Acceptable Use Policy

This policy is part of the Terms of Service. It exists because the Service issues documents with fiscal value, signed with a company’s certificate: an invoice that misrepresents a transaction harms the client named in it, the tax authority and every honest issuer.

1. Invoices and certificates

• Do not issue invoices for services that were not provided, for amounts that were not agreed, or to a client that did not take the service.
• Do not issue on behalf of an issuer you are not entitled to represent, and do not upload a certificate you are not authorised to use.
• Do not use cancellation and re-issue to disguise the date, the amount or the client of a transaction.
• Do not present a document issued in the sandbox, or a DANFSe you altered, to anyone as if it had fiscal value.

2. Content and data

• Load only the client data an invoice needs. Do not put special categories of data (health, biometrics, religious or political data) in service descriptions or internal notes.
• Do not load personal data you have no lawful basis to process, and do not use the client list for anything other than invoicing.
• Do not resell access without a written agreement.

3. Technical limits

• Do not attempt to reach another organisation’s data, or to bypass isolation, authentication or roles.
• Do not overload the Service or the government systems through it, and do not automate the interface to work around its limits.
• Security testing against your own organisation is welcome after you write to security@quathos.com, and unwelcome anywhere else. Report what you find there: we answer researchers, and we do not threaten them.

4. Enforcement

We would rather warn you than shut you down. For most breaches we contact you first and give you a chance to fix it. Where the abuse is severe or ongoing, or a certificate appears to be used without authorisation, we suspend new issuing first and explain immediately after. Your ability to download the invoices already issued survives any suspension. Where the law requires it, we report to the competent authorities. Report abuse to security@quathos.com.