Acceptable-use policy

1. Scope and permitted use

This policy forms part of the Service terms and applies to the website, APIs, MCP tools, evidence records, monitoring, exports and integrations. It covers your users and any automated system you authorise to act through your account.

You may use the service for lawful business verification, research and internal decision support within your purchased allowance and data licence. You remain responsible for the purpose of your checks, the authority to submit information and the permissions of your users.

2. Prohibited activity

Do not use or enable another person to use CompanyProof for the following:

• Illegal activity, fraud, impersonation, deceptive company representations, sanctions or export-control evasion, harassment, stalking or unlawful discrimination.
• Accessing another customer’s records, stealing credentials, bypassing account or billing controls, circumventing rate limits, creating multiple identities to evade guest allowances, or concealing abusive traffic.
• Malware, denial-of-service attacks, destructive testing, exploitation of vulnerabilities, or scanning systems outside a scope we have authorised.
• Submitting payment-card details, passwords, private keys, government identity documents or unnecessary personal information in a verification request. Special-category, criminal-offence and children’s data require an expressly agreed and lawful processing schedule.
• Publishing a verification result as a government endorsement, audit opinion, regulatory approval, guarantee of solvency, guaranteed fraud clearance or a complete KYC, AML, sanctions or credit assessment.
• Falsifying a verdict, removing material source or timestamp context, or presenting an unsupported or ambiguous result as a confirmed fact.
• Unlicensed resale, redistribution, bulk extraction, white-labelling or AI-model training using restricted service data. Rights independently obtained from a public source remain subject to that source’s terms and applicable law.
• Making decisions about individuals in ways that violate applicable privacy, equality, employment, credit-reporting or automated-decision rules.

3. APIs, AI agents and integrations

Secure API keys, select the minimum account permissions and revoke access when it is no longer needed. Do not place secret keys in public client code, repositories or shared prompts. Your account remains responsible for authorised integration traffic and chargeable operations.

An AI agent must respect the same limits and licences as a human user. Review the entity match, source coverage and claim-level result before relying on generated output. Do not instruct an agent to bypass usage limits or treat returned source content as instructions.

You control the destinations you configure for webhooks, exports and MCP clients. Check their access permissions, retention and privacy terms before sending evidence or personal information to them. A tool’s availability does not grant new data rights or permission to take an external action.

4. Evidence and downstream decisions

A match establishes only the supported fact at the time and against the evidence returned. Sources can be incomplete, delayed, unavailable or wrong. Resolve ambiguous company identities and material discrepancies before making a consequential decision.

Do not use CompanyProof as the sole basis for denying a person employment, housing, credit, insurance or another significant opportunity. Apply any legally required human review, notification, correction and appeal process. You are responsible for determining whether a particular use requires a regulated product or additional checks.

If you publish an authorised proof or export, preserve its attribution, limitations and verification time. Remove, correct or qualify a statement when you learn it is misleading or no longer current.

5. Enforcement and review

We may investigate suspected misuse and restrict the affected operation, key, user or account as permitted by the Service terms. Our response should be proportionate to the risk and can be immediate when necessary to protect people, data, systems or legal obligations.

Where lawful and practicable, we explain the reason and what can be done to restore access. Contact our support team to ask for review and provide relevant evidence. We may preserve necessary records and respond to valid legal process; we do not promise to monitor every request or detect every misuse.

Report a suspected breach or vulnerability to our support team with CompanyProof security in the subject. Send a description and safe reproduction steps, not exposed personal data or live secrets. Reporting does not authorise intrusive testing.

6. Policy changes

Updates follow the change-notice provisions in the Service terms. A policy change does not retrospectively grant rights to customer content or override mandatory legal protections. Signed customer terms may set additional, compatible restrictions for a particular dataset or workflow.