Effective Date: August 15, 2014
Last Updated: October 21, 2026

This Acceptable Use Policy ("Policy") governs theuse of software, websites, applications, application programming interfaces("APIs"), mobile applications, communications capabilities, and otherSoftware as a Service offerings provided by Soleran, Inc.("Soleran"), collectively referred to as the "Services."

This Policy is intended to protect the security,availability, integrity, and lawful use of the Services and the informationprocessed through them.

By accessing or using the Services, users agree to complywith this Policy. Organizations that provide access to the Services to theiremployees, contractors, agents, or other authorized users are responsible forensuring that those users comply with this Policy.

1. Lawful and Appropriate Use

The Services may only be used for lawful, authorizedbusiness purposes.

Users may not use the Services to:

• Violate any applicable local, state, federal, or international law, regulation, court order, or governmental requirement;

• Create, upload, store, transmit, publish, or distribute content that is unlawful, fraudulent, threatening, defamatory, obscene, harassing, or otherwise prohibited by applicable law;

• Infringe or misappropriate copyrights, trademarks, patents, trade secrets, privacy rights, publicity rights, or other intellectual property or proprietary rights;

• Facilitate, encourage, or assist fraudulent, deceptive, or criminal activity;

• Impersonate another person or organization or otherwise misrepresent the user's identity, authority, affiliation, or origin of communications;

• Use the Services in a manner that violates the legal rights of another person or organization; or

• Use the Services for purposes that are materially inconsistent with the intended business use of the Services.

2. Account and Authentication Security

Users are responsible for maintaining the confidentiality and security of their accounts and authentication credentials.

Users may not:

• Share passwords, authentication tokens, API credentials, session information, or other credentials except where expressly supported by the Services;

• Access or attempt to access another user's account without authorization;

• Obtain, collect, use, or disclose another person's authentication credentials without authorization;

• Circumvent, disable, interfere with, or attempt to bypass authentication, multi-factor authentication, authorization controls, session controls, or other security mechanisms;

• Use another person's identity or account to conceal the user's identity or activity; or

• Allow unauthorized persons to access the Services through their account.

Users must promptly notify their organization or Soleran, as appropriate, if they know or reasonably suspect that credentials or accounts have been compromised.

3. Security and Technical Restrictions

Users may not compromise, test, or interfere with the security of the Services except pursuant to prior written authorization from Soleran.

Prohibited activities include:

• Accessing or attempting to access systems, functions, records, databases, files, accounts, or information for which the user has not been authorized;

• Probing, scanning, testing, or attempting to identify vulnerabilities in the Services or infrastructure supporting the Services without prior written authorization;

• Performing penetration testing, vulnerability scanning, automated security testing, or similar activities without prior written authorization;

• Circumventing or attempting to circumvent access controls, security controls, rate limits, usage limits, or other technical restrictions;

• Exploiting or attempting to exploit a vulnerability, configuration error, software defect, or other weakness;

• Introducing or distributing viruses, ransomware, worms, Trojan horses, malicious scripts, malicious code, or other harmful software or content;

• Using password cracking, credential stuffing, password spraying, keylogging, packet interception, exploitation frameworks, or similar techniques against the Services;

• Performing unauthorized port scanning, network reconnaissance, traffic interception, or network analysis;

• Attempting to obtain source code, underlying algorithms, security mechanisms, or non-public technical information through unauthorized reverse engineering, decompilation, disassembly, or other means, except to the extent such restrictions are prohibited by applicable law; or

• Modifying, tampering with, disabling, or interfering with the operation or security of the Services.

Good-faith security research must be coordinated with and expressly authorized by Soleran before testing is performed against production systems or Services.

4. Malware, Phishing, Fraud, and Social Engineering

The Services may not be used to create, distribute, facilitate, or support:

• Malware, ransomware, spyware, malicious scripts, or other malicious software;

• Phishing or credential-harvesting campaigns;

• Fraudulent websites, forms, surveys, communications, or workflows;

• Business email compromise or impersonation schemes;

• Social engineering intended to obtain credentials, confidential information, money, or unauthorized access; or

• Content or communications intentionally designed to deceive recipients regarding their origin or purpose.

5. Email, Messaging, and Communications

When communications functionality is provided through the Services, users must comply with applicable communications and anti-spam laws and regulations.

Users may not:

• Send unsolicited bulk or commercial communications in violation of applicable law;

• Send communications to recipients when the sender does not have an appropriate legal or business basis to contact them;

• Falsify sender information, routing information, message headers, caller information, or other identifying information;

• Send messages intended primarily to consume excessive resources or disrupt another system or account;

• Use the Services to conduct phishing, fraud, harassment, or deceptive marketing campaigns; or

• Use messaging capabilities in violation of applicable requirements governing commercial email, telephone, SMS, or other electronic communications.

Users are responsible for maintaining any consent, opt-in, opt-out, or other records required for communications they initiate through the Services.

Soleran-Branded Workflow SMS Messaging

Where available, customers may configure operational workflow notifications delivered by SMS under the Soleran sender identity. Permitted purposes include work order assignments, maintenance activity, task reminders, approvals, status updates, and escalations directly related to authorized business workflows. Authentication messages remain a separate SMS use case.

Customers must identify intended recipients accurately, obtain and document all consent required by applicable law and carrier or messaging-provider rules, and ensure that the scope of consent covers Soleran-branded workflow notifications. Customer configuration of a workflow or possession of a mobile number alone does not establish recipient consent.

Customers must not send unsolicited, promotional, political, fraudulent, harassing, misleading, or prohibited messages; evade carrier filters or rate limits; use purchased or scraped contact lists; or continue sending after an applicable opt-out. Customers must not include sensitive medical, financial, authentication, or confidential record details in SMS where disclosure would be inappropriate; messages should instead direct recipients to authenticate to the Service.

Customers must promptly honor recipient withdrawal and maintain accurate contact information. Soleran may apply recipient suppression, messaging quotas, throttling, content safeguards, and suspension of messaging features to prevent abuse, protect service availability, or comply with AWS, carrier, and legal requirements. Customers remain responsible for workflow triggers and message content they configure.

6. Data, Privacy, and Confidential Information

Users may only access, collect, enter, upload, process, disclose, export, or otherwise use information through the Services when authorized to do so.

Users may not:

• Access information outside the scope of their authorized responsibilities;

• Attempt to circumvent application permissions, roles, groups, tenant boundaries, record-level permissions, or other data access controls;

• Collect, copy, scrape, harvest, download, or export information through unauthorized means;

• Use automated methods to extract information from the Services except through functionality or APIs expressly provided or authorized by Soleran;

• Upload or process information when doing so violates applicable privacy, confidentiality, contractual, or regulatory obligations;

• Disclose confidential or sensitive information obtained through the Services to unauthorized parties; or

• Attempt to access information belonging to another Soleran customer or tenant.

Customers and users are responsible for determining whether they are legally permitted to collect and process information they submit to the Services and for configuring their use of the Services appropriately for their legal and regulatory obligations.

7. APIs, Integrations, and Automated Access

Where Soleran provides APIs, integrations, import/export functionality, automation capabilities, or other programmatic access, such capabilities must be used only as authorized and documented.

Users may not:

• Attempt to discover, access, or use undocumented or unauthorized APIs or endpoints;

• Circumvent API authentication, authorization, rate limits, quotas, or other restrictions;

• Use automated tools to create an unreasonable or disproportionate load on the Services;

• Use bots, crawlers, scripts, or automated agents to access the Services except as expressly permitted;

• Provide API credentials, access tokens, or other integration credentials to unauthorized parties;

• Use integrations to access information beyond the permissions granted to the user or integration; or

• Use an integration or third-party application to perform an activity that would otherwise violate this Policy.

Customers are responsible for integrations, applications, scripts, and automated processes they configure or authorize to interact with the Services.

8. Artificial Intelligence and Automated Technologies

Users may use artificial intelligence ("AI"), machine learning, automated agents, or similar technologies with the Services only when such use is authorized and complies with applicable law, contractual obligations, organizational policies, and this Policy.

Users may not use AI or automated technologies to:

• Circumvent security, authentication, authorization, or usage controls;

• Conduct unauthorized automated access, scraping, reconnaissance, vulnerability testing, or exploitation;

• Generate, submit, or distribute malicious code or harmful content through the Services;

• Misrepresent AI-generated information as having been created or approved by Soleran;

• Automatically make unauthorized changes to information, configuration, permissions, or workflows; or

• Submit confidential, sensitive, personal, or regulated information to an external AI service when the user is not authorized to disclose that information to the applicable service.

Users remain responsible for actions performed through AI systems, automated agents, scripts, integrations, or other automated technologies operating under their accounts or credentials.

9. Intellectual Property and Software Restrictions

Unless expressly authorized by Soleran or applicable law, users may not:

• Copy, modify, distribute, sell, sublicense, lease, or otherwise transfer proprietary software or components provided as part of the Services;

• Remove or alter copyright, trademark, proprietary, or attribution notices;

• Create or distribute unauthorized modifications, patches, cracks, or mechanisms intended to circumvent licensing or technical restrictions;

• Reproduce or use proprietary Soleran materials outside the scope permitted by the applicable agreement; or

• Use Soleran intellectual property in a manner that falsely suggests sponsorship, endorsement, or affiliation.

10. Service Availability and Resource Usage

Users may not use the Services in a manner that adversely affects the availability, reliability, performance, or security of the Services or systems used to provide them.

Prohibited activities include:

• Denial-of-service or distributed denial-of-service attacks;

• Flooding or intentionally overloading networks, servers, APIs, applications, queues, databases, or other resources;

• Generating excessive automated requests or traffic;

• Intentionally consuming disproportionate computing, storage, network, messaging, or other resources;

• Attempting to crash, degrade, disable, or disrupt a host, service, application, network, or account; or

• Interfering with another customer's or user's ability to access or use the Services.

Soleran may implement reasonable technical controls, including rate limits, resource limits, or other safeguards, to protect the availability and security of the Services.

11. Third-Party Services and Integrations

The Services may allow customers to connect to third-party applications, identity providers, APIs, data sources, or other services.

Users are responsible for ensuring that they have appropriate authorization to connect and use third-party services and that their use complies with applicable agreements, laws, and policies.

Users may not use the Services to gain unauthorized access to a third-party system or to circumvent security or usage restrictions imposed by a third-party provider.

12. Prohibited Attempts

An attempt to perform a prohibited activity is itself prohibited under this Policy, even if the attempt is unsuccessful.

Users may not assist, encourage, direct, enable, or knowingly permit another person or automated system to perform an activity prohibited by this Policy.

13. Security Vulnerability Reporting

Users who discover a suspected security vulnerability involving a Soleran Service should not exploit the vulnerability, access information beyond what is necessary to identify the potential issue, or perform additional testing that could affect the confidentiality, integrity, or availability of the Services.

Suspected security vulnerabilities should be reported promptly to Soleran through an authorized Soleran support or security contact.

14. Enforcement

Soleran may investigate suspected violations of this Policy.

When reasonably necessary to protect Soleran, its customers, users, systems, or third parties, Soleran may take appropriate action in accordance with applicable customer agreements. Such actions may include:

• Limiting or blocking specific activities;

• Disabling integrations, API credentials, sessions, or other access mechanisms;

• Temporarily restricting or suspending access;

• Requiring remediation of insecure or abusive configurations;

• Preserving information relating to suspected security incidents; or

• Taking other reasonable measures necessary to protect the security, integrity, or availability of the Services.

Serious or repeated violations may result in termination of access in accordance with the applicable agreement.

Where required by law or appropriate under the circumstances, Soleran may cooperate with authorized governmental, regulatory, or law-enforcement authorities.

15. Changes to This Policy

Soleran may update this Policy periodically to address changes in technology, security practices, legal or regulatory requirements, or the Services.

The current version of this Policy will identify its most recent revision date.

16. Contact Information

Questions regarding this Policy or the acceptable use of Soleran Services may be directed to Soleran.

Soleran, Inc.

7500 College Blvd

Overland Park, KS 66210

United States

Phone: 1-866-765-5522

Security Notifications

Soleran reserves the right to notify its subscribers of information that materially affects the security, integrity, availability, or appropriate use of Soleran products or Services.

‍