Veyn Connect · draft v0.1
Governance
The rules that sit in Veyn's code, not in a manifest. A connector cannot relax them.
Draft. Under review. Fees, developer verification, review times and a public registry are still open.
Trust tiers
| Tier | Launch | Who | Can declare | Limits |
|---|---|---|---|---|
| T0 Sandbox | yes | Any developer, unverified | link or web, prepare only, in your own test account | Visible only to you and invited testers. No real users. 25 calls a day. |
| T1 Listed | yes | A verified person or company (identity and domain proof) | link or web, prepare only | Public registry; the user turns it on. Low and medium scopes only. One call per user every 10 seconds. |
| T2 Verified | later | T1 plus a security questionnaire, privacy review and 30 days clean | Adds api and intent modes, and execute for non-money actions | Confirmation on every call. |
| T3 Partner | later | T2 plus a signed agreement and endpoint review | Adds money-adjacent actions | Yearly re-review. |
Promotion is decided by a Veyn reviewer and recorded. Demotion or suspension is immediate after a security report, a breach of the rules, or unusual call patterns: Doyo stops offering the connector at once. Your tier is stored by Veyn, never read from your manifest.
Confirmation
- At launch every connector is
prepare: your service opens with the details filled in, and the user presses the last button there. That press is the confirmation. - Later, a connector that finishes a job itself (
execute) shows the user a confirmation card on every call, with Face ID or device authentication where available. Orders, payments, bookings, messages and anything with an amount always need it, with no “remember my choice”. - A model, a tool call or a connector response can never give or skip a confirmation. One confirmation covers one call. A response cannot start another action.
- Veyn never moves money. Payments stay between the user and your service.
Consent
- Turning on. The user sees who you are, your tier, the actions you add, each scope in plain words, your regions, and your privacy policy and terms. Doyo never turns a connector on for the user, and never because a web page, document or model output asked it to.
- Using. Each call carries only the scopes that action declares.
- Agreeing again. If a new version widens scopes, effect or regions, or ownership changes, the user agrees again. Until then the old version keeps its old permissions.
- Turning off. The user can revoke at any time in Settings, effective before the next call. You are not needed for it. Deleting a Veyn account revokes everything.
- One person, one grant. A household member cannot turn a connector on for someone else.
Audit
Every call writes an immutable record: the connector and version, the action and mode, the scope names with a hash of the values, how it was confirmed, and the outcome.
| Who | Sees |
|---|---|
| The user | An activity list per connected app that they can filter, export and delete. |
| You | Your own calls: counts, errors, and a pseudonymous id per user. Nothing beyond what the call delivered. |
| Veyn | Full records for abuse review, access-logged and role-restricted, kept 12 months unless the user deletes earlier or the law requires otherwise. |
Raw input values are not kept beyond the user's own activity view. Card and account numbers are never stored.
What developers agree to
- Use inputs only to carry out the called action: no resale, no advertising profile, no joining with other data.
- Keep a working security contact and answer reports within 72 hours. Tell Veyn within 24 hours of a breach that affects Veyn users.
- Keep the domains in your manifest, with no redirects to other hosts.
- Honour revocation and delete what you hold for a user on request.
- No impersonation of other brands, and no misleading names, icons or descriptions.
- Follow the law of every region you declare.
Life of a connector
- Register a developer account: identity, domain proof, contact.
- Create a connector and upload a manifest. Veyn validates it and stores a signed canonical copy.
- Test it in T0 with invited testers.
- Submit for T1: automated checks, and a person reviews the first publish.
- Publish. A version never changes; a new version gets the checks its change needs.
- Operate: health checks on your hosts, error budgets, abuse signals.
- Withdraw, be suspended, or transfer to another owner (both accounts agree, users agree again).