AEGIS Finance OS — Acceptable Use Policy

**STATUS: DRAFT — researched against the Cybercrimes Act 19 of 2020, ECTA and POPIA (June 2026). Owner:

Charl. Best-effort, statute-grounded; not attorney-certified. This is the Acceptable Use Policy ("AUP")

referenced by the Terms of Service (§4.3, §14.2) and forms part of the Agreement. Last updated 2026-06-23.**

1. Purpose and scope

This AUP sets out how the AEGIS Finance OS platform may and may not be used. It applies to the Firm and to every user the Firm authorises. It forms part of the Agreement; capitalised terms have the meaning given in the Terms of Service. Breach of this AUP is a breach of the Agreement and may lead to suspension or termination (Terms §14).

2. Acceptable use

You may use the platform only:

• for the Firm's legitimate business of providing accounting, tax and compliance services;
• through authorised users, each keeping their credentials secure and confidential; and
• in compliance with all applicable law and this AUP.

3. Prohibited conduct — security and integrity

You must not, and must not permit anyone to:

• gain or attempt unlawful access to the platform, any account, tenant, or data you are not authorised to access

(Cybercrimes Act 19 of 2020, s2); intercept or attempt to intercept data (s3); or interfere with data, programs, storage or systems (s5–s6);

• acquire, use, or disclose any password, access code or similar device unlawfully (s7), or use any software

or hardware tool to commit any of the above (s4);

• attempt to defeat, probe or circumvent the platform's security or tenant isolation, or access another

Firm's or Client's data;

• conduct vulnerability scanning, penetration testing, or load/stress testing without our prior written

consent;

• introduce malware or any harmful code, or take any action that impairs or overloads the platform (including

denial-of-service), or exceed fair-use limits on compute, storage or API calls.

(Responsible-disclosure note: if you discover a security vulnerability, report it to us at [security email] and do not exploit it.)

4. Prohibited conduct — lawful and proper use

You must not use the platform to:

• commit or facilitate cyber fraud, forgery or uttering, or cyber extortion (Cybercrimes Act s8–s10), or any

other crime;

• process personal information you are not lawfully entitled to process, or in breach of POPIA — you are

responsible for obtaining the Client consents described in the Privacy Policy and DPA;

• infringe any intellectual property or other right, or upload content you have no right to upload;
• reverse-engineer, decompile, scrape, or perform automated bulk extraction outside the provided API, or

circumvent rate limits;

• resell, sublicense or share access except as permitted, or use the platform to build or assist a competing

product;

• impersonate any person, or provide false account information.

5. Proper use of automation and AI ("automate the labour, never the accountability")

The platform's Bots and AI propose; a qualified person must review and approve. You must not:

• use automated Output as a substitute for the Firm's professional judgement, or rely on it without review

(Terms §5);

• attempt to bypass the human-approval gate on actions that post to records or file with authorities (SARS,

CIPC, the Financial Intelligence Centre); or

• use the AI to generate unlawful, misleading or fraudulent content.

6. Your data-protection responsibilities

For Client data you process using the platform, the Firm is the Responsible Party under POPIA and AEGIS is the Operator (see the DPA and Privacy Policy). You must process personal information lawfully, only upload what you are entitled to, and apply your own access controls within the Firm.

7. Monitoring and enforcement

We do not generally monitor the content you process, and nothing in this AUP obliges us to (consistent with the Cybercrimes Act and POPIA). However, to protect the platform and other customers we may investigate suspected breaches, and we may suspend or terminate access for breach of this AUP (Terms §14). Where the law requires, or to protect rights or safety, we may report unlawful activity to the relevant authorities.

8. Reporting abuse

Report suspected breaches, security issues or abuse to [abuse/security email]. We will act on credible reports.

9. Changes

We may update this AUP from time to time; material changes are notified through the platform or by email and the "last updated" date will change. Continued use after that is acceptance.