Acceptable Use Policy

Effective Date: August 6, 2026 · Version 2.1 (supersedes v2.0, August 6, 2026, and v1.0, July 25, 2026)

1. Purpose

This policy defines acceptable use of the ESXPress platform by customers (tenants) and by the platform operator. It references the platform’s implemented enforcement mechanisms.

2. Scope

This policy applies to all tenant accounts, API key users, email-ingest users, webhook consumers, and the platform operator. Service terms: see the Terms of Service; privacy: see the Privacy Policy.

3. Permitted Use

Uploading insurance scope-of-loss documents you are authorized to process and converting them to Xactimate ESX files.
Using generated ESX files for legitimate insurance claims, supplements, and restoration workflows.
Using the public API (Enterprise and Volume+ plans, or with the API add-on) with tenant-scoped API keys for your own business automation.
Using the email ingest address to submit scope documents.
Webhooks configured to your own endpoints, with HMAC secrets where supported.

4. Prohibited Use

Prohibition	Enforcement
Creating multiple accounts to circumvent limits (free tier = 5 conversions/month, trial = 14 days)	Signup limit: max 3 signups per IP per day; trial-cycling block: more than 3 accounts from the same email domain within 30 days; referral-ring detection
Reselling conversions / API access	Enterprise and Volume+ accounts with more than 100 conversions in a month are flagged for reselling patterns
Abusing the referral program (rings, self-referrals, fake accounts)	Referral ring detection; referrals earn a 20% recurring commission on referred paid plans, tracked per account
Downgrade/upgrade gaming	Downgrade cooldown enforced
Sharing API keys	Each key is tenant-scoped and rate-limited (60 requests per minute); sharing is detectable via usage patterns; keys are revocable immediately
Uploading malicious content	Filename sanitization and path containment; 50 MB per-file limit; malware scanning is not currently implemented
Automated scraping / denial-of-service	Rate limits: anonymous 60 requests/min/IP, authenticated 600 requests/min/tenant, login 20/min/IP, plus burst limits; returns 503 errors if the rate-limit store is unavailable
Unauthorized access to other tenants' data	Tenant isolation: every query is scoped by the authenticated tenant; cross-tenant access requires administrator privileges, and every administrative action is audit-logged
Storing unlawful content	The platform may disable accounts that store unlawful content; we do not currently scan uploaded content

5. Operator (Administrator) Use

The platform operator will:

Access tenant data only for: support with tenant consent, security incidents, legal obligation, or platform operations — each access via the administrative API is recorded in the admin audit log with actor, action, target, IP, and user agent.
Not use tenant claim data for any purpose other than platform operation and the documented AI extraction pipeline (DeepSeek — see the Privacy Policy).
Maintain the confidentiality of internal secrets and tenant data.
Not create tenant accounts for personal use of the free tier (would violate the abuse controls this policy describes).

6. Monitoring and Enforcement

The platform monitors: rate-limit violations, abuse signals (trial cycling, referral rings, reselling), lockouts, CSRF failures, and administrative actions (audit log).
We do not monitor the content of uploaded documents — detection is technical and behavioral, not content-based.
Enforcement actions: rate-limit throttling (automatic), account suspension, API key revocation (immediate), webhook deactivation.

7. Reporting Violations

Report suspected abuse to [email protected]. Reports are reviewed within 2 business days.

8. Consequences

Violations may result in: warning, conversion-limit enforcement, temporary suspension, permanent account termination, and — for unlawful activity — referral to law enforcement. Termination follows the Data Retention Policy for data disposition.

9. Document History

Version	Date	Author	Changes
1.0	July 25, 2026	System Administrator	Initial policy
2.0	August 6, 2026	Chaz Jaco	Mapped each prohibition to its verified enforcement control; removed unverified content-monitoring claims
2.1	August 18, 2026	Content Revamp — Legal	Corrected the reselling and referral-program enforcement descriptions to match the implemented controls

Approved By: Chaz Jaco, Owner — ESXPress Enterprise · August 6, 2026