Acceptable use policy

Veil is built for one job: preparing a set of documents for disclosure to a data subject by removing other people's personal data from them. Related disclosure work, such as preparing a redacted bundle for a regulator, a court or a freedom of information response, is within scope.

You may use the service on documents your organisation lawfully holds and is lawfully entitled to process for that purpose.

• Uploading documents your organisation does not lawfully hold, or has no lawful basis to process for a disclosure purpose
• Uploading material obtained through unauthorised access to another party's systems
• Using the service to process documents on behalf of a third party without a written arrangement permitting it
• Uploading content that is unlawful to possess in any jurisdiction where the service processes it

Veil identifies people in documents in order to remove them. Using that capability for the opposite purpose is prohibited.

• Using the entity registry to build a profile of individuals, or to enrich or link data about them for any purpose other than deciding what to redact
• Exporting entity data to identify people rather than to evidence a redaction decision
• Using the service for surveillance, investigation of individuals, or any form of monitoring not directly required by a disclosure obligation

• Marking an entity as the data subject when you know or suspect it is not, in order to prevent its redaction
• Circumventing, disabling or attempting to defeat the verification step, the detection health gates or the audit log
• Suppressing or falsifying an attestation recorded against a flagged entity
• Releasing a bundle you have reason to believe still contains third-party personal data

• Sharing account credentials, or allowing access by anyone who is not an authorised user of your organisation
• Probing, scanning or testing the security of the service without our prior written agreement
• Attempting to access another organisation's tenant, data or storage objects
• Reverse engineering, decompiling or extracting the detection models, prompts or rules, except to the extent that restriction is unenforceable under applicable law
• Circumventing rate limits, quotas or plan entitlements

• Uploading malware, or files crafted to exploit a document parser
• Automated use that degrades the service for others, including uncontrolled parallel submission outside the published API limits
• Reselling, sublicensing or providing the service to third parties as a bureau service, unless your agreement expressly permits it
• Using the service to train, fine-tune or evaluate a machine learning model

You decide what to upload and you decide what to release. We provide the pipeline, the flags and the verification result. The disclosure decision is yours, and so is the lawful basis for making it.

You are responsible for keeping the list of authorised users current, for removing access promptly when someone leaves, and for the acts and omissions of everyone using your account.

You must review flagged entities before release. A flag is the system telling you it could not resolve something safely. Releasing a bundle without addressing the flags is a decision you are making, and it is recorded as one.

We do not read your documents to police this policy. Enforcement is driven by abuse reports, by billing and platform telemetry that contains no document content, and by security signals.

Where we do investigate, we access the minimum necessary, and access to customer content by our personnel is logged.

If we believe this policy has been breached, we may suspend the affected account or a specific case. Where the breach threatens the security or integrity of the service or another customer, we may suspend immediately and notify afterwards. Otherwise we will notify first and give a reasonable opportunity to fix the problem.

Repeated or serious breach is grounds for termination under the Terms of service.

Report suspected abuse or a security issue to security@pritect.ai. If you believe a released bundle contains third-party personal data that Veil should have removed, report it to the same address and mark it urgent. We treat that class of report as a priority one incident.

Questions about this policy go to legal@pritect.ai. White Label Consultancy AS, Fjordalleen 16, 0250 Oslo, Norway.