Acceptable use policy

1. Prohibited content

You must not upload, import, sync, generate, publish, or share via the Service any content or URL that:

• is unlawful, defamatory, fraudulent, obscene, or promotes illegal acts;
• you do not have the lawful right or authorization to possess, reproduce, or process (such as a competitor’s or third party’s misappropriated trade secrets or confidential documents in violation of an NDA);
• infringes, misappropriates, or violates any third party’s copyright, trademark, patent, trade secret, privacy, or publicity rights;
• contains viruses, worms, ransomware, trojans, malicious macros, exploit payloads, or any code designed to disrupt, damage, or gain unauthorized access to any software, hardware, or network;
• includes Special Categories of Personal Data (as defined under GDPR Article 9, such as genetic, biometric, or health records), HIPAA Protected Health Information (PHI), government-issued identification numbers (such as Social Security or passport numbers), or payment card numbers (PCI data), unless strictly necessary for a lawful business questionnaire and permitted under applicable law; or
• contains adversarial prompt-injection payloads or hidden instructions designed to hijack, jailbreak, or manipulate the behavior of the Service’s AI models or extract system prompts.

2. Prohibition on fraudulent or deceptive representations

Because the Service is used to respond to commercial RFPs, vendor security questionnaires, and compliance inquiries, you must not use the Service to intentionally defraud or deceive third parties, including by:

• knowingly approving, exporting, or sharing answers that falsely claim your organization holds security certifications, regulatory attestations, insurance coverage, or technical controls that you do not hold;
• uploading or publishing forged, altered, or fabricated third-party audit reports (such as altered SOC 2 or ISO 27001 reports) on your Trust Center or via Share Links; or
• impersonating another company, organization, or individual.

3. Platform security, tenant integrity, and network abuse

You must not (and must not permit any User or third party to):

• access or attempt to access any organization workspace, database record, storage bucket, or account that does not belong to your organization;
• probe, scan, fuzz, or penetration-test the Service’s infrastructure, APIs, or tenant isolation controls, except strictly in compliance with the rules and scope of our Vulnerability Disclosure Policy;
• bypass, disable, tamper with, or circumvent authentication mechanisms, SAML SSO enforcement, Row-Level Security controls, rate limits, Plan allowances, or usage counters (including by creating multiple Free Plan organizations to evade Plan limits);
• interfere with or disrupt the integrity or performance of the Service through Denial-of-Service (DoS) attacks, load testing, flood requests, or unthrottled automated scripts;
• use the Website Import tool to scan internal networks, bypass paywalls or robots.txt restrictions, harvest third-party websites in violation of their terms of service, or launch requests against third-party targets; or
• share individual login credentials among multiple people or permit individuals outside your organization to access your workspace Users’ accounts.

4. Protection of the Service and intellectual property

You must not (and must not permit any User or third party to):

• copy, modify, translate, adapt, decompile, disassemble, or reverse-engineer the Service, its underlying software, or the browser extension (except to the limited extent applicable law expressly prohibits such restriction despite a contractual waiver);
• access or use the Service in order to build, train, benchmark, or design a competing RFP automation, questionnaire response, or trust center product, or systematically extract our system prompts, scoring heuristics, or UI architecture for competitive purposes (good-faith internal evaluation by a prospective customer for its own purchasing decision is permitted);
• resell, white-label, sublicense, lease, time-share, or operate the Service as a managed service bureau to draft RFPs on behalf of unrelated third-party companies without an express written partner or agency agreement with AcuityRFP; or
• use automated bots, headless browsers, or scrapers to interact with the Service UI or register accounts.

5. Fair use of Business Plan (“unlimited”) drafting

While the Business Plan does not impose a fixed monthly question allowance, it is intended solely for your own organization’s internal RFP, RFI, and security questionnaire workflows performed by your human Users. It does not permit: (a) processing questionnaires on behalf of third-party clients as an outsourced service; (b) automated programmatic bulk generation unrelated to genuine questionnaires; or (c) abusive loops that repeatedly regenerate drafts to exhaust compute resources. Across all Plans (including Business), automated velocity safeguards temporarily pause AI drafting or document ingestion if an organization triggers an extraordinary spike in requests over a short period. If your usage patterns exceed normal enterprise fair-use thresholds, we will reach out to your organization owners to review your workflow and agree on an appropriate solution or custom capacity arrangement.

6. Monitoring and enforcement

While we do not routinely monitor Customer Content, we reserve the right to investigate suspected violations of this AUP. If we reasonably determine that you or a User has violated this AUP, we may remove or disable access to the offending content (such as a public Trust Center document or Share Link), temporarily suspend the offending User or feature, or terminate your account in accordance with Sections 14 and 15 of the Terms of Service. We will act proportionately and, where practicable and safe to do so, notify your organization owners and provide an opportunity to remediate the violation unless the violation poses an immediate security, legal, or operational threat.

7. Reporting violations or abuse

If you become aware of any violation of this AUP—including a Trust Center page or Share Link that hosts infringing, fraudulent, or malicious material—please report it immediately to security@example.com or legal@example.com.