Acceptable Use Policy

1. About this policy

1.1 This policy sets the rules for using CertSync (the website, web application and mobile apps), provided by CERTSYNC LIMITED (Company No. 17216573). It forms part of the Subscription Agreement under clause 1.4 of the Terms of Service and applies to every Customer and every Authorised User. Words with capitals have the meanings given in the Terms of Service.

1.2 If this policy and the Terms of Service conflict, the Terms of Service prevail.

2. Your responsibilities

2.1 The Customer must use the Service lawfully and only for preparing, signing, storing and delivering Certificates and related records.

2.2 The Customer must make sure each Authorised User knows about and follows this policy, and must give each Authorised User only the access they need. The Customer is responsible for their conduct as if it were its own.

3. Account security

3.1 One login per person. Credentials must not be shared, even with another Authorised User. Each extra person must be added as an Authorised User, at the seat price published at /pricing.

3.2 Passwords. Every Authorised User must use a strong password that they do not use on any other service.

3.3 Multi-factor authentication. Multi-factor authentication is on by default, and CertSync strongly recommends leaving it on. Sign-in codes are sent by email, so the Customer must keep each Authorised User's email address current and secure.

3.4 Compromised accounts. If a password or email account may have been compromised, the Authorised User must reset their password at once, and the Customer must tell security@certsync.co.uk if personal data, payment details or a Signed Certificate may be affected.

4. Illegal content

4.1 No one may upload, store or share through the Service any content that is illegal, including child sexual abuse material, terrorist content, intimate images shared without consent, content that is fraudulent, threatening or harassing, or content that infringes another person's rights.

4.2 CertSync may remove, or block access to, any content it reasonably believes is illegal or breaches this policy. It may keep a copy where the law requires or allows, and report the content and the account to the police or another relevant authority.

4.3 CertSync will tell the Customer when it removes content, unless the law or the authorities prevent it, or telling the Customer would risk harm to others.

5. Prohibited uses

5.1 The Customer must not, and must not allow anyone else to, use the Service in any of the ways set out in this clause 5.

5.2 Unlawful use. The Service must not be used to commit or further any criminal offence, to send messages that break the Privacy and Electronic Communications Regulations 2003, or to process personal data without a lawful basis under the UK GDPR.

5.3 Misrepresentation. The Service must not be used to claim a qualification, competence or scheme registration that the person does not hold, to misuse a scheme's membership details, or to suggest that CertSync, a scheme or any trade body endorses anyone when it does not.

5.4 Certificate misuse. The Service must not be used:

5.4.1 to prepare or sign a Certificate for work, equipment or an inspection that the signatory has not personally carried out or directly supervised;

5.4.2 to sign a Certificate without forming a professional judgement that the work meets the applicable standard;

5.4.3 to alter a Signed Certificate or to get round the rule in clause 10 of the Terms of Service that it cannot be edited;

5.4.4 to backdate, post-date or misstate when a Certificate was prepared, signed or issued; or

5.4.5 to issue a Certificate that the signatory knows, or ought to know, contains a material inaccuracy.

5.5 Data extraction. No one may scrape the Service or use any automated means to extract data from it unless the Service expressly allows it, extract data in bulk beyond normal use of its search, autofill and export features, or get round any rate limit or similar protection.

5.6 Copying and reverse engineering. No one may reverse engineer or decompile the Service, except as section 50B of the Copyright, Designs and Patents Act 1988 or other law allows; copy its templates, interface or documentation; or use the Service or its output to build a competing product.

5.7 Security. No one may test, scan or load-test the Service without CertSync's written permission, try to access any account or data they are not authorised to access, get round any access control, or introduce malicious code.

5.8 Automated tools. The Customer must not:

5.8.1 use any automated tool, including any tool that incorporates artificial-intelligence or machine-learning components, to generate, sign, or issue a Certificate without the personal supervision and professional sign-off of the relevant Authorised User in accordance with clause 5.4; or

5.8.2 use the Service in a way that delegates the professional judgement of the Customer or an Authorised User to an automated tool.

5.9 Resale. The Service must not be resold, sublicensed, rebranded or provided to others as a service without CertSync's written agreement.

5.10 Harm to the Service. The Service must not be used in a way that, in CertSync's reasonable view, may damage its security, availability or performance for other users, or bring CertSync into disrepute.

5.11 AI-assisted features. Where the Service offers AI-assisted features, the Customer must not, and must ensure that its Authorised Users do not:

5.11.1 submit to an AI-assisted feature content that the task does not need, including the name, address or contact details of any person typed into a notes or question box, or a photograph taken to show a person rather than an installation or a piece of equipment;

5.11.2 use an AI-assisted feature, or attempt to cause one, to reproduce, extract or compile the text, tables or figures of BS 7671 or of any other published standard;

5.11.3 attempt to make an AI-assisted feature act outside its stated purpose, including by submitting instructions intended to override how the feature works, or attempt to obtain AI-assisted output without the credits that output costs; or

5.11.4 accept, or record on a Certificate, any AI-assisted suggestion — including a suggested classification code, earthing arrangement or equipment detail, or a value captured from a photograph of an instrument display or from speech — that the relevant Authorised User has not personally checked against the installation, the equipment or the instrument concerned.

6. Reports and complaints

6.1 Reporting. Anyone can report illegal content, a breach of this policy or other abuse of the Service by emailing abuse@certsync.co.uk. Please say what the content or conduct is, where and when it was seen, and how to contact you.

6.2 Complaints. You can also complain to abuse@certsync.co.uk if you think content on the Service is illegal, that CertSync has not dealt properly with a report, or that your content was wrongly removed or your account wrongly restricted because of content.

6.3 What happens next. CertSync will acknowledge each report or complaint within 2 working days, deal with reports of intimate images shared without consent first, act under clauses 4 and 7, and tell you the outcome. If content was removed or an account restricted in error, CertSync will put it right.

6.4 Other routes. Security vulnerabilities go to security@certsync.co.uk and privacy requests to privacy@certsync.co.uk.

7. Enforcement

7.1 Notice of breach. Where CertSync reasonably believes this policy has been breached, it may give the Customer written notice describing the breach, any step it requires, and the time allowed where the breach can be remedied.

7.2 Suspension. CertSync may suspend the Customer's account, or an Authorised User's access, under clause 4.5 of the Terms of Service.

7.3 Termination. For a material breach, or a repeated breach not cured after notice under clause 7.1, CertSync may end the Subscription Agreement under clause 16.3 of the Terms of Service.

7.4 Law enforcement. CertSync may report suspected criminal use of the Service to the police or another relevant authority and give them information as the law allows.

8. Other terms

8.1 The Customer indemnity in clause 14.6 of the Terms of Service covers breaches of this policy. Clauses 17 and 23 of the Terms of Service apply to changes to this policy, and clause 21 to governing law and jurisdiction.