Acceptable use policy

Who this binds

This policy applies to everybody who uses Footersly or MailAuthInspector, whether as a customer, a user within a customer organisation, a reseller, a managed service provider, or a delegate acting for one of those. It forms part of the agreement under which the products are supplied, and a customer is responsible for the conduct of its own users.

General obligations

When you use our products you must:

• comply with the law, including the UK GDPR, PECR and the Computer Misuse Act 1990;
• hold the authority you need over any mailbox, tenant or domain you connect — see the next section, which is the one that matters most;
• keep your credentials to yourself, and tell us promptly if an account is compromised;
• make sure the people whose data you put into the products have been told about it by you, since you are the controller of that data and we are not;
• use the products as documented, and not in a way that degrades the service for others.

Domains and tenants you do not own

MailAuthInspector reads public DNS, which anybody may do; a free check of a domain is no more intrusive than a dig on the command line, and we place no restriction on it.

Beyond that, the line is clear. You must not connect a Microsoft 365 tenant, add a domain to continuous monitoring, ingest a domain's aggregate reports, or deploy a signature to any mailbox, unless you own that domain or tenant or have the documented authority of the organisation that does. An MSP acting for a client must hold that authority from the client and be able to show it.

We may ask you to demonstrate authorisation for any domain or tenant on an account, and may suspend access to it until you do.

Prohibited use

You must not use our products, or anything you take from them, to:

• impersonate anybody. Signature templates must not represent a person or organisation you are not authorised to represent, and must not be used to make mail look as though it comes from a company that has nothing to do with you;
• send spam or unlawful marketing, or support a sending operation that does. A valid SPF record does not make an unlawful campaign lawful;
• plan an attack. Authentication findings about a domain you do not control must not be used to craft phishing, business email compromise or spoofing against it, or sold to anybody who will;
• probe or stress systems — ours or anybody else's — including by using the products as a scanner, a proxy, or a source of load;
• circumvent limits, including by scripting the interface, sharing one account across unrelated organisations, or creating multiple free accounts to avoid a licence;
• resell or white-label the products, or build a competing service from their output, without a written reseller agreement with us;
• upload malicious content, including code or links intended to compromise a recipient, into a template, disclaimer or banner;
• distribute unlawful or abusive material — anything infringing, defamatory, harassing, discriminatory, obscene, or promoting violence — through a signature or banner;
• reverse engineer the products other than to the extent the law expressly permits.

Fair use and rate limits

Both products apply rate limits so that one account cannot spoil the service for everybody else, and MailAuthInspector is additionally careful not to be a nuisance to the DNS servers it queries. Limits are published in each product's documentation. If a legitimate workload needs more — a provider onboarding several hundred domains at once, for instance — ask us and we will raise them rather than have you work around them.

Automated access through a published API is welcome within its documented limits. Driving the web interface with a script is not an API.

Content you put in

You keep ownership of the templates, disclaimers, images, domain lists and other content you put into the products. You grant us only the licence we need to host and process it in order to provide the service.

You are responsible for having the rights to use that content — including logos, photographs and typefaces in a signature — and for the accuracy of a legal disclaimer you publish. We do not review content and do not advise on whether a disclaimer meets a regulatory requirement that applies to you.

Reporting misuse

If you believe one of our products is being used against this policy — for example a signature impersonating your organisation, or monitoring of a domain you own that you did not authorise — tell us at security@trustlayertechnologies.com. Include the domain or tenant and anything that shows the position, and we will investigate. Security vulnerabilities go to the same address; see the security page.

What we do about it

Where this policy is broken we will take the least drastic step that fixes the problem. That might be a conversation, the removal of specific content, suspension of a domain or tenant, or suspension of the account. For serious or repeated breaches, or where people are at risk, we may suspend immediately and without notice, terminate the agreement, and report the matter to the police or another authority.

We will tell you what we have done and why, unless the law stops us, and we will restore access once the problem is resolved. No refund is due for a period of suspension caused by a breach of this policy.

Questions about this document

Write to privacy@trustlayertechnologies.com for anything about data protection, or hello@trustlayertechnologies.com for everything else. Post reaches us at the registered office: to be confirmed.