Acceptable use policy

Why this exists

Every workspace runs on infrastructure shared with other organisations' payroll and personal data. One workspace behaving badly is not just its own problem. This policy is short, specific, and enforced in that order: tell you, limit the thing, then — only if we must — suspend.

Prohibited outright

• Unlawful content or data. Material you have no right to hold, or personal data you have no lawful basis for processing.
• Malware and phishing. Hosting, distributing or linking to malicious software, or using the workspace to impersonate anybody.
• Unsolicited bulk messaging. The mailbox and messaging modules are for your own organisation, not for sending mail to people who did not ask for it.
• Attacking the service. Probing, scanning, denial-of-service, attempting to reach another workspace's data, or circumventing rate limits, authorisation or the audit trail.
• Shared or transferred credentials. One sign-in is one person. Passing credentials to anybody outside your organisation is prohibited, as is sharing an account to avoid seat charges.
• Reselling. Reselling, sublicensing or operating a workspace on behalf of a third party, unless we have agreed it in writing.
• Interfering with other customers. Any deliberate attempt to degrade the service for anybody else.

Ask us first

These are not forbidden; they just need a conversation, because they affect shared capacity:

• Automated or scripted access beyond ordinary use of the product.
• Load testing, penetration testing or vulnerability scanning — including of your own workspace.
• Importing more than 100,000 historical records in one operation.
• Using the shared drive for media libraries or backups unrelated to employment records.

Fair use of shared resources

We do not meter ordinary work and we do not want to. What we do protect is shared capacity: one large import runs per workspace at a time, background jobs are attributed per workspace so one customer's queue cannot starve another's, and request rate limits apply per account and per IP address. If your legitimate use is bumping into a limit, tell us and we will raise it — the limits exist to stop abuse, not to upsell you.

Security measures you will encounter

• Automatic IP blocking. Repeated authentication failures, injection or scripting attempts, or traffic matching known attack patterns gets the source address blocked automatically.
• Allow-listing on request. If a block catches your office, your VPN or a legitimate integration, ask and we will add the address to the allow list. Give us the address and a reason; we normally action it the same working day.
• Account lockout. Repeated failed sign-ins lock an account temporarily and notify its owner.

How we enforce it

1. We tell you. A named person receives a specific description of what we saw and when, with a reasonable period to put it right. Nothing is suspended at this stage.
2. We limit before we suspend. Where it is an abuse of shared capacity, we rate-limit or switch off the module involved rather than taking your whole workspace away.
3. Suspension is a last resort, and it deletes nothing. Access is withdrawn; your data stays as it is, and restoring it is a single status change once the matter is settled.
4. Immediate action only for immediate harm. An active attack, malware distribution, or a live risk to other customers is stopped first and explained immediately afterwards, in writing, with what we did and why.
5. You can always get your data. Even after suspension or termination, a complete export is yours on request for the whole retention period.

Disagreeing with a decision

Reply to the notice, or raise a ticket from the help page inside your workspace — suspension does not close that door, deliberately. A different person reviews it from the one who made the decision, and you get an answer in writing.

Reporting abuse or a vulnerability

Abuse of a workspace: support@zapronixdigital.com. A security vulnerability: support@zapronixdigital.com, acknowledged within one working day. Please do not test against another customer's workspace, and give us a reasonable period to fix an issue before publishing it. We will not pursue anybody who reports in good faith and stays within those lines.