Acceptable Use Policy

1. Purpose

inSigner is built to help people create trustworthy electronic records. You must use the service lawfully, respect other people’s rights, and avoid conduct that harms recipients, customers, third parties, or the platform.

You are responsible for activity under your account, organization, API keys, public campaign links, templates, integrations, and credentials.

2. Fraud, forgery, and impersonation

You may not use inSigner to:

• Forge, falsify, backdate, alter, or misrepresent a document, signature, timestamp, seal, or audit record.
• Impersonate another person or organization, or claim authority you do not have.
• Obtain a signature through deception, coercion, concealed terms, or a misleading document.
• Bypass or manipulate consent, authentication, KYC, access-code, OTP, or approval controls.
• Create false evidence or present a verification result as proving more than it actually proves.
• Use stolen credentials, identity documents, payment methods, phone numbers, or email accounts.

3. Illegal or harmful content

You may not upload, send, sign, store, or link to content that:

• Violates applicable law, sanctions, court orders, or regulatory requirements.
• Infringes intellectual property, confidentiality, privacy, publicity, or other rights.
• Facilitates fraud, money laundering, trafficking, exploitation, harassment, or credible threats.
• Contains malware, ransomware, destructive code, phishing content, or credential-harvesting mechanisms.
• Contains child sexual abuse material or unlawfully exploits or endangers a minor.
• Is designed to evade law enforcement, regulatory review, or legally required recordkeeping.

High-risk or regulated documents are not automatically prohibited, but you must have the authority, lawful basis, safeguards, and professional review appropriate to the use case.

4. Email, SMS, and WhatsApp communications

You may contact a recipient only when you have a lawful reason and have provided any required notice or obtained required consent. You may not use inSigner for spam, purchased recipient lists, abusive reminders, phishing, or unrelated marketing.

Document titles, messages, and templates must accurately identify the sender and purpose. Recipients must have a reasonable way to identify the sender and report an unexpected request. Carrier, WhatsApp, and communications-provider rules also apply.

5. Platform and service security

You may not:

• Probe, scan, or test vulnerabilities without prior written authorization.
• Attempt unauthorized access to accounts, documents, systems, networks, or provider infrastructure.
• Disable, evade, or overwhelm rate limits, authentication, logging, encryption, or abuse protections.
• Introduce malicious code or use the service to attack another system.
• Interfere with service availability or consume resources in a way that harms other customers.
• Reverse engineer protected parts of the service except where that restriction is prohibited by law.

Good-faith vulnerability reports should be sent privately to hi@insigner.co before public disclosure.

6. Privacy, sensitive data, and identity checks

You must collect and process personal data only with an appropriate legal basis and must follow applicable notices, consent, minimization, security, retention, and data-subject-rights requirements.

Do not require KYC, biometric checks, government identity documents, health information, financial information, or other sensitive data when a less intrusive method is sufficient. Do not use identity or authentication results for unrelated profiling, discrimination, or automated decisions that are unlawful.

7. API, webhooks, and automation

API keys and webhook secrets must be kept confidential. Automated use must follow published limits, respect recipient consent, validate webhook signatures, handle errors responsibly, and avoid duplicate or excessive requests.

You may not resell, sublicense, scrape, mirror, or create a competing dataset from the service unless a written agreement or applicable open-source license permits it. Public campaign links must not be used to collect data deceptively or distribute unlawful content.

8. Enforcement

We may investigate suspected violations and may restrict a feature, block a message or integration, remove content, rotate credentials, suspend an account, or terminate service. Action may be immediate when needed to protect people, evidence, infrastructure, or comply with law.

Where appropriate, we will consider context, severity, recurrence, cooperation, and risk. We may preserve relevant records, notify affected customers, providers, or authorities, and respond to valid legal process. Fees are not refunded for service terminated because of a material violation, except where required by law.

9. Reporting abuse

Report suspected fraud, impersonation, phishing, unlawful content, or an unexpected signing request to hi@insigner.co. Include the signing link or document reference, sender information, and a concise description, but do not email identity documents, passwords, one-time codes, or unnecessary sensitive data.