Acceptable Use Policy

Customer and Authorized Users may not:

1. Access or attempt to access another organization’s accounts, data, files, tokens, portals, or systems without authorization.
2. Share individual credentials, circumvent authentication, defeat permissions, or permit an unauthorized entity to use Customer’s subscription.
3. Probe, scan, exploit, overload, disrupt, or test the Service’s security without IronDispatch’s prior written authorization and agreed testing rules.
4. Upload malware, malicious code, unlawful content, or content that infringes or violates another person’s rights.
5. Use the Service for stalking, harassment, covert tracking, unlawful surveillance, discrimination, retaliation, or monitoring outside a disclosed lawful work purpose.
6. Falsify timecards, inspections, tickets, signatures, fuel records, qualifications, safety records, invoices, or other business documents.
7. Use AI Features to make unreviewed employment, safety, legal, credit, regulatory, environmental, hazardous-materials, transportation-compliance, or other high-impact decisions; generate unlawful or deceptive content; or bypass human-confirmation controls.
8. Use the Service to operate equipment, vehicles, emergency response, or other safety-critical systems autonomously.
9. Submit unsupported payment-card data, bank credentials, Social Security numbers, protected health information, or biometric identifiers.
10. Scrape, resell, sublicense, mirror, reverse engineer, or use the Service to build a competing product except where a restriction is prohibited by law.
11. Send spam or unlawful messages, violate consent/opt-out requirements, or misuse customer portals and public links.
12. Violate export controls, sanctions, anti-bribery laws, privacy law, employment law, or other applicable law.

IronDispatch may investigate suspected violations and take proportionate steps under the MSA. Where feasible, IronDispatch will notify Customer and limit action to affected users or functions. Good-faith security research must be conducted under a separately published vulnerability-disclosure policy or written authorization.