Terms of Service

Legal name: Thornbury Banking Ltd.

Registered office: 3452 Cawthra Road, Mississauga, Ontario L5A 3V9.

Ontario Corporation No.: 2489173.

We are a member institution of the Canada Deposit Insurance Corporation (CDIC) and operate under the regulatory oversight of the Office of the Superintendent of Financial Institutions (OSFI). OSFI Registration No. DTI-20120914-ON.

We are registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). MSB Registration No. M21847563.

Thornbury Banking Ltd. has been in continuous operation since our incorporation in Ontario in September 2012. We are a regulated deposit-taking institution. These terms govern your use of our digital properties and complement — but do not replace — the specific agreements governing individual banking products and credit facilities.

TBL Connect is our proprietary digital banking platform. Access requires valid credentials issued during client onboarding. Here is what governs your use of the platform.

Access & Credentials

Each authorized user receives unique login credentials. You are responsible for keeping these credentials secure. Do not share your password with anyone — including other employees at your organization. Role-based access controls are available and configurable for multi-user accounts.

If you suspect unauthorized access to your TBL Connect account, notify us immediately at (646) 964-8887 or [email protected]. We will disable the compromised credentials within 15 minutes of verification.

Data Accuracy

TBL Connect displays real-time intra-day balance and transaction data. While we make every reasonable effort to ensure data accuracy, balance figures displayed in TBL Connect are provisional until end-of-day settlement. Final business account statements serve as the authoritative record.

API Usage

TBL Connect supports 40+ pre-built API integrations with platforms including QuickBooks Online, Xero, Sage, NetSuite, ConnectWise, Lightspeed, and custom endpoints. API usage is governed by rate limits documented in the TBL Connect API reference guide provided to each client. Standard rate limit: 1,000 requests per hour per API key.

Misuse of API access — including exceeding rate limits by more than 300% on a sustained basis or using API keys for unauthorized third-party applications — may result in temporary or permanent suspension of API access.

Platform Availability

Our target uptime for TBL Connect is 99.7% annually. We provide advance notice of scheduled maintenance windows — typically Saturday nights between 11:00 PM and 3:00 AM ET. Emergency maintenance may occur without advance notice, though we will communicate via status page and email as rapidly as possible.

TBL Connect is SOC 2 Type II certified. Annual third-party penetration testing is conducted by an independent cybersecurity firm.

You agree to provide accurate, current, and complete information when using our services. This applies to contact forms, commercial loan proposals, KYC/KYB documentation, account-opening applications, and any information submitted through TBL Connect.

You are responsible for the security of your TBL Connect credentials. Specifically:

• Use unique, complex passwords (minimum 12 characters, with mixed character types).
• Enable two-factor authentication (available for all TBL Connect accounts — we strongly recommend it).
• Notify us within 24 hours of discovering any unauthorized access to your account.
• Never share credentials via email, SMS, or messaging platforms.

Failure to maintain credential security may affect your liability for unauthorized transactions originating from your account. We determine liability on a case-by-case basis, consistent with OSFI guidelines and good-faith principles.

"Thornbury Banking Ltd.," "TBL Connect," and all associated logos, designs, and visual marks are the property of Thornbury Banking Ltd. and are protected under Canadian trademark and intellectual property law.

The content on our website — text, graphics, interface designs, data compilations, and software — is owned by or licensed to Thornbury Banking Ltd. You may not reproduce, distribute, modify, or create derivative works from our content without prior written consent.

Here is what you can do: link to our public web pages, reference our published materials with appropriate attribution, and share content through standard social media sharing functions.

The TBL Connect platform, including its architecture, codebase, API specifications, and user interface design, was built entirely in-house by our technology team under Elena Vasquez-Thornbury's direction. It is proprietary software and is not available for resale, sublicensing, or reverse engineering.

These terms are governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein.

If a dispute arises between you and Thornbury Banking Ltd., we ask that you first attempt to resolve it through direct communication with our compliance team. Email [email protected] or call (646) 964-8887 and ask for Nadia El-Amin, Chief Compliance & Risk Officer.

We commit to acknowledging your dispute within 2 business days and providing a substantive response within 10 business days.

If we cannot resolve the dispute through good-faith discussion within 30 days, either party may submit the matter to mediation administered by the ADR Institute of Ontario. If mediation fails, the dispute shall be resolved through binding arbitration in accordance with the Arbitration Act, 1991 (Ontario), unless the dispute falls within the jurisdiction of a regulatory authority such as OSFI or FINTRAC.

Nothing in this section prevents you from filing a complaint with the Office of the Superintendent of Financial Institutions, the Financial Consumer Agency of Canada, or any other applicable regulatory body. We cooperate fully with regulatory inquiries.

You may stop using our website and TBL Connect at any time. No notice required for website use. For TBL Connect access, we recommend notifying us so we can properly disable your credentials and ensure data is handled according to your preferences.

We may suspend or terminate your access to TBL Connect if:

• You breach these terms in a manner that is material or uncured after written notice.
• We are required to do so by law, regulation, or a valid order from OSFI, FINTRAC, or a court of competent jurisdiction.
• We detect suspicious activity on your account that requires investigation.

Important distinction: terminating website or TBL Connect access does not terminate your banking relationship. Banking relationships — credit facilities, deposit accounts, commercial card programs — are governed by their own agreements with their own termination provisions. Closing a TBL Connect account does not close your bank accounts, and closing a bank account does not automatically disable TBL Connect (though access would become limited).

Upon termination, we will retain your data in accordance with our Privacy Policy and applicable regulatory requirements (minimum 7-year retention for financial records under PCMLTFA).