Acceptable Use Policy

1. Why this policy matters on a shared service

Customers share the servers that run the Service. Each Customer's Authorized Users are kept in their own group, and by default they can only find and share with people in their own organisation. Misuse by one Customer can affect the security, reliability and reputation of the Service for every other Customer, including the reputation of the mail servers all Customers send from.

2. Prohibited content

Do not use the Service to store, send, share or publish content that:

• is illegal, or promotes or facilitates illegal activity;
• sexually exploits or endangers children, in any form;
• infringes someone else's intellectual property, privacy or other rights;
• threatens, harasses, defames or incites violence against any person or group;
• contains viruses, malware, ransomware or other harmful code, except where a security team stores samples safely for defensive work;
• is designed to deceive, such as phishing pages, impersonation of another person or organisation, or fraudulent offers.

3. Prohibited activities

Do not:

• use the Service in breach of any law or regulation that applies to the Customer or its Authorized Users;
• resell, sublicense or provide the Service to third parties as a hosted service, unless an Order Form allows it;
• share one Authorized User account between several people to avoid buying Seats;
• use public share links to distribute content to the public at large in a way that breaches this policy;
• run cryptocurrency mining, open proxies, open mail relays or similar services on or through the Service;
• store or process Protected Health Information outside the terms of a signed BAA (see section 7).

4. Security abuse

Do not:

• probe, scan or test the vulnerability of the Service, or of any other Customer's workspace, except as allowed below;
• attempt to guess, steal or reuse credentials, including credential-stuffing or brute-force sign-in attempts;
• attempt to access another Customer's data or accounts, or to get around the controls that keep Customers' users and data separate on the shared service;
• interfere with or disrupt the Service, including by denial-of-service attacks or by sending traffic designed to overload it;
• get around sign-in, two-factor, Seat, quota or other technical limits of the Service;
• use the Service to attack, scan or gain unauthorised access to any other system or network.

Security research: good-faith reports of vulnerabilities are welcome under the Vulnerability Disclosure Policy. Customers may run security tests against their own workspace only within the scope of that policy.

5. Email sending and spam

Do not use the Service to send unsolicited bulk or commercial email (spam), or any email that breaks anti-spam laws that apply to the sender. In particular, do not:

• send to purchased, rented or harvested address lists, or to people who have not agreed to hear from the sender;
• forge or hide the sender, headers or origin of a message;
• send mail designed to get around spam filters or sending limits;
• ignore unsubscribe requests or complaints.

• Bulk and marketing email: bulk or marketing email must not be sent from the Service; Customers should use a dedicated email-marketing provider.
• Sending limits: Helios may set reasonable limits on the volume of mail sent from the Service, to protect deliverability and prevent spam.

Today, mail handled by the Service passes through automated spam and virus filtering, and outgoing mail is signed with DKIM. Helios may delay, limit or block mail that appears to breach this section.

6. Resource use

Storage per user for each plan is shown on the Pricing page. Do not use the Service in a way that places an unreasonable load on shared infrastructure, such as automated bulk uploads or downloads designed to get around quotas, or using workspace storage as a backup target for unrelated systems.

Use of the Service must be reasonable. Helios may limit use that degrades the Service for other Customers, for example unusually high request rates or bandwidth.

7. Protected Health Information

Business Associate Agreements ("BAAs") will be available to customers subject to HIPAA once Helios's hosting move is complete; Helios does not offer them today. PHI may be handled in the Service only under the terms of a BAA that both parties have signed.

• Helios will offer BAAs once the Service runs on a hosting provider that signs a BAA. Until then, Helios does not offer BAAs or accept PHI.
• The Customer must not store or send PHI in the Service unless Helios and the Customer have signed a BAA.

8. Investigation and enforcement

If Helios reasonably believes this policy has been breached, it may investigate and may take one or more of these steps, in proportion to the breach: ask the Customer to fix the problem; remove or disable access to specific content; block or limit outgoing mail; suspend an Authorized User's account; suspend the Customer's workspace; or terminate the Agreement as set out in the Terms.

• Notice before suspension: Helios may suspend immediately where a violation creates a security or legal risk. Otherwise, Helios will give notice and 10 days to cure before suspending.
• Looking at Customer Data during an investigation: Helios staff will look at Customer Data during an abuse investigation only with the Customer's consent or where the law requires it.

Helios may report illegal content or activity to the authorities where the law requires or allows it. Fees during a suspension and any refund are governed by the Billing Policy.

9. Reporting abuse

To report spam, phishing, illegal content or other abuse coming from the Service, email support@helioscloudsuite.com with “Abuse” in the subject line. Please include the message headers, links or other details that show where the abuse came from.

To report a security vulnerability in the Service, follow the Vulnerability Disclosure Policy instead.

10. Changes to this policy

Changes to this policy take effect for an existing Subscription at the start of its next renewal term. Each version shows its "Last updated" date at the top of this page.