# signafAIde acceptable use policy

Version: 1.0

Effective date: 13 November 2026

This policy forms part of the signafAIde terms of service. It applies to everyone who uses the Service, including through a sandbox, an API key, an auditor link or a coding agent acting for them.

## 1. Content

You must not send, store or share through the Service, including in stored content, agent names, tool names or alert settings, anything that:

- is illegal, or that you have no right to send to us;
- is child sexual abuse material, or promotes terrorism or violent extremism;
- infringes anyone's intellectual property, privacy or confidentiality;
- is personal data you have no lawful basis to process, or special category or criminal offence data that we have not agreed in writing to accept;
- contains malware or code designed to cause harm.

Agent names, tool and action names and other record envelope fields must not contain personal data.

## 2. The free sandbox and Free plan

You must not:

- create sandboxes in bulk, rotate IP addresses or use automation to get around sandbox creation limits or quotas;
- use sandboxes, or several Free organisations, to get more than the free allowance for what is in practice one user or organisation;
- use a sandbox for production evidence or as general storage;
- resell or give public access to sandbox or Free capacity.

## 3. Security and the Service

You must not:

- try to gain access to any account, project, organisation, key, record or system that is not yours, or to the operator admin;
- probe, scan or test the vulnerability of the Service without our written permission (see section 5);
- interfere with or disrupt the Service, its anchoring, or other customers, including by denial of service, flooding, or sending data designed to exhaust resources;
- get around rate limits, quotas, plan limits or access controls;
- use the Service to attack other systems, including by pointing alert webhooks or SSO settings at systems you do not control;
- forge, replay or misrepresent records, receipts or verification packs, or present them as showing something they do not;
- reverse engineer the Service except where the law allows it. The open-source SDKs, verifier and protocol specification are not restricted by this point.

## 4. Representing what the Service shows

You must not state or imply that signafAIde, a record, a verification pack or an audit pack certifies that a decision was correct, or that you or a system comply with any law or standard. Records attest integrity and timing only.

## 5. Reporting security issues

If you find a vulnerability, report it to sales@signafaide.co.uk. We will not take action against good-faith research that follows our responsible disclosure policy (/security), avoids other customers' data and does not disrupt the Service.

## 6. What we may do

If we reasonably believe this policy has been breached, we may remove content, revoke keys or links, throttle or refuse traffic, delete a sandbox, or suspend or terminate access, as set out in the terms. Where reasonable we will tell you first and give you a chance to fix the problem. We may report illegal activity to the authorities.

To report abuse of the Service, contact sales@signafaide.co.uk.