1. Prohibited activities

• Uploading unlawful, infringing, or malicious content, or malware.
• Attempting to gain unauthorised access to the platform, other accounts, or underlying systems.
• Interfering with or disrupting the integrity or performance of the service.
• Using the service to process data you are not authorised to process.
• Uploading data belonging to a third party (e.g., a tenant, resident or account holder) without the necessary authority or consent to process it.
• Reverse engineering, scraping, or circumventing usage limits except as permitted by law.

2. Payment and financial misuse

• Submitting fraudulent, forged or unauthorised payment instructions.
• Providing banking or payee details you are not authorised to use, or that you know or suspect to be inaccurate or fraudulent.
• Using the service to facilitate money laundering, sanctions evasion, or any form of payment fraud.

3. AI misuse

You must not attempt to manipulate, poison, or adversarially probe the platform's AI models — for example, by uploading documents crafted to cause misextraction, to extract model internals, or to degrade output quality for yourself or others. This complements the AI provisions of the Terms (Section 10), under which your review before approval is the primary control against error.

4. Credential and integration security

You are responsible for safeguarding your login, API and SFTP credentials and any integration access you configure, consistent with the security expectations in the DPA. Do not share credentials, and promptly rotate and report any suspected compromise.

5. Fair use

Credit-based plans are subject to the account volumes for your subscription tier — Free (1–5 accounts), Starter (125 included credits), Growth (4,000 included credits, up to 4,000 accounts/month) or Enterprise (custom) — as detailed in the Terms of Service (Section 3). Automated or bulk usage must remain within those limits.

6. Enforcement: tiers, notice and consequences

We apply enforcement proportionate to the violation:

• Minor or fair-use breaches (e.g., volume overage): we will provide notice and a reasonable opportunity to cure, consistent with the Terms' thirty (30) day cure period, before suspension.
• Security-threatening or fraud-related violations (e.g., malware, unauthorised access attempts, fraudulent payment instructions): we may suspend or restrict access immediately and without prior notice, as an express exception to the Terms' thirty (30) day cure period, and may terminate for cause.
• Repeated or uncured violations may result in termination.

7. Termination for cause and data export

On termination for a breach of this AUP, the data-export window described in the Terms (Section 15) and the DPA (Section 11) applies; however, for fraud-related terminations we reserve the right to shorten or suspend that export window to the extent reasonably necessary to prevent ongoing harm or to comply with law or a banking-partner requirement. We will cooperate with lawful requests from authorities where required. Questions? Contact info@billportal.io.