Acceptable Use Policy

Why this policy exists

RPM is shared: on the shared server, many businesses use the same system. This policy protects all of them, and you. It applies to every Customer and every User.

You must not

Break the law or hurt others

• Use RPM for anything unlawful, fraudulent or deceptive, including money laundering, tax evasion, false invoicing or misleading records.
• Store or send material that infringes anyone's intellectual property, privacy or other rights, or that is defamatory, harassing, hateful, threatening or obscene.
• Use the messaging features to harass people, or to send spam or unsolicited marketing.

Attack or overload the service

• Try to reach data, tenants or accounts you have not been given access to, or get around RPM's access controls, tenant separation or rate limits.
• Probe, scan or test the service for vulnerabilities, except as allowed by Responsible Disclosure.
• Upload malware, or anything designed to disrupt, damage or gain unauthorised access.
• Overload the service: denial-of-service attacks, or automated requests heavier than normal business use.
• Reverse engineer, decompile or copy the software, except where the law expressly allows.

Misuse accounts

• Share an account, or sign in as someone else.
• Resell, rent or give third parties access to RPM, except your own Users, without a written agreement with us.

Store data the service is not built for

• Payment card numbers or security codes. RPM is not certified under PCI DSS. Record that a payment was made, never the card itself.
• Health records regulated by health privacy laws (such as protected health information under the US HIPAA): we do not sign business associate agreements.
• Special or sensitive personal information — such as health, biometric, criminal, religious or political information, or government identity numbers — unless your business genuinely needs it and you have a lawful basis to hold it.
• Customers' money. "Wallet" and other accounts in RPM are bookkeeping records. RPMCODE does not hold, move or safeguard money, and RPM must not be used to run a deposit-taking, stored-value or payment service that needs a licence you do not have.

Break sanctions

• Use RPM if you, or anyone who owns or controls your business, is subject to sanctions by the United Nations, Australia, the European Union, the United Kingdom, the United States or South Africa, or is in a country or region under comprehensive sanctions; or use it to deal with sanctioned people.

Messages and content between businesses

RPM lets businesses and the Platform Team exchange messages. Each sender is responsible for what they send. We do not check messages in advance, and are not responsible for what other customers send you. Report abuse to support@rpmcode.com.

What we do about breaches

We may investigate suspected breaches, remove material, suspend or close accounts or Tenants, and report suspected crimes to the authorities. Where we can, we will tell you first and give you a chance to put things right. Where there is an immediate risk to the service or other customers, we act first and tell you afterwards.