Acceptable Use Policy
In short: use AmazFlow only for work you are authorised to do, put a human approval gate in front of high-impact actions, and keep regulated data on approved systems. The full list is below.
This Policy is incorporated into the Master Services Agreement (“MSA”) between AmazFlow, LLC and Customer. Capitalised terms not defined here have the meaning given in the MSA.
Prohibited uses
Customer will not, and will not permit any Authorized User or Workflow configuration to:
- violate any applicable law, regulation, sanctions program, or export-control restriction;
- access, modify, or exfiltrate data or systems Customer is not authorised to access, including by configuring a Workflow to act using credentials or permissions the underlying account holder has not actually authorised;
- take a high-impact action — including financial transfers or refunds, access grants or revocations, deletion of records, healthcare or benefits determinations, legal filings, or payroll changes — without a human-approval gate commensurate with that action’s risk;
- process regulated data (including protected health information, payment card data, or government identification numbers) through a system, connector, or data classification not approved for that category under the applicable Order Form, Data Processing Agreement, or Business Associate Agreement;
- send unsolicited bulk communications, engage in phishing, or otherwise violate the CAN-SPAM Act, TCPA, or comparable law;
- disable, circumvent, or interfere with the Service’s approval gates, verification steps, audit logging, or other safety and accountability controls;
- develop a competing product, or benchmark the Service for a competitor’s commercial purpose, without AmazFlow’s written consent;
- introduce malware, or conduct penetration testing or vulnerability scanning against AmazFlow’s infrastructure without prior written authorisation (to report a vulnerability, see our Security page); or
- cause material harm to any individual, including configuring an automated action affecting a healthcare, benefits, or safety-critical determination without a human-approval gate.
Responsibility for workflow configuration
Customer is solely responsible for the Workflows it configures, including determining the appropriate approval thresholds, data classifications, and authorised systems for each Workflow, consistent with the MSA and the Data Processing Agreement.
Enforcement
AmazFlow may investigate suspected violations and may suspend or restrict access to a specific Workflow, connector, or account where reasonably necessary to prevent or stop a violation, prior to formal termination proceedings under the MSA. AmazFlow will provide notice of such a suspension as soon as reasonably practicable, except where notice itself would increase risk (for example, an active unauthorised-access situation).
Reporting a violation
To report a suspected violation of this AUP by another AmazFlow customer, contact security@amazflow.com.