Acceptable use policy

1.What Paper Free Finance is for

Processing your own organisation's supplier invoices, credit notes and related documents (or those of clients you are authorised to act for, such as an accountancy practice for its clients): capturing them, reviewing and approving them, posting them to your ledger and keeping them.

2.What is not allowed

You must not use Paper Free Finance, or let anyone else use it, to:

• break the law, including tax, anti-money-laundering, sanctions and data protection law;
• commit or hide fraud, for example by creating false invoices, altering genuine ones, or redirecting payments to accounts that are not the supplier's;
• process documents or personal data you have no right to process;
• upload malware or files designed to exploit the software that reads them;
• get into another organisation's data, probe or scan the service for weaknesses, or get round its security, rate limits or plan limits (see section 3 for responsible research);
• place a load on the service beyond normal use of your plan, or scrape it;
• send spam, or use an intake address to receive anything other than documents for your organisation;
• share sign-in details or API keys, or let people outside your organisation use them;
• copy, resell or reverse-engineer the service, except as the law allows;
• use the service to build a competing product.

3.Security research

We welcome reports of vulnerabilities made in good faith under our vulnerability disclosure policy. Testing that follows it is not a breach of this policy.

4.Documents you send

Send only documents your organisation needs to process. Do not send documents containing special category data (for example health information) or criminal records data unless it is needed to pay a supplier and your organisation has a lawful basis for processing it.

5.What happens if this policy is broken

We may remove content, revoke API keys or agents, or suspend a User or the organisation, as described in the Terms of service (clause 15.3). We will tell you why unless the law or an investigation prevents it, and restore access once the problem is resolved. We may report illegal activity to the authorities.

6.Reporting misuse

Tell us about misuse at [security contact email: to be confirmed].