Acceptable Use Policy

This Acceptable Use Policy ("Policy") sets forth the rules, restrictions, and obligations governing the use of the Seygov platform and related services ("Services"), operated by Seygov, a product of Nassau Technologies LLC ("Seygov," "we," "us," or "our"). This Policy is incorporated by reference into Seygov's Terms and Conditions. By accessing or using the Services, you, on behalf of yourself and the organization you represent, agree to abide by this Policy in its entirety. Failure to comply with this Policy may result in immediate suspension or termination of access to the Services.

1. Authorized Use

The Services are made available exclusively for the following authorized purposes:

• Deploying, configuring, and administering government applications through the Seygov platform on behalf of a subscribing government agency or organization;
• Collecting, managing, and processing intake submissions from authorized users and members of the public through Subscriber-deployed applications;
• Administering user accounts, group permissions, department structures, and organizational settings within the Subscriber's instance of the Services;
• Accessing and using the Seygov API for lawful integration purposes within the scope of issued API token permissions;
• Any other use expressly authorized in writing by Seygov.

You are solely responsible for ensuring that all use of the Services by your organization, your authorized users, and members of the public accessing your deployed applications complies with this Policy, Seygov's Terms and Conditions, and all applicable laws and regulations.

2. Prohibited Uses

You shall not use the Services, directly or indirectly, for any of the following purposes:

Unauthorized Access

• Attempt to gain unauthorized access to any portion of the Services, any other Subscriber's account or data, Seygov's infrastructure, or any third-party system connected to the Services;
• Attempt to bypass, circumvent, or defeat authentication, authorization, encryption, session management, CSRF protections, or any other security measure implemented by Seygov;
• Use another Subscriber's or user's credentials to access the Services without authorization;
• Exploit or attempt to exploit any vulnerability in the Services for any purpose.

Malicious Conduct

• Upload, transmit, introduce, or execute malware, viruses, worms, Trojan horses, ransomware, spyware, or any other harmful, destructive, or malicious code through the Services;
• Use the Services to distribute or facilitate the distribution of malicious software or content to members of the public or any third party;
• Use the Services to conduct phishing, spoofing, or social engineering attacks against any individual or organization.

Disruption and System Abuse

• Conduct denial-of-service (DoS), distributed denial-of-service (DDoS), brute-force, credential stuffing, fuzzing, load testing, stress testing, or any activity intended to degrade, overload, or disrupt the Services or any third-party system;
• Probe, scan, or test the vulnerability of Seygov's infrastructure, servers, or network without Seygov's prior written authorization;
• Circumvent, tamper with, or interfere with Seygov's monitoring, logging, rate-limiting, or security controls;
• Interfere with or disrupt any other Subscriber's or user's access to or use of the Services;
• Consume excessive platform resources in a manner that materially degrades the performance of the Services for other users.

Unlawful and Harmful Content

• Use the Services to collect, store, transmit, or process any content that is unlawful, harmful, threatening, abusive, harassing, defamatory, obscene, fraudulent, or otherwise objectionable;
• Deploy applications through the Services for purposes that violate any applicable federal, state, or local law or regulation;
• Use the Services to impersonate any government agency, official, or other person or entity in a misleading or deceptive manner;
• Use the Services to facilitate or enable any illegal activity, including but not limited to violations of the Computer Fraud and Abuse Act (18 U.S.C. § 1030) or any applicable state cybercrime law.

Data Misuse

• Use the Services to collect, process, or store personal information from members of the public without providing required privacy notices and obtaining any required consents in compliance with applicable law;
• Use Subscriber Data, including data submitted by members of the public through Subscriber-deployed applications, for any purpose other than the lawful governmental purpose for which it was collected;
• Share, sell, disclose, or transfer Subscriber Data or member of the public data to any unauthorized third party;
• Use the Services to process categories of data that are disproportionate to or inconsistent with the stated purpose of the deployed application.

Unauthorized Transfers and Resale

• Resell, sublicense, transfer, or otherwise provide access to the Services to any third party without Seygov's prior written consent;
• Use the Services to build a competing product or service;
• Reproduce, modify, distribute, or create derivative works based on the Services or any component thereof without Seygov's prior written authorization.

API Misuse

• Use the Seygov API in a manner that exceeds the scope of issued API token permissions;
• Attempt to access data belonging to another Subscriber or organization through the API;
• Share API tokens with unauthorized parties or embed API tokens in publicly accessible code or repositories;
• Use the API to automate requests at a rate or volume that materially degrades platform performance or circumvents usage limits.

3. Subscriber Responsibility for Deployed Applications

Subscribers are solely and exclusively responsible for the content, configuration, and operation of all applications deployed through the Services. This includes but is not limited to:

• Ensuring that all deployed applications are used for lawful governmental purposes consistent with the Subscriber's authority and obligations;
• Ensuring that all information collected from members of the public through deployed applications is collected with appropriate legal basis and in compliance with applicable privacy and data protection laws;
• Ensuring that deployed applications are not used to collect unnecessary, excessive, or unauthorized personal information from members of the public;
• Promptly deactivating any deployed application that is no longer in active use or that has been found to be operating in violation of applicable law or this Policy;
• Ensuring that all authorized users within the Subscriber's organization comply with this Policy.

SEYGOV DOES NOT REVIEW, APPROVE, OR MONITOR THE CONTENT OR CONFIGURATION OF SUBSCRIBER-DEPLOYED APPLICATIONS AND ASSUMES NO RESPONSIBILITY FOR THE LAWFULNESS OR APPROPRIATENESS OF ANY SUBSCRIBER-DEPLOYED APPLICATION OR ANY DATA COLLECTED THROUGH IT.

4. User Account Responsibilities

Subscribers are responsible for all activity that occurs under their account and the accounts of their authorized users. Subscribers must:

• Maintain the confidentiality and security of all account credentials, including passwords and API tokens;
• Promptly deactivate or disable accounts for employees, contractors, or other authorized users who no longer require access to the Services;
• Immediately notify Seygov of any known or suspected unauthorized access to or use of the Subscriber's account;
• Ensure that LDAP integration credentials and SMTP server credentials provided to Seygov for integration purposes are accurate, authorized, and kept current.

5. Enforcement

Seygov reserves the right, at its sole and absolute discretion, to determine whether any activity violates this Policy. Violations of this Policy may result in any or all of the following actions, without prior notice or liability:

• Immediate suspension or termination of the Subscriber's account and all associated user accounts;
• Removal or disabling of any deployed application or content that violates this Policy;
• Permanent prohibition of the Subscriber from accessing the Services;
• Reporting of unlawful conduct to appropriate law enforcement authorities;
• Civil or criminal liability under applicable law.

Seygov's failure to enforce any provision of this Policy on any particular occasion shall not constitute a waiver of Seygov's right to enforce that provision or any other provision at any time.

6. Indemnification

You agree to indemnify, defend, and hold harmless Seygov and its officers, directors, employees, agents, contractors, affiliates, successors, and assigns from and against any and all claims, demands, actions, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) your violation of this Policy; (b) your organization's deployed applications and all data collected through those applications; (c) your authorized users' violation of this Policy; (d) any unlawful, unauthorized, or inappropriate use of the Services by you or any party acting under your account; or (e) any claim by a member of the public, third party, or government authority arising from your use of the Services.

7. Force Majeure

Seygov shall not be liable for any failure to enforce this Policy or any failure of the Services arising from events beyond Seygov's reasonable control, including but not limited to acts of god, natural disasters, pandemics, war, terrorism, civil unrest, government actions, power outages, internet or telecommunications failures, cyberattacks, or other malicious third-party activity beyond Seygov's reasonable ability to prevent or mitigate.

8. Changes to This Policy

Seygov reserves the right to update or modify this Acceptable Use Policy at any time at its sole discretion. Updated versions of this Policy will be posted on the Seygov website with a revised effective date. Your continued use of the Services following the posting of an updated Policy constitutes your acceptance of the revised Policy. It is your responsibility to review this Policy periodically.

9. Entire Agreement

This Policy, together with Seygov's Terms and Conditions, Privacy Policy, Security & Compliance Statement, Data Processing Addendum, and Cookie Policy, constitutes the entire agreement between the parties regarding acceptable use of the Services. This Policy supersedes all prior or contemporaneous agreements, communications, representations, or understandings, whether oral or written, relating to acceptable use of the Services.

10. Contact Information

Questions or concerns regarding this Acceptable Use Policy may be submitted through the contact methods provided on the Seygov website. To report suspected violations of this Policy, including security incidents or unauthorized use of the Services, please contact Seygov immediately through the methods provided on the Seygov website.