Acceptable Use Policy — Draft

The product lets administrators, teachers, teaching assistants, and students create or access course content, communications, assignments, submissions, grades, quiz material, and uploaded files.

If approved and validly accepted, this policy would apply to [PRODUCT NAME], operated by [COMPANY LEGAL NAME], and its authorized customers and users.

• Do not use the service for unlawful, deceptive, infringing, abusive, or harmful conduct.
• Do not exploit, groom, threaten, bully, harass, or endanger another person.
• Do not create, request, possess, or distribute child sexual abuse material.
• Do not expose another person’s grades, submissions, credentials, or private data without authority.
• Do not impersonate users, share accounts without permission, or bypass access controls.
• Do not introduce malware, denial-of-service traffic, abusive automation, or unauthorized security tests.
• Do not alter academic records dishonestly or help another person do so.
• Do not copy, resell, reverse engineer, or train a model on service content unless an approved agreement or mandatory law permits it.
• Do not use automated output alone for consequential educational, disciplinary, admissions, employment, or safeguarding decisions.

Relevant workflows accept text, sanitized Markdown, HTTP(S) links, and files up to 10 MB. Downloads are served as attachments through authorization-guarded routes.

Production file-safety policy and operational controls are incomplete. Exact gaps and proposed remediation remain documented in the internal security review.

Users must have authority to share content and must not upload malware, secrets, unlawfully obtained material, or content that violates another person’s rights. Institutions must configure membership carefully because course files are available to every active member of that course.

No abuse-report or safeguarding workflow is implemented. There is no case queue, account-suspension tool, moderation appeal, or emergency escalation path.

Reports require [ABUSE/SAFEGUARDING CONTACT] and security reports require [SECURITY CONTACT] after those channels are staffed and tested.

[LEGAL REVIEW REQUIRED] Define investigation, evidence preservation, notice, content restriction, role removal, suspension, termination, appeal, emergency disclosure, and institution or guardian escalation. Enforcement must be proportionate and documented.

Unauthorized production testing is prohibited. Authorized research requires written scope, targets, timing, data handling, safety, and disclosure terms.

No vulnerability-disclosure policy or staffed security-contact page exists.

Confirm [PRODUCT NAME], [COMPANY LEGAL NAME], [JURISDICTIONS], [AGE GROUPS], [REPORTING CONTACTS], [ENFORCEMENT OWNER], and [APPEAL PROCESS], then obtain qualified legal, safeguarding, and institutional review before acceptance.