Abuse Policy

This policy applies to everyone who uses SorviAI: customers, their users, people accessing a Portal, visitors to a storefront built on the platform, and anyone opening a shared link we host. It forms part of our Terms of Service.

Where the other policies take over

Do not use SorviAI to do something unlawful, to harm another person, to damage the platform, or to interfere with anyone else’s use of it.

The lists that follow are examples, not an exhaustive catalogue. Something is not permitted merely because it is not listed. If a use is obviously harmful and obviously not what business software is for, treat it as prohibited, and ask us if you are unsure.

Do not store, upload, publish or transmit through SorviAI any material that:

• Is unlawful, or promotes or facilitates unlawful activity.
• Sexually exploits or abuses children, or sexualises a minor in any way. We report this to the authorities in every case, without warning and without exception. Reporting illegal content in the United Kingdom names the UK routes.
• Depicts or incites terrorism, extreme violence, or violence against a person or group.
• Harasses, threatens, bullies, defames or incites hatred against a person or group.
• Infringes copyright, trade mark, patent, trade secret or any other intellectual property right.
• Is malware, ransomware, spyware, a virus, or code designed to damage or gain unauthorised access to a system.
• Is designed to deceive: forged documents, counterfeit listings, fake credentials or fraudulent invoices.
• Contains someone’s personal information published without a lawful basis, including doxxing.
• You do not have the right to store or share.

Do not use SorviAI to:

• Operate a fraudulent business, a pyramid or Ponzi scheme, or an advance-fee scam.
• Launder money, evade sanctions, or process transactions for a business you have concealed from us.
• Sell counterfeit, stolen or illegally imported goods, or goods you are not licensed to sell.
• Falsify accounting records to deceive an auditor, a tax authority, a lender or an investor.
• Impersonate another business or person, or misrepresent your affiliation with one.
• Collect or process personal data unlawfully, including employee data in Worklink.
• Evade a suspension or termination we have applied, including by opening a new account.

Some features let you make content publicly reachable without a login: a storefront, a shared file link, a quote or invoice preview sent to a customer, self check-in or kiosk links for Worklink, and a short-lived link that lets a user upload photos from their phone into a record. These carry extra responsibility, because the content is served from our systems to the open internet.

Rules for anything you publish publicly

• Everything in Prohibited content and Prohibited activities applies, and we enforce it more actively here because the exposure is public.
• Do not build a page designed to collect credentials, card details or bank details under false pretences. Phishing pages hosted on our infrastructure are removed immediately and reported.
• Do not use public links as general file hosting or a content delivery network. They exist to share a document with a counterparty, not to distribute media at scale.
• Do not publish a storefront selling anything you are not lawfully entitled to sell in the territories you ship to.
• Keep shared links current. Revoke a link when the person no longer needs it, and do not share a link to data you would not hand over on paper.
• You are responsible for what your own users publish, including anyone you invite into your workspace.

Your duties as a UK business publishing a storefront

A storefront you publish is your own website, and UK law places its own duties on you as the business behind it. The Electronic Commerce (EC Directive) Regulations 2002 (reg. 6) require your name, geographic address, email address and, where they apply, your company registration and VAT numbers to be easily and permanently accessible; if you are a company, the trading disclosure rules also apply to your website; and a privacy notice is needed if you collect personal data through it. SorviAI storefronts take enquiries and have no checkout, so the Consumer Contracts Regulations 2013 rules on distance sales are not triggered by the storefront itself; they may apply to any sale you conclude afterwards. SorviAI’s storefront themes have no dedicated place for your company details or a privacy notice today, so check how you will meet these duties before you publish.

SorviAI keeps every customer’s data in a separate database schema. Attempting to cross that boundary is the most serious thing you can do on this platform, and we treat it accordingly.

Unauthorised access to computer material, and acts that impair the operation of a computer, are criminal offences in the United Kingdom under the Computer Misuse Act 1990. We report attacks on the platform to the police where we consider it appropriate.

The platform applies rate limits and size limits so that one account cannot degrade the service for others. Attachments are capped at 10 MB per file and Nest files at 100 MB per file. Storefront endpoints, the Worklink kiosk and the phone-upload link are rate limited per IP address. Nest public links and public quote and invoice pages are not rate limited today.

Do not:

• Work around a rate limit by rotating IP addresses, accounts, workspaces or API credentials.
• Automate the interface to place load a human user could not generate, other than through our documented API within its limits.
• Scrape or bulk-extract data from the platform, from a storefront, or from another customer’s public pages.
• Use the platform for cryptocurrency mining, distributed computing or any workload unrelated to running your business.
• Use storage as a general file archive or backup target unrelated to your records in the product.
• Generate artificial load, including load testing, without our written agreement.

The ban on bulk extraction is about other people’s data and about load. It never stops you taking your own records out of your own workspace through the exports the product provides.

• A single account per person. Do not share a login between people. Seats exist so that each person has their own identity, and the audit log is worthless if three people share a sign-in.
• Do not create accounts to extend free trials or to avoid seat charges.
• Do not register accounts using false details or someone else’s identity.
• Do not resell or sublicense access to your workspace unless your agreement with us permits it.
• Keep credentials secure. Turn on two-factor authentication for your own sign-in (each user sets it up for themselves, with recovery codes; administrators cannot yet require it for their users), do not share codes, and tell us promptly if you believe an account has been compromised.
• Remove access when someone leaves. Deactivating a departing user is your responsibility, not ours.

Security abuse bans probing the platform. That ban is not aimed at people trying to help us, and we do not want it to stop you reporting a genuine flaw.

If you find a vulnerability, tell us at [email protected]. We acknowledge reports within 2 working days. What we ask of you:

• Report it to us promptly and give us a reasonable chance to fix it before telling anyone else.
• Only test against your own account or an account whose owner has permitted it. Never against another customer’s data.
• Stop as soon as you confirm a vulnerability exists. Do not pivot further into the system, and do not access, copy, modify or delete data that is not yours.
• Do not degrade the service, and do not run automated scanning that generates significant load.
• Do not extort us. A report conditioned on payment is not a disclosure.

We will not pursue legal action against a researcher who reports in good faith and stays within the boundaries above, we will keep you informed as we work on the issue, and we will credit you if you would like to be credited. This is a promise about what we will do. It cannot grant immunity from the law, and it does not bind the police, prosecutors or any third party: the Computer Misuse Act 1990 has no defence for good-faith security research, which is why the boundaries above matter.

We run no bug bounty programme at present and offer no payment for reports. We would rather say that plainly than leave it ambiguous.

Report abuse to [email protected], or through the form on our contact page. Tell us what you saw, where, and when. A link and a screenshot help enormously. You do not need to be a SorviAI customer or have an account to report: visitors to a storefront, portal users and anyone who received a shared link can use this route.

One mailbox takes every kind of report, and it is read every working day. We acknowledge reports within 2 working days, and faster where the report involves child safety, an active phishing page or an imminent security risk. Reports involving child sexual abuse material are escalated immediately.

There is no report button in the product today: no storefront, portal page or shared-link page links to this route, so it is reached from this page, our contact page or by email. We record each report and our decision by hand.

We do not usually tell a reporter what action we took against a specific account, because that is confidential to that customer. We will confirm that the report was investigated and closed.

We aim to be proportionate. Most reports turn out to be a misunderstanding, a misconfiguration or a dispute between two businesses that is not ours to settle.

• We look at what we can see without opening your records: public pages, audit metadata, delivery and error logs, and the report itself.
• We access workspace content only where it is necessary to investigate a credible report, or where the law requires it, and we limit that access to what is needed.
• When support staff need to see inside a workspace, they use an impersonation route, and a senior engineer approves each use. Entering it writes a record of who did it, when and against which workspace, in the same transaction as the access itself, so the access cannot happen without the record. A banner in your interface shows that the session is running. The record covers the start of the session; the individual actions taken during it are not logged separately.
• Impersonation is not the only way staff can reach customer data. Our director and one or two senior engineers can connect directly to the production databases for maintenance; that list is reviewed every quarter, and those connections leave no audit record today.
• We will normally contact you and give you a chance to explain or fix the issue before acting.
• We act first and explain afterwards only where the harm is immediate: child safety, an active phishing page, malware distribution, or an attack in progress.

Depending on what we find, and how serious it is, we may:

• Contact you and ask you to fix it.
• Remove or disable access to specific content or a specific public link. Today our staff can do this only by entering your workspace through the impersonation route described above, so the entry is recorded and you will see the session banner if you are signed in at the time.
• Suspend the account until the matter is resolved. Suspension applies to the whole workspace, sign-in included; we lift it by hand, and we tell you ourselves because the platform sends no automatic notice.
• Terminate the account for serious or repeated breaches.
• Report to the authorities where we are required to, or where the conduct is criminal. Reporting illegal content in the United Kingdom lists the routes we use.

We aim to use the least disruptive measure that resolves the problem. Removing one link is better than suspending a company’s accounting system.

Your data during and after enforcement

An enforcement action is about what you did on the platform. It is not a reason to take your business records away from you, and we do not delete a workspace’s data because we have suspended it.

• Content we remove or disable. Where we can, we disable public access to the item or the link rather than delete it, so the underlying record stays in your workspace. The exceptions are material that is itself unlawful to hold, such as child sexual abuse material or live malware, which we remove and, where the law requires, preserve for the authorities.
• While your account is suspended. Suspension currently blocks sign-in to the whole workspace, which also blocks the product’s exports. If you need your records while suspended, for example for an HMRC check, contact us and we will work out how to get them to you.
• When legal process is involved. Where an authority requires us to preserve data, we preserve it, and a suspension does not shorten that.
• After termination. Termination locks every application, as the end of a subscription does, and there is no whole-workspace export; contact us and we will work out how to get your records to you. Nothing is deleted automatically: we delete your data from our live systems within 30 days of your written request, and backup copies are overwritten within 7 days after that, as our Privacy Policy and Terms of Service set out.
• Your own retention duties do not stop. Our backups are kept for seven days and are not an archive. They are no substitute for the records you are required to keep, so keep your own exports.

Your UK record-keeping duties continue while you are suspended

A UK company must keep adequate accounting records for at least three years (private company) or six years (public company) under the Companies Act 2006, sections 386 to 388, and VAT records, including the digital records Making Tax Digital requires, are generally kept for six years. HMRC may ask to inspect them during a compliance check. Those duties do not pause because we have suspended your account. If you receive an HMRC request while suspended, tell us at [email protected] and we will give getting your records to you priority.

Appealing

If you think we got it wrong, reply to the notice we sent, or write to [email protected] with the reasons. The same route is open to anyone who reported content to us and disagrees with what we did about it, including a decision to take no action.

A senior member of the team reviews the decision, and we aim to respond within 10 working days. Every decision is taken by a person; we use no automated moderation. If we made a mistake we will reverse it and say so, and we tell you the outcome either way.

Termination for breach of this policy is not refundable. That is set out in our Refund Policy.

Alongside reporting to us, you can go straight to the authority or hotline that deals with the kind of content involved. We use the same routes when we report.

A police constable can give us a notice under section 3 of the Terrorism Act 2006 stating that specific material we host is unlawfully terrorism-related and requiring us to remove it or make it unavailable.

If we do not do so within two working days without reasonable excuse, we lose the defence the Act would otherwise give us, and we are treated as endorsing the material. We act on a valid section 3 notice within that period, and we tell the customer concerned unless the police ask us not to. Our mailbox is read every working day for this reason.

If we become aware that the same or substantially similar material has been published again after we acted on a notice, we remove it as well, without waiting for a second notice.

If you believe something published on a storefront or through a shared link defames you, send your complaint to [email protected].

Tell us your name, the statement you complain of, where it appears (the full URL), why it is defamatory of you and, as far as you know, why it is untrue or not an opinion honestly held. Where the author can be identified and contacted, we will pass the complaint to them.

The Online Safety Act 2023 regulates “user-to-user services”: services where content generated or uploaded by one user can be encountered by another user. It does not apply to every service that lets a business publish something, and several of the features that make up SorviAI fall within exemptions the Act provides.

We have assessed each part of SorviAI against the Act, on these facts:

Our position

Storefronts, portals, public quote and invoice pages, Repairs, Escalate, TeamEmail and the internal modules are, in our assessment, outside the Act’s user-to-user duties: their content is the business’s own, their user-to-user content is email, or they are internal business services. Nest public share links can let content uploaded by one user be encountered by another, so we treat them as within scope and comply: we have recorded an illegal content risk assessment and a children’s access assessment for them, and our director, Deepak Gupta, is the accountable person.

Anyone can report a file shared through a public link by email to [email protected] or through the form on our contact page. Whatever the feature, the reporting and appeal routes in this policy are open to anyone, we do not allow illegal content anywhere on SorviAI, and we remove it when we become aware of it. Ofcom, which enforces the Act, can fine up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

We comply with valid legal process. We also check that it is valid, and we do not hand over customer data on an informal request.

• Requests must come through proper legal channels and be addressed to [email protected].
• We disclose only what the request actually compels, not everything we hold.
• Where we are legally permitted to, we notify the affected customer before disclosing, so they have an opportunity to challenge it.
• Where a request looks overbroad or improper, we push back.
• Because we are usually the processor rather than the controller, we will normally direct a request for a customer’s business records to that customer.

Requests from UK authorities

UK authorities obtain communications data and content under the Investigatory Powers Act 2016 and by court order. Some of those instruments make it an offence for us to tell anyone about them; where that applies, we cannot notify you, and we will not. An overseas production order under the Crime (Overseas Production Orders) Act 2019 can require a provider in a country with a designated agreement to produce electronic data, and under the UK-US Data Access Agreement UK authorities can request data directly from providers in the United States, including our US-based suppliers. A court can also order us to disclose information that identifies a wrongdoer (a Norwich Pharmacal order); we disclose on such an order, not on an informal request. The same process applies to all of these: we check the legal basis, disclose only what is compelled, and notify the customer where we are allowed to.

We may update this policy as the platform and the threat landscape change. The version and effective date at the top tell you which one you are reading. This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.

We will announce changes on this page and give workspace owners at least 30 days’ notice of material changes by email, except where an immediate change is needed to address active abuse or to meet a legal requirement. How a change takes effect in your contract with us is governed by the Terms of Service.

If you are not sure whether something is allowed, ask before you do it. That is always easier than unwinding an enforcement action afterwards.

Our full company details are on our company information page.