Doc 08 — Acceptable Use Policy

1. Who this Policy applies to

1.1 This Acceptable Use Policy ("Policy") applies to every User of the Website and the Platform. It is incorporated into Doc 01 — Website Terms of Use and Doc 02 — Platform Terms of Service. Customers are responsible for compliance by their invited Users (see Doc 02, clause 3).

2. Prohibited conduct

You must not, and must not attempt or help anyone else to:

2.1 Unlawful use. Use the Website or Platform for any unlawful purpose, including money laundering, terrorism financing, evasion of sanctions, fraud, bribery, tax evasion or concealment of beneficial ownership.

2.2 False or misleading information. Submit information or documents that are false, misleading, forged, altered or incomplete in a material way. This includes identity documents, beneficial-ownership information and any information a Participating Firm relies on. Your warranties as to accuracy are set out in Doc 03 — Singapore Terms of Business and Doc 14 — Client Authorisation; breach of this clause is also a breach of those warranties.

2.3 Impersonation. Impersonate any person or entity, misrepresent your authority to act for a Customer, or use another person's identity or credentials.

2.4 Circumventing controls. Circumvent, disable or interfere with identity-verification or KYC steps, screening, human-review or approval gates, kill-switches, or any other compliance or security control — including manipulating inputs so that a review step is skipped or a record is marked in a state it has not genuinely reached.

2.5 Scraping and harvesting. Scrape, crawl, harvest or bulk-extract data from the Website or Platform, or collect personal data of other Users, except through interfaces we expressly provide for that purpose.

2.6 Unauthorised access and testing. Access or attempt to access accounts, systems or data without authorisation; probe, scan or test the vulnerability of any system; carry out penetration testing or load, stress or performance testing without our prior written agreement.

2.7 Malware and interference. Introduce malware or other harmful code; interfere with or disrupt the integrity, performance or availability of the Platform or the data in it, including by sending unsolicited bulk messages through Platform communication features.

2.8 Reselling. Resell, sublicense, white-label or make the Platform available to third parties as a service, except under a written agreement with DPW (see Doc 11 — Participating Firm Terms and Doc 12 — Marketplace/Professional Network Terms for firm arrangements).

2.9 Misuse of AI features. Misuse AI-assisted tooling (see Doc 09 — AI / Automation Terms (the "AI Terms")), including: attempting prompt injection or otherwise manipulating AI features to bypass safeguards, extract other parties' data or produce unintended behaviour; presenting or relying on AI output as professional, legal, tax or accounting advice; or using AI features to generate unlawful, deceptive or infringing content.

2.10 Abusive conduct. Harass, threaten, abuse or discriminate against DPW staff, a Participating Firm's personnel or any Professional, whether through the Platform or any related channel. We and Participating Firms owe duties of care to our and their people; we may restrict or end interactions to protect their welfare.

2.11 IP infringement. Upload or transmit content that infringes intellectual property or confidentiality rights of any person, or remove or alter proprietary notices.

2.12 Sensitive data in the wrong fields. Enter full payment card numbers, banking credentials, passwords or similar secrets into free-form fields (such as chat, notes or document-name fields). Use only the designated secure flows for payments and credentials.

3. Enforcement

3.1 We apply a graduated approach where appropriate: (a) warning with an opportunity to correct; then (b) suspension of some or all access under Doc 02, clause 8; then (c) termination under Doc 02, clause 13.3.

3.2 For serious cases — including suspected money laundering, terrorism financing, sanctions issues, fraud, forged documents, attacks on the Platform or threats to any person — we may suspend or terminate immediately without prior warning.

3.3 Enforcement decisions are made by DPW personnel. We will state the reason where lawful; we may withhold reasons where disclosure is prohibited (for example, where tipping-off restrictions apply) or would compromise security or an investigation.

4. Reporting to authorities

4.1 Where required or permitted by law, DPW and Participating Firms may report suspected unlawful activity to the relevant authorities and provide related records, and may preserve evidence of suspected violations. Nothing in this Policy limits any person's statutory reporting obligations.

5. Effect on pending Engagements

5.1 Suspension or termination of Platform access under this Policy does not by itself terminate an Engagement with a Participating Firm. Where you have a pending Engagement:

(a) we will hand over the matter and relevant records to the Participating Firm so it can decide, under Doc 03 and its own legal obligations, whether and how to continue, pause or end the Engagement; and

(b) statutory duties are unaffected — the Firm's obligations (including retention of customer due diligence records for at least the statutory minimum period) and any obligations of the Customer's company under Singapore law continue regardless of Platform access.

6. Changes and questions

6.1 We may update this Policy under the change process in Doc 02, clause 17. Questions about this Policy: privacy@csfile.ai.