Acceptable use policy

1. Who this binds

The customer who holds the workspace, and every person they give access to. A customer is responsible for what their own users do with it.

2. What the service may not be used for

• Data that is not yours to hold. Uploading employee records you have no lawful basis to process, or holding on to them after that basis ends.
• Breaking into the service. Probing, scanning or testing the security of the platform without written permission; accessing another workspace's data; attempting to defeat the limits of your plan.
• Overwhelming it. Automated traffic that degrades the service for other customers, including scraping and bulk requests outside the published API limits.
• Sending what we do not send. Using the notification, letter or email features for marketing to people who did not ask, chain messages, or anything unlawful.
• Unlawful employment practice. Using the product to conceal statutory deductions that are due, to falsify a payroll record, or to produce a document that states something untrue about a person's employment.
• Reselling it as your own without a written white-label agreement.

3. Security research

We would rather hear about a flaw than read about it. Report one to [email protected] and we will not pursue you for the testing that found it, provided you did not access or alter anyone else's data, gave us a reasonable chance to fix it, and did not degrade the service for others.

4. What we do about a breach of this policy

1. We tell you. Except where the activity is actively harming other customers or we are legally required not to, the first step is an email to the workspace administrators describing what we have seen.
2. We may suspend the specific capability — outbound email, the API — rather than the whole workspace, where that is enough to stop it.
3. We may suspend the workspace where it is not. Your data remains exportable throughout; suspension is not deletion.
4. Termination is for repeated or deliberate breaches, and is handled under the Terms of service, including the notice and data-export rights there.

Suspension for breaking these rules is a separate matter from suspension for an unpaid invoice, which is described in the Terms.

5. Reporting misuse

If you believe a workspace is being used against this policy — including to hold your own data unlawfully — write to [email protected]. We acknowledge within 48 hours and tell you the outcome.