Dropwarden

Legal and security documents

DRAFT — requires lawyer review. Not legal advice.

Dropwarden Acceptable Use Policy

Effective date: TBD

This Acceptable Use Policy ("AUP") is part of the Terms of Service. It applies to every organization, user and partner that uses Dropwarden. Customers are responsible for their users' and partners' compliance.

1. Prohibited content

You must not upload, store, transfer or share through the Service:

  1. Malware: viruses, worms, ransomware, trojans, spyware, exploit kits or any other code designed to harm, gain unauthorized access to, or disrupt systems. This includes malware samples kept for research, because our scanner quarantines them automatically.
  2. Infringing material (piracy): content that infringes copyright, trademarks or other intellectual property rights, including unlicensed software, films, music, books or games.
  3. Child sexual abuse material (CSAM): any content that sexually exploits or endangers children. We report apparent CSAM to the National Center for Missing & Exploited Children (NCMEC) and other authorities as the law requires, preserve it as the law requires, and terminate the account.
  4. Unlawful content: content that is illegal where it is stored, sent or received, including content that defames, harasses, threatens or incites violence, promotes terrorism, or was obtained through unauthorized access or a data breach.
  5. Payment cardholder data: full primary account numbers (card numbers), card verification codes, PINs or magnetic-stripe/chip data. The Service is not designed or assessed for storing cardholder data. Use your payment processor's tokenization instead.
  6. Protected health information (PHI): individually identifiable health information that is regulated under United States health privacy law. We do not currently sign Business Associate Agreements (BAAs) under HIPAA, so do not store PHI in the Service.
  7. Other data that, by law, may only be hosted under certifications, government authorizations or contract terms we do not offer (for example classified information or controlled unclassified information), unless a separate signed agreement with us expressly allows it.

2. Prohibited activities

You must not:

  1. Probe, scan or test the vulnerability of the Service or another customer's data, except as allowed by our Responsible Disclosure Policy, or attempt to access another organization's files or accounts.
  2. Bypass or interfere with authentication, permissions, quotas, fair-use limits, rate limits, malware scanning or other security controls.
  3. Use the Service to send spam or phishing, host phishing pages, or distribute malware through share links or webhooks.
  4. Use share links or the Service as a public content-distribution network or file-sharing site for the general public.
  5. Create multiple trials or accounts to avoid paying or to evade Plan limits or a suspension.
  6. Overload the Service, for example with denial-of-service traffic or automated requests well beyond normal use for your Plan.
  7. Point webhooks, automations or integrations at systems you are not authorized to send data to.
  8. Resell the Service or give access to third parties as a stand-alone file hosting service, unless we agree in writing.
  9. Use the Service in breach of export control or sanctions laws.

3. How we enforce this policy

  • We automatically scan uploaded files for malware. Files that match known malware are quarantined and never made available for download. Organization admins are notified.
  • We do not routinely review file contents. We act on scanner results, abuse reports, legal requests and signs of abuse in metadata (for example traffic patterns).
  • When we reasonably believe this AUP or the law is breached, or the Service or other customers are at risk, we may, with or without prior notice: remove or quarantine content; disable share links, users, partners, keys or API keys; suspend the organization; or freeze it. A freeze disconnects active sessions and blocks all access, including by owners, while we investigate.
  • Where the law and the circumstances allow, we will tell the organization's owners what happened and how to resolve it. Serious or repeated breaches may lead to termination under the Terms of Service.
  • We cooperate with law enforcement where the law requires.

Report abuse, including malware, phishing or illegal content hosted on or sent from the Service, to [email protected]. Include the share link, hostname, IP address or other details that help us find it.

Copyright owners can send notices under the U.S. Digital Millennium Copyright Act (DMCA) to our designated agent: TBD. A notice must include the elements required by 17 U.S.C. § 512(c)(3). We will act on valid notices, notify the affected customer, accept counter-notices, and terminate repeat infringers in appropriate circumstances.

Security vulnerabilities in the Service itself: see our Responsible Disclosure Policy.

5. Changes

We may update this AUP. For material changes we will email account owners before they take effect, unless the change is needed urgently to address abuse or a legal requirement.