Acceptable use policy

1. Introduction

This Acceptable Use Policy ("Policy") sets out how the Riska platform, its AI features, its API and its integrations (together, the "Services") may be used. It is incorporated into the Services Agreement between Riska, Inc. ("Riska", "we", "us") and the customer that subscribes to the Services ("Customer"). Capitalised terms not defined here have the meaning given in the Services Agreement.

Customer is responsible for making sure that everyone it allows to use the Services, including its employees, contractors, producers and agents ("Users"), follows this Policy.

2. Lawful use

Use the Services only for lawful business purposes and in line with the laws that apply to you, including insurance, privacy, consumer-protection, anti-spam, sanctions and export-control laws. In particular, Customer is responsible for holding any licence, appointment or registration that the insurance activity it carries out through the Services requires.

3. Prohibited use

You must not, and must not allow anyone else to:

• upload, store or send content you do not have the right to use, or that infringes anyone's intellectual property, privacy or other rights;
• use the Services to make an unlawful underwriting, pricing, claims or eligibility decision, including one that discriminates on a basis prohibited by law;
• send unsolicited bulk email, or email that misrepresents who it is from, through the Services' email features;
• upload malware, or anything designed to disrupt, damage or gain unauthorised access to any system;
• probe, scan or test the vulnerability of the Services, except as our Vulnerability Disclosure Policy allows;
• get around any access control, usage limit or tenant boundary, or access another customer's data;
• copy, frame, resell or sublicense the Services, or use them to build a competing product;
• reverse engineer the Services, except to the extent the law expressly allows it;
• put a load on the Services that degrades them for other customers, including through automated access outside the published API.

4. AI features

The Services include features that use machine-learning models to classify, extract, summarise and draft. Their output can be wrong. Customer and its Users remain responsible for any decision made with that output, and must review it before relying on it for a binding underwriting, pricing, coverage or claims decision.

You must not use the AI features to generate content that is unlawful, deceptive or harmful, or try to make a model reveal another customer's data, its instructions or its configuration.

5. Integrations and the API

When you connect a third-party service to Riska, you confirm that you are allowed to share the data that flows between them. Keep API keys and webhook secrets confidential, and rotate any key you believe has been exposed. Access through the API is subject to the same rules as access through the application.

6. Customer data and personal data

Upload personal data only where you have a lawful basis to process it and have given any notice the law requires. Do not upload special category or health data unless your use of the Services needs it and the law allows it. Do not use the Services to store payment card numbers or government identification numbers except in the fields designed for them.

7. Enforcement

If we reasonably believe that the Services are being used in breach of this Policy, we may suspend the affected User, integration or API key while we investigate. We will tell Customer when we do this unless the law prevents us, and will restore access once the issue is resolved. Serious or repeated breaches may lead to termination under the Services Agreement.

8. Reporting and changes

Report a suspected breach of this Policy to legal@riska.io, and a security issue to security@riska.io. We may update this Policy from time to time, and the date at the top of this page shows the latest version.