Acceptable Use Policy

The principle

Certiqa is for operating and evidencing a management system. Use it for that, lawfully, and this policy will never trouble you.

You must not

You must not use Certiqa to:

• break the law, or help anyone else to
• store or transmit material that is unlawful, defamatory, or infringes someone else's rights
• upload malicious code, or attempt to interfere with the platform's operation or security
• attempt to access another customer's data, or any part of the platform you have not been granted access to
• probe, scan or test the platform's security without our written permission, or circumvent any access control, rate limit or audit mechanism
• resell, sublicense or provide the platform as a service to a third party without our written agreement
• use automated means to extract data at a scale or rate the platform was not sold for
• falsify a record, an approval or an acknowledgement, or use the platform to present work as having been done or approved when it was not

A word about that last one

Certiqa exists to make a governance claim evidenced rather than asserted. Using it to manufacture evidence of something that did not happen is not a grey area, and it is the one misuse we will treat as a material breach without a cure period.

Personal data you put in

You decide what personal data enters Certiqa. Put in what your management system genuinely needs and no more. Where you record special category data, such as health information in a medical certificate or an incident record, you are responsible for having a lawful basis and an appropriate condition for doing so.

The Data Processing Addendum sets out what we do with it.

Reporting a problem

If you find a security vulnerability in Certiqa, tell us at hello@is3.co.uk before telling anyone else, and give us a reasonable opportunity to fix it. We will not pursue you for a good-faith report.

If this policy is breached

We will normally raise it with you and give you a reasonable opportunity to put it right. Where the breach is serious, or where leaving it in place would put other customers or the platform at risk, we may suspend access immediately and discuss it with you straight afterwards.