Acceptable Use Policy

This Acceptable Use Policy (the "Policy") is part of the Sanning Terms of Service. It says what you must not do with the Services. Words with capital letters have the meanings in the Terms of Service. You are responsible for your Users and for everything done with your Account and API keys.

You must not use the Services, or let anyone else use them, to do any of the following:

1. Break the law or others' rights. Record, reference or send anything unlawful, or anything that infringes another person's intellectual property, privacy or other rights.
2. Send personal data without a lawful basis. Put personal data in a Sent field without a lawful basis, or put in a Sent field the kinds of data that section 5.3 of the Terms of Service forbids.
3. Make false evidence. Use the Services to make evidence that misleads about the origin, author, time or integrity of any data or event; to give a fabricated record the look of independent verification; or to tell anyone that a verification result shows more than section 9 of the Terms of Service says it shows.
4. Pretend to be someone else. Sign as, or claim to be, another Agent, Signing key, organization or person.
5. Attack the Services. Get around or test rate limits, permissions, metering or security controls, except as the section "Security research" allows or with our written permission; access accounts, keys or systems that are not yours; send malware; or overload or disrupt the Services, the public record or the systems that connect them.
6. Abuse metering or free access. Change or avoid metering or billing, or use automated means to make accounts or use up free access.
7. Resell without permission. Resell, sublicense or provide the Services to others, unless we agree in writing.
8. Use the Services as the only safeguard where failure can kill or injure. Use the Services as the only safeguard in a system where a failure can cause death, serious injury or severe damage to property or the environment, unless we agree in writing.
9. Break sanctions or export laws. Use the Services in breach of export-control or sanctions laws.
10. Harm children. Use the Services in connection with child sexual abuse material or the exploitation of children. We report this to the authorities.

If you find a vulnerability, report it to security@sanning.io. Do not access data that is not yours, do not disrupt the Services, and give us reasonable time to fix the issue before you make it public. If you follow these rules and act in good faith, we will not take legal action against you for your research.

To report a breach of this Policy, or content that you think is illegal, email legal@sanning.io. Tell us what you found, where it is (for example a link or an id), why you think it breaks this Policy or the law, your name and email address, and confirm that you believe your report is accurate and complete. We confirm that we received your report, a person reviews it without undue delay, and we tell you what we decided.

We can investigate a breach. Depending on how serious it is, we can warn you, rate-limit or revoke a credential, suspend your access, or end the Terms of Service, as sections 15 and 16 of the Terms of Service describe. Some protections run automatically, such as rate limits and revoking a leaked API key. When we act, we tell you what we did and why, unless the law or a security need prevents it, and you can reply to legal@sanning.io to ask a person to review the decision. We report unlawful activity to the authorities where the law requires or allows it, and we tell them at once if we learn of a threat to a person's life or safety.

We cannot change or delete a Stamp that is already on the public record. A suspension or termination does not change published Stamps.

We can change this Policy as section 17 of the Terms of Service describes.