provided by Provider (Name), Provider (Address (one line)) ("Provider")
to Customer (Name), Customer (Address (one line)) ("Customer")
Effective date: Effective date
Purpose and scope
This Acceptable Use Policy ("Policy") sets out what Customer and its users may not do with the Service. It applies to everyone who accesses the Service through Customer's account, including Customer's employees, contractors, and anyone else Customer gives access to ("Users").
Restricted purposes
When using the Service, Customer and its Users may not:
collect or extract information or user data from accounts that do not belong to them;
circumvent, disable, or otherwise interfere with security-related features of the Service, or probe, scan, or test its vulnerabilities without Provider's written permission;
trick, defraud, or mislead Provider or other users, including by making false reports or impersonating another person;
upload or transmit, or attempt to upload or transmit, viruses or any other malware, or tracking mechanisms such as 1x1 pixels, web bugs, or similar devices that users have not agreed to;
interfere with, disrupt, or create an undue burden on the Service or the networks connected to it, including through automated access that exceeds normal use;
harass, intimidate, or threaten others, including Provider's employees;
store, share, or distribute content that is illegal, that infringes anyone's intellectual property rights, or that violates anyone's privacy;
send unsolicited bulk messages (spam) or use the Service for phishing;
share login credentials, or give people access to the Service beyond what Customer's agreement with Provider allows;
copy, decompile, or reverse engineer the Service, except to the extent applicable law allows this despite this restriction; or
use the Service in a manner inconsistent with any applicable laws or regulations, including export control and sanctions laws.
AI features
AI use
Customer's responsibility for users
Customer makes sure its Users know and follow this Policy, and is responsible for their use of the Service. If Customer learns that a User has broken this Policy, Customer will stop the violation and tell Provider without undue delay.
How to report abuse
Anyone can report a violation by email to Abuse report email. A report should include detailed information about the account, the content or behavior being reported, and how it was found, including links or screenshots. Provider will not disclose the identity of the person reporting to anyone associated with the reported account, unless the law requires it.
Enforcement
If Customer or its Users break this Policy, Enforcement Provider may also remove or disable content that breaks this Policy. Provider's other rights under its agreement with Customer and under the law remain unaffected.
Changes to this policy
Provider may update this Policy to reflect changes to the Service, the law, or new kinds of misuse. Provider will tell Customer about material changes at least 30 days before they take effect, unless a shorter period is needed to comply with the law or to stop an immediate threat to the Service.
Relationship to the agreement
This Policy forms part of Customer's agreement with Provider for the Service. If this Policy and that agreement conflict, the agreement controls, except that this Policy controls on what uses of the Service are restricted.
Acknowledgment
By signing, Customer confirms that it has read this Policy and agrees that it and its Users will follow it.
Customer
Signature pending
Disclaimer: The original creator, the author of this template, and fynk GmbH are not responsible for any damages or liabilities that may result from using this template. This template should not be considered a substitute for legal advice, and consulting with a legal professional is recommended before use. fynk GmbH, the original creator, and the author do not provide legal advice and will not be held accountable for any legal consequences arising from its use.
More than 12,000 teams chose fynk to outgrow legal chaos · Used in over 60 countries
What an acceptable use policy covers and how to use this template
Learn the difference between a customer AUP and an employee IT policy, what restrictions to include, how enforcement and AI rules work, and how the AUP fits into your customer contract.
Acceptable use policy
A set of rules that defines what users may and may not do with a service, system, or network, and what happens when they break the rules. For online services it is usually part of the customer contract, next to the terms of service or a master agreement.
Use this template if:
You run a SaaS product, platform, hosting service, or other online service and need written rules for how customers may use it
You want a clear basis in the contract to suspend or terminate accounts that abuse the service
Your product includes AI features and you want rules against misuse, such as impersonation or training competing models
You sell to businesses and want each customer to sign that it has read the policy, instead of hoping it clicked through
Customer AUP or employee IT policy?
Search for “acceptable use policy” and you will find two very different documents:
Customer AUP (this template)
Employee IT acceptable use policy
Who it binds
customers of your service and their users
your own employees
What it covers
how your product may be used: security, abuse, content, AI, resale
company laptops, email, internet, passwords, personal devices
Legal basis
part of the customer contract
part of employment terms and internal policies
Consequence of a breach
suspension or termination of the account
disciplinary action
This template is the first kind. For employees, the same structure works, but the content belongs in your handbook and IT security policy.
What this acceptable use policy restricts
Customers and their users may not:
collect data from accounts that are not theirs
circumvent security features, or probe and scan for vulnerabilities without permission
deceive the provider or other users, including impersonation
upload malware or tracking devices users have not agreed to
overload or disrupt the service, including through excessive automated access
harass or threaten others, including the provider’s staff
store or share illegal content, content that infringes intellectual property, or content that violates privacy
send spam or run phishing
share credentials or give access beyond what the contract allows
copy, decompile, or reverse engineer the service, except where the law allows it anyway
use the service in violation of the law, including export controls and sanctions
The list is deliberately short and concrete. Long AUPs that try to anticipate everything are harder to enforce, because a customer can argue that whatever is not listed is allowed. Item 11 is the catch-all.
AI rules: when your product uses AI
If your service includes AI features such as text generation, summaries, or document analysis, keep the AI option on. It prohibits using those features to create illegal, deceptive, or harmful content, to impersonate real people without consent, to make fully automated decisions with legal or similarly significant effects on people without human review, and to extract the models or train competing ones. The automated-decisions rule tracks Article 22 of the GDPR and helps customers stay compliant. If your product has no AI features, choose the other option and the section stays short.
Get the AUP signed with the contract, not lost in a checkbox.proof
Immediate suspension. You may suspend or terminate access without notice. Strong protection, but enterprise customers often push back on it, because a false alarm could take their business offline.
Warn first, unless it is urgent. You notify the customer and give reasonable time to fix the problem, but may still suspend immediately if the violation causes or threatens immediate harm. This is the default, and the version most business customers accept without negotiation.
Either way, you may also remove content that breaks the policy, and your other rights under the contract and the law remain.
Reporting abuse
A good AUP tells the outside world how to report problems. The template names your abuse email address, asks reporters for details such as account, content, and screenshots, and promises not to reveal the reporter’s identity to the reported account unless the law requires it. That wording comes straight from the 37signals policy and is one of its strengths.
How the AUP fits into your contract
The AUP is not a standalone contract. It forms part of your agreement with the customer, such as a SaaS agreement or cloud service agreement. If the two conflict, the main agreement controls, except on the question of which uses are restricted, where the AUP controls. The template also lets you update the policy, with 30 days’ notice for material changes, so it can keep pace with new kinds of misuse.
Fill in the fields. Enter the service name, the effective date, and your abuse email, and choose the enforcement and AI options. Your company is already set as the provider.
Send it with the contract. Send the AUP together with the main agreement. The customer reviews it online, without an account, and signs the acknowledgment with an electronic signature.
Keep the proof. The signed AUP sits next to the customer’s contract, linked through related files. If you ever have to suspend an account, the audit trail shows exactly when the customer accepted the policy.
Searching for a contract management solution?
Find out how fynk can help you close deals faster and simplify your eSigning process – request a demo to see it in action.
A set of rules that defines what users may not do with a service or system, and what happens if they do. For online services, it is part of the customer contract and protects the provider, its infrastructure, and its other customers.
Who it applies to, a concrete list of restricted uses, rules for special features such as AI, how to report abuse, what happens when someone breaks the rules, how the policy can change, and how it relates to the main contract. A signature or acceptance step proves the customer agreed.
Yes, if it is part of the contract and the customer accepted it, for example by signing it or by agreeing to terms that incorporate it. A policy that is only posted on a website, without being referenced in the contract, is much harder to enforce.
Terms of service cover the whole relationship: fees, liability, warranties, termination. The AUP covers only how the service may be used. Keeping it separate lets you update the rules on misuse without changing the commercial terms.
If your product offers AI features, it is wise to include AI-specific rules, either in a separate policy or, as in this template, as a section of your AUP. They prohibit misuse such as deceptive content, impersonation, unreviewed automated decisions about people, and model extraction.
Yes. This template allows updates and requires 30 days' notice to customers for material changes, unless a shorter period is needed to comply with the law or stop an immediate threat.
