Acceptable Use Policy

• Your account is yours alone. Do not share your password or sign-in codes with anyone, including colleagues and your own administrator. Everything done in BoxTick is logged against the person who did it, and that record is what proves your organisation did the right thing.
• Use multi-factor sign-in and keep it working. If you think someone else has got into your account, or you lose the device that holds your codes, tell us straight away. Nothing bad happens to you for reporting it quickly.
• Only connect systems you are allowed to connect. Connecting your organisation's Microsoft 365, Google Workspace, Xero or HR system needs the right authority inside your organisation.
• Give honest, accurate information. BoxTick can only show what it is told and what it can see. A guess presented as a fact makes your evidence worthless. "I don't know" is a valid answer.
• Use BoxTick through BoxTick. No scripts, scrapers or bulk downloads, no attempts to work out our rules libraries, and no attempts to steer our automated tools.
• If this policy is broken, we may suspend your access and tell your administrator. We would rather talk to you first, and usually will.

1.1 This policy is between The Programme Group Limited, trading as BoxTick (we, us, our), and you personally, as a named user of the BoxTick platform (you).

1.2 You accept it at first sign-in. Until you accept it, you have no access.

1.3 It sits alongside the platform terms and data processing agreement your organisation has accepted. It does not replace them or give you rights under them. Words with capital letters, such as Platform, Reports and Connected Systems, have the meaning given in the platform terms.

2.1 Your account is issued to you by name and email address and identifies you personally.

2.2 You must not share your sign-in details with anyone. That includes your password, one-time codes, recovery codes, a signed-in session on an unlocked screen, and any device set up to sign in as you. It includes colleagues, your organisation's administrator and us. Nobody at BoxTick will ever ask for your password or a one-time code.

2.3 You must not let anyone else use your account, and you must not use anyone else's.

2.4 Why this matters. Every action in the Platform is recorded against the person who did it: every answer, upload, connection, policy issued and Report downloaded. If people share a login, the record no longer shows who did what. That weakens the evidence your organisation relies on if it is ever questioned. If someone else needs access, your administrator can invite them.

2.5 You are responsible for what is done under your account, unless it happened after you reported a problem under clause 4.

2.6 When you leave your organisation or no longer need access, tell your administrator so your account can be removed. Do not hand it to your successor.

3.1 You must use multi-factor authentication. Where the Platform requires it for your role, you cannot continue without it. Where it is offered, you must turn it on.

3.2 Keep your authentication device and recovery codes secure, and do not store them with your password.

3.3 Use a password of at least 12 characters that you do not use anywhere else.

3.4 Sign out or lock your screen when using a shared or public device.

4.1 Tell us straight away if you think your sign-in details have been exposed, someone else has used your account, you have lost a device holding your codes, or you have seen data belonging to another organisation.

4.2 Report it through the Platform or by email to hello@boxtick.uk, and tell your organisation's administrator.

4.3 Reporting promptly and in good faith is not itself a breach of this policy.

4.4 If you see another organisation's data, stop, do not read further or copy it, and tell us. Where this is a personal data breach, our data processing agreement applies.

5.1 You must use the Platform through its own screens and features, for your organisation's internal business purposes only.

5.2 You must not:

• (a) scrape, crawl or harvest the Platform or any Report;
• (b) extract content in bulk, by hand, by script or by an automated agent, except through export features we provide;
• (c) access the Platform through any tool, integration or automation we have not provided, including tools that sign in using your details;
• (d) get around, disable or interfere with any rate limit, access control or security feature;
• (e) remove or change any notice, marking or attribution in a Report; or
• (f) upload anything unlawful, defamatory, infringing or that you do not have the right to share.

6.1 You must not try to reconstruct or reverse engineer our rules libraries, compliance mappings, scoring, templates or the way the Platform reaches its findings, whether from what you see in the Platform, from Reports, or by entering information designed to test how it responds.

6.2 You must not use the Platform or any Report to build, train or market a product or service that competes with BoxTick, or to provide compliance services to other organisations.

6.3 You must not use any part of the Platform or any Report as training data for any AI model.

7.1 You must not upload malware, viruses or any other harmful code. Uploads are scanned, and an infected file is deleted and the uploader told.

7.2 You must not probe, scan or test the security of the Platform, or carry out penetration testing, without our prior written permission. Your security team can ask, and we will agree the scope, timing and how findings are reported.

7.3 You must not try to access data, accounts or systems belonging to another organisation, or any part of the Platform you have not been given access to. Attempts are logged.

7.4 You must not disrupt or overload the Platform.

7.5 If you find a security weakness, tell us rather than exploring it. We will not take action against anyone who reports a genuine finding in good faith and does not exploit it, take data or make it public before we have had a reasonable chance to fix it.

8.1 BoxTick uses software, including automated and AI-assisted tools, to read documents, gather evidence from Connected Systems and prepare draft findings. Every Report released as reviewed is checked and approved by a member of our analyst team.

8.2 You must not try to make these tools behave other than as designed. This includes:

• (a) hiding instructions in a document, file name or answer so that the tools read them as commands;
• (b) trying to make the tools reveal their instructions, rules or configuration;
• (c) trying to make them produce a particular finding, score or status other than by giving accurate information; and
• (d) trying to make them produce unlawful, harmful or abusive content.

8.3 Detected attempts are recorded in the audit log, with who did it, when and from where.

8.4 A deliberate attempt to manipulate the tools may make any affected Report invalid. If we decide it has, we will tell your organisation's administrator and record why.

9.1 You must answer questions accurately and to the best of your knowledge, and only upload documents that genuinely support what you say.

9.2 If you do not know something, say so. The Platform accepts "I don't know" and records it as a gap. A guess presented as a fact is worse than an admitted gap, because neither the Platform nor our analysts can always tell the difference.

9.3 Reports depend on the accuracy of what your organisation provides. Your organisation acts on them and shows them to customers, insurers and others, and carries the consequences if they are based on false information.

9.4 You must only connect a Connected System if you are authorised by your organisation to do so and to give BoxTick the access it asks for.

9.5 You must not upload special category data (for example health, ethnicity, religion or trade union membership) or criminal offence data. If you upload it by mistake, tell us and we will delete it.

9.6 If you use the Platform to issue policies to staff, you must only issue policies your organisation has approved, and only to people who work for your organisation.

10.1 We record sign-ins, agreement acceptances, uploads and deletions, connections to Connected Systems, BoxTick staff access to your organisation's data, Report approval and release, downloads, policy issue and acceptance, settings changes, and any detected attempt to manipulate our tools. Each entry records who, which organisation, what, when and from where.

10.2 The record cannot be changed or deleted through the Platform. We keep it as described in our privacy notice.

10.3 We use it to run the Platform securely, to investigate suspected breaches of this policy, and to provide evidence of what happened. Your organisation's administrator can see the activity of users in your organisation.

11.1 We aim to be proportionate. Most problems are a misunderstanding that a conversation can fix.

11.2 Depending on what has happened and how serious it is, we may:

• (a) contact you and ask you to stop;
• (b) suspend your access, immediately if the risk requires it;
• (c) tell your organisation's administrator, with the reason;
• (d) reset or reissue your sign-in details;
• (e) treat an affected Report as invalid under clause 8.4; or
• (f) where the breach is serious, repeated or puts other organisations' data at risk, suspend your organisation's account under the platform terms.

11.3 Suspending an organisation's account is a last resort. Unless the risk requires immediate action, we will tell the administrator first and give a reasonable chance to put things right.

11.4 We may report unlawful conduct to the police or a regulator.

11.5 Appeal. If you think a suspension is wrong, email hello@boxtick.uk. A person, not a system, will look at it again.

12.1 This policy is versioned and dated. If we make a material change, you will need to accept the new version at your next sign-in. Other changes are recorded without needing you to accept again.

12.2 You can download any version you have accepted from the Platform at any time.

13.1 This policy, and any dispute arising out of it, including non-contractual disputes, is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.