Acceptable Use Policy

This Acceptable Use Policy explains what you can and can't do when you use Authvio, whether you're an individual verifying your identity, a developer integrating our sign-in and verification tools, or anyone accessing our systems in any other way. It sits alongside our Terms of Service and our Privacy Policy, and it applies to everyone who touches the platform, no exceptions.

Authvio is a brand of Bolrach Technologies Limited. We built this policy in plain language on purpose. If something here is unclear, use the Legal support topic before you do the thing you're unsure about.

You may not use Authvio, or help anyone else use Authvio, to do any of the following:

• Fraud or impersonation. Creating or verifying an identity that isn't your own, submitting someone else's photo or documents as your own, or helping another person misrepresent who they are.
• Defeating verification or liveness checks. Using photos of photos, masks, deepfakes, screen replays, injected video, emulators, or any other method meant to trick our capture or liveness checks instead of presenting a real, live person.
• Scraping or harvesting identities. Automated collection, bulk export, or systematic scraping of verification results, profile data, or any personal information tied to an Authvio account.
• Reselling access. Reselling, sublicensing, renting, or otherwise passing on your access to Authvio's verification or sign-in services to a third party without our written agreement.
• Using claims beyond what was consented to. Requesting, storing, or acting on a verified claim (identity, age, or otherwise) for a purpose the user didn't agree to at the time they consented.
• Automated abuse of login or OTP endpoints. Scripting, brute-forcing, credential stuffing, or otherwise hammering our sign-in, password, or one-time-code endpoints outside normal human use.
• Reverse-engineering the verification engine. Attempting to extract, decompile, probe, or otherwise reverse-engineer the models, logic, or thresholds behind our document, face-match, or liveness checks.

If you're building on Authvio through the developer console or API documentation, a few extra rules apply on top of the ones above:

• Your app must not mislead users about who is asking for their information, why it's needed, or what Authvio actually verified.
• Only request the scopes your app genuinely needs. If you don't use a piece of data, don't ask for it.
• Don't store raw identifiers (document numbers, raw biometric templates, or similar) on your own systems. Store the verified claim or token we give you, not the underlying identity document.
• Keep your client secrets and API keys out of source control, mobile binaries, and anywhere else a user or attacker could pull them out.

We can suspend an app's access, with or without notice, if it puts users or the platform at risk.

If you find a security issue, report it through the Security support topic before public disclosure and give us a reasonable window to investigate and fix it.

• Test against accounts and data you created for that purpose. Never test against a real user's live identity data, account, or session without their explicit permission.
• Don't run automated scanners against production that could degrade service for other users.
• Don't access, modify, or delete data that isn't yours while researching an issue.

Good-faith research that stays inside these lines won't result in legal action from us.

How we respond depends on what happened and how serious it is. We generally follow this order, but we can skip straight to suspension or termination for anything involving fraud, safety, or repeat abuse:

• Warning. A notice explaining what rule was broken and what needs to change.
• Suspension. Temporary loss of access to your account, API keys, or app while we investigate.
• Termination. Permanent closure of the account or revocation of developer access.
• Referral to authorities. Where the conduct may involve fraud, identity theft, or another crime, we may report it when appropriate or legally required.

If you spot behavior on Authvio that looks like it breaks this policy, whether it's a suspicious app, a fake identity, or anything else, report it through the Security support topic. Include the app name, dates, safe references, and what you saw. Do not include passwords, codes, recovery keys, or identity-document images.

We may update this policy as Authvio grows and as new risks show up. If we make a material change, we'll update the date at the top of this page and, where required, notify account holders directly. Continuing to use Authvio after a change takes effect means you accept the updated policy.

Questions about this policy go through the Legal support topic. Security issues go through the Security support topic. You can also read our Terms of Service, Privacy Policy, Data Processing Agreement, and Cookie Policy for the rest of the picture.

Authvio is a brand of Bolrach Technologies Limited.