Acceptable Use Policy

Overview

General Rule

Illegal or Harmful Content and Conduct

• Content, activity, or transactions that violate applicable law or regulation.
• Child sexual abuse material, sexual exploitation of minors, grooming, online enticement, child trafficking, or any attempt to solicit, obtain, create, distribute, or preserve such material or activity.
• Non-consensual intimate imagery, sexual exploitation, human trafficking, harassment, stalking, threats, intimidation, or abuse.
• Credible threats of violence, incitement to violence, terrorist activity, violent extremist activity, or instructions for evading law enforcement in connection with violent or unlawful conduct.
• Fraud, scams, phishing, impersonation, forged identity, deceptive business practices, or misrepresentation of source, affiliation, endorsement, or authority.
• Unlawful discrimination, harassment, or exclusion in employment, housing, credit, education, public accommodation, or similarly regulated contexts.
• Content or activity that infringes, misappropriates, or violates intellectual property, publicity, privacy, confidentiality, contractual, or proprietary rights.
• Unlawful gambling, regulated financial activity, controlled substances, weapons, counterfeit goods, stolen goods, or other regulated goods or services unless expressly permitted in writing by Matte and lawful in all applicable jurisdictions.
• Content designed to exploit, shame, extort, dox, expose, or endanger a person or organization.

Regulated and Sensitive Data

• Protected health information subject to HIPAA.
• Payment card data subject to PCI DSS.
• Bank account credentials, private keys, seed phrases, or authentication secrets not intended to be managed in the Services.
• Government identification numbers, tax identifiers, background-check data, biometric identifiers, or precise geolocation data used for tracking individuals.
• Children's data or student education records subject to child privacy or education privacy laws.
• Criminal offense data or special categories of personal data under GDPR.
• Export-controlled technical data, classified information, or data subject to government security restrictions.

Security Abuse

• Access or attempt to access accounts, workspaces, systems, networks, data, APIs, custom domains, sessions, cookies, tokens, credentials, or object storage that Customer is not authorized to access.
• Bypass, disable, degrade, or interfere with authentication, authorization, MFA, CSRF protection, rate limits, permission checks, workspace isolation, logging, monitoring, security headers, or other security controls.
• Probe, scan, penetration test, load test, stress test, or vulnerability test the Services except as allowed in the vulnerability research section.
• Introduce malware, ransomware, spyware, backdoors, botnets, worms, credential harvesters, malicious scripts, or destructive code.
• Use the Services to attack, scan, spam, overload, scrape, disrupt, or compromise any third party.
• Attempt to extract source code, underlying models, system architecture, non-public APIs, credentials, secrets, or information about other customers except as permitted by law and the agreement.
• Share accounts, API keys, passwords, session tokens, recovery codes, passkeys, or credentials except through authorized administrative workflows.
• Use automated systems to create accounts, bypass signup controls, evade rate limits, or generate abusive traffic.
• Hide or misrepresent origin through proxying, spoofing, forged headers, misleading domains, or other deceptive routing.

Platform Integrity and Service Limits

• Degrade, disable, or interfere with the Services or infrastructure used by Matte or other customers.
• Consume excessive bandwidth, storage, compute, API capacity, email capacity, or database resources disproportionate to Customer's plan or normal business use.
• Circumvent quotas, billing limits, workspace limits, feature limits, retention limits, storage limits, API rate limits, or technical restrictions.
• Run crypto mining, bulk scraping, bot operations, open proxies, relay services, traffic resale, benchmark farms, or unrelated high-volume computation.
• Use the Services as a general-purpose file host, malware repository, backup dump, content distribution network, or anonymous data drop unless expressly permitted by Matte.
• Repeatedly create and abandon workspaces, custom domains, API keys, imports, or accounts to evade enforcement, limits, payment, or abuse review.

Email, Invitations, and Messaging

• Spam, unsolicited bulk email, or messages that violate anti-spam, telemarketing, or electronic communications laws.
• Phishing, credential harvesting, malware delivery, deceptive attachments, malicious links, or social engineering.
• Messages with false or misleading sender information, headers, subject lines, domain names, or affiliation claims.
• Messages to recipients who have not consented where consent is required or who have opted out.
• Harassment, threats, extortion, or other abusive communications.

Custom Domains and Workspace Identity

• Connect, claim, verify, or use a domain without authorization from the domain owner.
• Impersonate another person, company, product, government agency, or brand.
• Use confusingly similar workspace names, slugs, logos, avatars, custom emoji, domains, or sender identities to mislead others.
• Host or route deceptive, malicious, infringing, or unlawful content through a custom domain.
• Interfere with certificate issuance, DNS validation, or domain verification processes.

Privacy and Data Rights

APIs, Imports, Exports, and Integrations

• Use APIs or automation to evade UI controls, permissions, auditability, workspace isolation, billing, or usage limits.
• Import or export data in violation of law, contract, confidentiality obligations, privacy rights, intellectual property rights, or this AUP.
• Use API keys or exports to build an unauthorized competing service, replicate the Services, or provide service bureau access without Matte's written approval.
• Submit malformed, oversized, recursive, malicious, or intentionally disruptive payloads.
• Continue using revoked, leaked, expired, unauthorized, or compromised API keys.

Sanctions, Export Controls, and Restricted Parties

AI and Automated Decisioning

• Make decisions that are unlawful, discriminatory, deceptive, or materially harmful.
• Generate malware, phishing, credential theft, evasion techniques, or instructions for wrongdoing.
• Create or facilitate child sexual abuse material, sexual exploitation, non-consensual intimate imagery, or abusive content.
• Infer sensitive attributes, re-identify individuals, or conduct unlawful surveillance.
• Process regulated data in violation of the agreement, DPA, BAA, or applicable law.

Vulnerability Research

• Avoid accessing, modifying, deleting, exfiltrating, or disclosing data that does not belong to the researcher.
• Avoid privacy violations, service disruption, degradation, social engineering, phishing, physical attacks, spam, malware, persistence, or destructive activity.
• Stop testing and report promptly if the researcher encounters non-public data, credentials, or a vulnerability that could affect other customers.
• Give Matte a reasonable opportunity to investigate and remediate before public disclosure.
• Comply with applicable law.

Enforcement

• Warning Customer or workspace administrators.
• Requiring Customer to remove content, revoke API keys, change configuration, disable integrations, or remediate misuse.
• Limiting, throttling, disabling, or suspending features, accounts, workspaces, domains, imports, exports, API keys, email workflows, or access.
• Removing or disabling access to content.
• Preserving information as required or permitted by law.
• Reporting illegal or harmful activity to law enforcement, regulators, NCMEC, or other appropriate authorities.
• Terminating the agreement for material or repeated violations.

Remediation and Appeals

Reporting Abuse

Changes