Acceptable Use Policy

This Acceptable Use Policy applies to every use of the Cloudlayer Service and is part of the Terms of Service. A capitalized term not defined here has the meaning in the Terms.

Customer is responsible for its users, Customer Data, targets, recipients, and automated activity. Customer must use reasonable safeguards and comply with applicable law, contracts, permissions, and third-party rights.

Lawful access and content

Do not use the Service to:

• violate a law, regulation, court order, contract, or another person’s rights;
• upload, generate, capture, distribute, or store material that is unlawful, fraudulent, defamatory, threatening, exploitative, or that unlawfully infringes intellectual property, privacy, publicity, confidentiality, or database rights;
• impersonate a person or organization, misrepresent the source or purpose of a form or document, create a deceptive official-looking instrument, or facilitate fraud;
• access or capture a webpage, account, system, or dataset without authorization, including by using credentials, cookies, tokens, or headers that Customer is not entitled to use;
• bypass an authentication control, paywall, rate limit, technical restriction, or access revocation; or
• remove ownership, provenance, safety, or rights-management information in a misleading or unlawful way.

Customer must determine whether it has permission to reproduce, modify, sign, or distribute a form, webpage, trademark, government document, association form, font, image, template, or other protected material. Cloudlayer’s ability to process material is not a rights clearance.

Security and network abuse

Do not:

• probe, scan, exploit, disrupt, overload, or attempt unauthorized access to the Service or another system;
• direct capture, webhook, import, or integration features to localhost, link-local, metadata, private, internal, administrative, or otherwise restricted network resources without express authorization;
• submit malware, malicious documents, exploit code, credential-harvesting content, destructive scripts, or content intended to evade security review;
• use the Service to operate phishing, spam, botnet, denial-of-service, credential-stuffing, scraping, surveillance, or vulnerability-exploitation activity;
• defeat tenant boundaries, access controls, usage meters, content limits, audit records, or security protections;
• test security outside a published authorization or written permission; or
• resell, lease, or provide shared access in a way that avoids account, seat, or usage controls.

Forms, signatures, and communications

Do not use forms, signing requests, email, webhooks, or other delivery features to:

• collect data that is unnecessary or disproportionate to the stated purpose;
• send unsolicited bulk or commercial messages, ignore a withdrawal or opt-out, falsify routing or sender identity, or use purchased or unlawfully obtained lists;
• pressure, deceive, or mislead a person about what they are signing, submitting, or consenting to;
• forge a signature, event, identity, timestamp, or audit record, or sign for another person without authority;
• make a high-impact decision about employment, housing, credit, insurance, health, education, legal services, or access to essential services without the notices, legal basis, human review, and appeal required by law; or
• collect children’s data without written Cloudlayer authorization and all required notices and verifiable consent.

Sensitive and regulated data

The Service is not enabled for PHI or ePHI. Do not submit it unless Cloudlayer has approved an eligible service scope in writing and the parties have executed a business associate agreement.

Do not submit payment-card data outside Stripe-hosted controls. Do not submit passwords, private keys, full authentication secrets, government identifiers, precise location, biometric templates, or special-category data unless the applicable documentation and order expressly permit the data and Customer has applied appropriate controls.

Cloudlayer may impose additional safeguards or decline a use involving export controls, sanctions, financial crime, critical infrastructure, regulated records, or safety-critical decisions.

AI use

Do not use AI features to generate or facilitate unlawful discrimination, fraud, impersonation, malware, exploitation, deceptive synthetic media, rights violations, or instructions designed to cause physical or material harm. Do not represent AI output as verified fact or professional advice when it has not been appropriately reviewed. The AI Additional Terms also apply.

Platform integrity

Do not reverse engineer the Service except to the limited extent a law expressly permits despite this restriction. Do not copy non-public product elements to build a competing service, use automated means to extract the Service’s software or non-public data, or remove notices. Reasonable interoperability through documented APIs is permitted.

Do not create accounts or distribute traffic to evade enforcement, plan limits, suspensions, or technical restrictions. Do not use free or trial access for production workloads beyond its stated purpose.

How does Cloudlayer enforce this policy?

Cloudlayer may investigate suspected violations and may block a request, target, recipient, integration, content item, feature, credential, or account when reasonably necessary to prevent harm, protect the Service, or comply with law. Action will be proportionate where practical. Serious or repeated violations may result in suspension or termination.

Cloudlayer may preserve and disclose relevant information when legally required or reasonably necessary to investigate abuse, protect rights and safety, or enforce the Terms, subject to the Privacy Notice and DPA.

Report suspected abuse to support@cloudlayer.io with the subject “Abuse report.” Include the relevant URL, account or job identifier, dates, a clear description, and supporting material that you are authorized to share. Security vulnerabilities should be reported using the contact and scope on the Security page.