Acceptable Use Policy (AUP)

What is an acceptable use policy?

An acceptable use policy (AUP) is a list of things you are not allowed to do with a vendor's product. It covers your whole team, not only the person who signed up.

The AUP is usually a separate page that the terms of service pulls in by link. That makes it part of your contract, even though you never signed it on its own. Lawyers call this incorporation by reference.

An AUP often bans things like:

• Attacking the service: probing for weaknesses, getting around security, or overloading the system.
• Harmful content: malware, illegal material, harassment or content that infringes someone's rights.
• Spam and abuse: bulk messages, fake accounts and impersonation.
• Scraping and copying: pulling data out in ways the vendor does not allow, or building a competing product.
• AI misuse: rules about what you may do with the vendor's AI features.

For a real example, Atlassian's Acceptable Use Policy groups its rules into disruption, wrongful activities, inappropriate communications and inappropriate content, with a separate set of rules for its AI features.

What it looks like in a vendor's terms

A typical clause reads like this:

You will not use the Services in violation of our Acceptable Use Policy, which we may update from time to time. If we believe you or your users have violated it, we may remove content or suspend or terminate your access, with or without notice. We may act on conduct not listed in the policy if it goes against the policy's purpose.

• "Which we may update": the vendor can add new bans without your signature.
• "You or your users": one employee's mistake counts against the whole account.
• "If we believe": the vendor decides whether a breach happened.
• "Suspend or terminate": the vendor can cut off access, sometimes with no warning. See suspension of service.
• "Conduct not listed": the list is not complete, so the vendor keeps room to judge.

Atlassian's AUP follows this pattern. It says Atlassian may suspend or terminate accounts, temporarily or permanently, and that it can act against conduct that is "inconsistent with the spirit of the guidelines," even if the conduct is not listed.

A real change we caught

Venpo flagged that OpenAI bans using ChatGPT to label or score data for rival AI. Labeling or scoring data is a common task when teams build or test their own AI models. A new ban like this can turn an existing workflow into a policy breach.

A similar change: Shopify now bars using its data to copy product catalogs beyond limited previews.

Why it matters to you

• Suspension risk: breaking the AUP can let a vendor suspend an account, as Atlassian's AUP shows. If the tool runs part of your business, a suspension stops that work.
• Bigger exposure: some contracts treat an AUP breach as more serious than other breaches. In Atlassian's Customer Agreement, a breach of the use restrictions, which include the AUP, is excluded from the normal liability caps.
• Changes without signature: AUPs can change on their own schedule. Slack's User Terms, for example, say Slack may change the User Terms or the Acceptable Use Policy, with reasonable notice for material changes.
• You answer for your team: you agree that your users will follow the rules, so you need to tell them what the rules are.

What to check

• Where the AUP lives: find the link in the ToS and save a copy of the current version.
• AI rules: check what you may not do with AI features or outputs, such as automated decisions or training other models.
• Suspension process: check whether the vendor must warn you and give you a chance to fix the problem first.
• Scraping and data export: make sure the way you move data out of the product is allowed.
• Change notice: check whether AUP changes get the same notice as ToS changes.

AI Usage Policy

An AI usage policy is a vendor's set of rules for what you may and may not do with its AI features or models. It may be its own document or a section of the AUP.

Rules often ban using the AI for certain high-risk decisions, getting around safety controls, or passing off AI output as human work. Atlassian's AUP, for example, bans using its AI for professional advice (legal, medical or financial) and for automated decisions with legal or similarly significant effects. It also bans tricking people into thinking they are talking to a human.

AI rules can also sit in other documents and change there. In one case, Grok's standard API is now off limits for personal data: SpaceXAI's DPA now allows personal data only through its zero data retention API, which matters if you send customer records to it.

Do not confuse a vendor's AI usage policy with your own internal AI policy. The vendor's policy limits what you can do with its product. Your internal policy is the set of rules you write for your staff about which AI tools they may use and with what data. See shadow AI for why that internal side matters.

Export Control Clause

An export control clause is a promise that you will follow export and sanctions laws when you use the vendor's product. Sanctions laws stop business with certain countries, groups and listed people.

Such a clause often bans using or sending the product to embargoed countries or to people on government restricted lists. Grafana Labs' MSA has you promise that you and your users are not on lists such as the US "Specially Designated Nationals and Blocked Persons" list. Atlassian's Customer Agreement bans sending its products to embargoed places or listed parties.

Vendors can widen these limits. In September 2025, Anthropic updated its regional restrictions to cover companies more than 50% owned, directly or indirectly, by companies based in regions where its products are not allowed. The limits now apply regardless of where those companies operate.

If you have owners, staff or customers abroad, read these clauses closely. A widened clause can cut off access for part of your business.

How Venpo helps

Venpo watches the acceptable use policies of the vendors you use, along with their AI and service terms, and emails you a plain-English alert when a rule is added or changed. Each vendor has a change history, so you can see which rules were in force when.