification of inquiries and their treatment** | Inquiry Classification | Definition | Update of Inquiry's Status| |-------------------------|-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------| | 1 | Any malfunction in the system, which, in the bank's opinion, disables or substantially interferes with the open banking activity. | Immediately and once every few hours depending on progress in treating the problem. | | 2 | Any error, defect, disruption including a decrease and/or change in system performance. | Once every two days until an end date is defined for handling the inquiry. | | 3 | A point fault with a limited effect on system users. For example, some system users are unable to log in to establish access authorization. | Once a week until an end date is defined for handling the inquiry. | | 4 | A fault, which has no significant consequences for users of the system. | Once every two weeks until an end date is defined for handling the inquiry. | | 5 | Request for information on how to use the financial information system interface, for basic support, support for the development/integration process, or an inquiry that does not affect production systems. | Up to two weeks. | 5. **System availability, up-to-date of information, and response times** a. **Availability of the system as described below**. - We strive to achieve ninety-nine percent (99%) Uptime per calendar month. We are dedicated to maintaining high service availability and minimizing any disruptions to ensure a reliable experience. - Maintenance and Downtime will be subject to the following conditions: i. Onboarded TPPs will be notified at least seven (7) days prior to any Scheduled Maintenance, stating the expected Downtime. ii. Scheduled Maintenance, generally, will not exceed one (1) consecutive Downtime hour and two (2) cumulative Downtime hours in any given month; and iii. Scheduled Maintenance sessions will be scheduled to be performed only within the Scheduled Maintenance Window(s) - The daily average API response time with respect to AIS APIs will be less than 500 ms, applicable for the asynchronous data flow which is currently implemented. b. **Response times** - Financial information interface response time will be the as describes in section 4 'Classification of inquiries and their treatment'. c. **Up-to-date of information** - The information shared with service providers will be in accordance with what is displayed on the bank's digital channels and as required by the standard. - The information shared in the financial information system interface (as defined in the Financial Information Service Law, 2021) will be at the same level of up-to-date as the bank's digital channels, with at most with a delay of up to 30 seconds compared to the digital channels. In areas where the level of up-to-date is not the same, or there is a delay of more than 30 seconds from digital channel, the relevant time windows will be detailed in the DATA AVAILABILITY area on the developer portal, under each information product. 6. **Shutdowns** a. Notifications regarding planned shutdowns in the financial information system interface or malfunctions in the SANDBOX or production environments, if any, will be published on the main page of the API MARKETPLACE on the developer portal under AVAILABILITY. b. The bank will update the developer portal regarding planned shutdowns in the financial information system interface about four hours before the shutdown. 7. **The bank supports a maximum number of inquiries per second, in a way that will allow optimal service for all service providers, in accordance with the bank's needs in protecting its systems.** BIT reserves the right to update the principles of the policy presented in this document subject to the provisions of the law. It is recommended to check this from time to time. 8. **New releases** For every new major or minor release, all relevant details will be made available to TPPs through the Changelog on the TPP Developer Portal. This will ensure that all updates are clearly communicated and easily accessible by TPPs. In addition, the TPPs who are already integrating the APIs will receive timely email notifications regarding any upcoming changes, giving them ample time to prepare for new features or updates. We remain committed to maintaining transparency and open communication, and our support team is always available to assist with any questions or concerns. We encourage all TPPs to stay engaged and take full advantage of the resources provided to ensure a smooth integration experience and continued success. **Last updated: December 2024** ## Privacy This privacy policy (**“Privacy Policy”**) governs how we, BIT. (**“BIT”**, **“we”**, **“our”** or **“us”**) use Personal Information (defined below) that we collect, receive and store pertaining to you (**“User”**, **“you”**), in connection with the following use cases: 1. When you browse or visit our Developers Portal ("Website") 2. When you make use of, or interact with, our Website and its applicable services ("Services") a. When you sign up for an Account b. When you apply to "create a company" on a behalf of a Corporation c. When you contact us (e.g. customer support, etc.) We greatly respect your privacy, which is why we make every effort to provide a platform that would live up to the highest of user privacy standards. Please read this Privacy Policy carefully, so you can fully understand our practices in relation to Personal Information. This Privacy Policy may be updated from time to time and therefore we ask you to check back periodically for the latest version of the Privacy Policy, as indicated below. If there will be any significant changes made to the use of your Personal Information in a manner different from that stated at the time of collection, we will notify you by posting a notice on our Website or by other means. 1. **INTRODUCTION** We have implemented this Privacy Policy because your privacy, and the privacy of other users, is important to us. This Privacy Policy explains our online information practices and the choices you can make about the way your Personal Information is collected and used in connection with the Services. **“Personal Information”** means any information that may be used, either alone or in combination with other information, to personally identify a living individual, including, but not limited to, a first and last name, a personal profile, an email address, a home or other physical address, or other contact information. 2. **TERMS OF USE** This Privacy Policy forms part of our Terms of Use which is available at [Term and Use](/docs#section/Legal-information/Term-of-use) (**“Terms”**) and the License Agreement. Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Terms or in the License Agreement, as applicable. 3. **CONSENT AND MODIFICATION** By using the Services, you agree to the terms of this Privacy Policy and to our collection, processing and sharing of Personal Information as described herein. If you do not agree to this Privacy Policy, please do not access or otherwise use the Services. We reserve the right, at our sole discretion, to modify this Privacy Policy at any time. Such change will be effective ten (10) days following posting of the revised Privacy Policy on the Website, and such modifications will be effective immediately upon posting on the Website Your continued use of the Services following the posting of any modifications to this Privacy Policy constitutes your acceptance of such modifications and of all terms set forth herein. 4. **WHAT INFORMATION WE COLLECT, WHY WE COLLECT IT, AND HOW IT IS USED** *When you make use of, or interact with our Website* 4.1 *When you sign up for an Account* **Information we collect** - Last name and First Name - Password - Email - Cell Phone Number **Why is the Information collected and for what purposes?** - Creating an Account - Using the Documentation services provided on the Website **Third parties with whom we share your Information NONE** 4.2 *When you apply to "create a company" on a behalf of a Corporation* **Information we collect** - Corporation name - Additional information establishing you are an authorized representative of the Corporation **Why is the Information collected and for what purposes?** - In order to process your request - Creating a company to use the API Services **Third parties with whom we share your Information NONE** 4.3 *When you send us a "Contact us" request* **Information we collect** - First name - Last name - Email - Phone Number **Why is the Information collected and for what purposes?** - Reply to your "contact us" request **Third parties with whom we share your Information NONE** Finally, please note that some of the abovementioned Personal Information will be used for fraud detection and prevention, and for security purposes. 5. **HOW WE PROTECT AND STORE YOUR INFORMATION** a. Security. We have implemented appropriate technical, organizational and security measures designed to reduce the risk of accidental destruction or loss, or unauthorized disclosure or access to such information appropriate to the nature of the information concerned. While we strive to use commercially reasonable security measures, please note that we cannot guarantee that the information will not be exposed as a result of unauthorized penetration to our servers, and we make no warranties or representations regarding absolute security of any information. We make commercially reasonable efforts to ensure the collection and security of such information is consistent with this Privacy Policy and all applicable laws and regulations. The security of your information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect your devices, access credentials and this information. b. Retention of your Personal Information. We retain Personal Information for as long as needed to fulfill the purposes outlined in this Privacy Policy, including but not limited to our legitimate business interests, legal and regulatory obligations, tax or accounting requirements, maintaining accurate records of your dealings with us, addressing potential complaints or challenges, resolving disputes, and/or where we reasonably believe or anticipate the possibility of litigation relating to your Personal Information or dealings. The specific retention period may vary depending on the type of Personal Information, applicable legal requirements, and our ongoing business needs. 6. **ADDITIONAL INFORMATION ON HOW WE SHARE YOUR PERSONAL INFORMATION AND HOW WE USE IT** We may share and use your information as follows: - To the extent necessary, with regulators, to comply with all applicable laws, regulations and rules, and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order; - If, in the future, we sell or transfer some or all of our business or assets to a third party, we will (to the minimum extent required) disclose information to a potential or actual third party purchaser of our business or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events; - Where you have provided your consent to us sharing the Personal Information (e.g., where you opt-in to optional additional Services or functionality); - Where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any Personal Information is disclosed; - We will use your Personal Information to provide and improve our Website and Services, to send you marketing/advertisement communications that we believe may be of interest to you, to contact you in connection with the Website and Services, and to identify and authenticate your access to the parts of the Website that you are authorized to access; - We may use your designated email address to send you updates or news regarding the Website, Services and products; - We may share your Personal Information with our third party service providers partners, and other trusted entities to facilitate and improve our business operations, provide and enhance our Website and Services to you and other users. Such information may be transferred to and processed in other countries where these third parties operate. By using our Services, you acknowledge and consent to such international transfers.; and - We may disclose your Personal Information or any information you submitted via the Website if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce our Terms, including investigations of potential violations thereof; (iii) detect, prevent, or otherwise address fraud or security issues; or (iv) protect against harm to the rights, property or safety of BIT, our users, yourself or the public. 7. **USE BY CHILDREN** We do not offer the Services for use by children. If you are under 18, you may not use the Website, or provide any information to the Website. We do not knowingly collect information from, and/or about children. 8. **HOW CAN I DELETE MY ACCOUNT?** Should you ever decide to delete your Account, you may do so by emailing compliance@saltedge.com or poalimdevelopersportal@poalim.co.il . If you terminate your Account, any association between your Account and information we store will no longer be accessible through your Account. If you request deletion of your Account, we may retain certain information as necessary for our legitimate business interests, to comply with legal obligations, prevent fraud, or enforce our agreements. 9. **ACCESS/ACCURACY** To the extent that you do provide us with Personal Information, we wish to maintain accurate Personal Information. If you would like to delete or correct any of your other Personal Information that we may be storing, you may submit an access request by sending an email to poalimdevelopersportal@poalim.co.il Your email should include adequate details of your request. 10. **CONTACT US** If you have any questions, concerns or complaints regarding our compliance with this notice and the Information protection laws, or if you wish to exercise your rights, we encourage you to first contact us via this email address compliance@saltedge.com. **Last updated: December 2024**