Acceptable use policy

1. Who this applies to, and what Entrustt is for

This policy applies to the business that signs up for Entrustt, its employees and contractors, and anyone acting for it. You are responsible for what they do.

Entrustt is for three lawful purposes: watching for customers who have gone quiet, keeping a register of the next of kin your customers name, and asking for a human-reviewed disclosure of information where there is a lawful reason, such as administering an estate.

2. What you must not do

• Use Entrustt to find, contact or identify anyone in order to harm, harass, threaten, pressure or defraud them. This includes stalking, and any use connected with abuse or domestic violence.
• Make false claims. This includes a false death or incapacity claim, a false nomination, impersonation, and pressuring or tricking a next of kin.
• Bypass, automate, pre-approve or rubber-stamp Human Review. Do not use a shared login, a service account or a script as a reviewer, and do not falsify who reviewed a request.
• Export, scrape or list information in bulk, or test whether a person is a customer or has died.
• Sell, license or share Entrustt data or outputs, build marketing lists from it, or use it to profile people for credit, insurance pricing or employment unless we have agreed it in writing and the law allows it.
• Use Entrustt, its outputs or its webhooks to start, approve or settle any movement of money or assets. Entrustt discloses information, not money. Do not treat its output as the only proof of death or incapacity before releasing funds.
• Send data you have no lawful basis to send, data about children beyond what is necessary, or data that our terms do not allow.
• Use Entrustt for, by or for any person or place under sanctions that apply to you, structure activity to avoid screening, or use it for money laundering or terrorism financing.
• Share your keys, resell or white-label access without our written consent, reverse engineer Entrustt, benchmark it for a competitor, or try to reach another partner's data.
• Send malware, attack the service, or push requests past your limits in a way that harms other partners.

3. Rate limits and fair use

Limits exist to protect every partner. The current defaults are below, and your Order Form or the documentation may set different ones.

• API keys: [60 requests a minute] sustained, with a short burst of [120]. Sandbox: [30 a minute].
• Disclosure requests: [3 per account holder in 30 days] and [100 per day] per partner in Production.
• Webhook endpoints: up to [5] per environment.

Over-limit requests return HTTP 429 with a Retry-After header. Repeated breaches can lead to your key being slowed.

4. Security testing

You may test the Sandbox without asking us, if you use made-up data and stay inside the rate limits.

Do not test Production without our written consent at least [10 business days] before. The consent will set the scope, the time window and the named testers. Testing must not damage anything or involve tricking our staff or your customers, and must not touch any other partner's data. If you see another partner's data, stop at once and tell us.

To report a vulnerability, read our disclosure policy.

5. What happens if the policy is broken

We choose the response that fits the breach.

1. Warning, and a request to fix it within [5 business days].
2. Slowing the affected key, and a requirement to rotate it.
3. Suspending a key, a feature or a user, with notice.
4. Suspending Production, while we keep and protect your data.
5. Ending the agreement for material breach. There is no cure period for fraud, harm to a person, sanctions breaches, or bypassing Human Review.
6. Reporting to a regulator or law enforcement where the law requires it, and preserving audit logs.

We may suspend at once, without notice, where there is an imminent risk of harm to a person, active fraud, a security compromise, a legal order or a sanctions issue. We tell you as soon as the law allows.

6. Reporting misuse

If you think Entrustt is being misused, tell us. We treat reports about harm to a person as urgent.