Acceptable use policy

1. Use the Service lawfully

You must follow every law that applies to you, to the people you send documents to, and to the documents themselves. This includes laws on electronic signatures, contracts, consumer protection, privacy and data protection, anti-spam, employment, financial services, health information, export controls and sanctions.

You are responsible for deciding whether a document can be signed electronically, which identity check is suitable, and whether any consent, disclosure, witness, notary or filing is required. eSora Sign is a tool. It does not give legal advice and is not a party to your documents.

2. Fraud, deception and financial crime

You must not use the Service to:

• Commit or help commit fraud, scams, phishing, identity theft or forgery.
• Trick, pressure or mislead anyone into signing, for example by hiding important terms, misdescribing a document, swapping pages, or changing a document after someone has agreed to it.
• Create, sign or send documents for money laundering, terrorist financing, fraud on lenders or insurers, tax evasion, or to get around know-your-customer or anti-money-laundering checks.
• Run pyramid or Ponzi schemes, fake investment offers, advance-fee schemes, debt-relief or credit-repair scams, or fake prize or lottery claims.
• Sell or arrange anything that is illegal where you or the signer are, including unlicensed gambling, illegal drugs, weapons or explosives without the required licence, counterfeit goods, or stolen property.
• Take part in human trafficking, forced labour, or any form of exploitation.

3. Impersonation and signing authority

You must not:

• Pretend to be another person, company, government body or official, or suggest you represent an organization when you do not.
• Sign, or let anyone else sign, in another person's name, unless the law allows it and you have their clear authority, such as a valid power of attorney or an authorized signatory role.
• Use another person's email address, phone or identity documents to pass an identity check.
• Backdate documents or signatures, or present a document as signed on a date it was not.
• Use our name, logos or certificates to suggest that eSora Labs endorses you, your document, or its contents.
• Hide or disguise who is sending a request. Every request must show the real sender or organization.

4. Integrity of signatures, seals and records

The value of eSora Sign depends on signatures, seals, certificates and audit trails being trustworthy. You must not:

• Alter, remove or forge a tamper seal, trusted timestamp, certificate of completion, audit trail, Sign ID or Document ID.
• Present an edited copy as the original signed document, or claim a document passed our Verify check when it did not.
• Delete, change or suppress records to defeat a legal hold, investigation, audit or court order.
• Use the Verify page or API to test forgeries, or to work out how to defeat our checks.

5. Consent and communications

Every email, text message and reminder you send through eSora Sign goes out in your name. You must:

• Send requests only to people who expect them or with whom you have a real business, employment or personal relationship.
• Never use bought, rented, scraped or harvested contact lists, and never use eSora Sign for marketing or advertising messages.
• Follow anti-spam and messaging laws, including Canada's Anti-Spam Legislation (CASL), the US CAN-SPAM Act and the Telephone Consumer Protection Act (TCPA), and the rules of mobile carriers for text messages.
• Stop sending to anyone who asks you to, declines, or withdraws their consent to sign electronically.
• Not use reminders, bulk send or public links to harass, pressure or overwhelm anyone.

6. Content you must not upload or send

• Child sexual abuse material, or any content that sexualizes minors. We report it to the authorities, including the Canadian Centre for Child Protection and the US National Center for Missing and Exploited Children, and close the account.
• Intimate images of anyone shared without their consent.
• Content that threatens, harasses, bullies or incites violence or hatred against people based on race, ethnicity, national origin, religion, gender, gender identity, sexual orientation, disability, age or any other protected characteristic.
• Content that promotes terrorism or violent extremism.
• Defamatory content, or private information about someone published to harm them.
• Malware, viruses, ransomware, phishing pages, or links to any of them, including inside PDF files, attachments or form fields.
• Content that infringes copyright, trademarks, trade secrets, or other rights. See our Copyright and takedown page.

7. Sensitive and regulated information

Keep sensitive information out of places that are not built for it. You must not:

• Ask signers to type payment card numbers, bank account numbers, passwords, or full government ID numbers into text fields. Use the photo ID check for identity, and a payment provider for payments.
• Use eSora Sign to store or send personal health information that is regulated (for example under HIPAA, PHIPA or similar laws) unless you are on a plan that supports it and we have signed the agreement that law requires, such as a business associate agreement.
• Collect more personal information than the document needs, or use information collected through eSora Sign for anything the signer did not agree to.
• Process personal information without a lawful basis, or send it to a country where the law does not allow it to go.

8. Documents that may need more than an e-signature

Some documents need wet-ink signatures, witnesses, a notary, a commissioner, a registered filing, or a special form of electronic signature. Depending on where you are, these can include wills and codicils, certain powers of attorney, land transfers and mortgages, some family-law and court documents, negotiable instruments, and some government forms. You must check the rules before using eSora Sign for them. We may warn you when a document looks like one of these, but that warning is not legal advice and its absence does not mean an e-signature is enough.

9. High-risk uses

Do not rely on the Service where a failure, delay or error could lead to death, personal injury, or serious physical or environmental damage, such as emergency services, life-support or medical-device decisions, aircraft or vehicle control, or nuclear facilities. The Service is not designed or certified for those uses.

10. Security and the integrity of the Service

You must not:

• Probe, scan or test the security of our systems, except as allowed in our Responsible disclosure policy.
• Break or get around authentication, identity checks, rate limits, plan limits, access controls or encryption.
• Access, or try to access, another customer's workspace, documents or data.
• Overload or disrupt the Service, including through denial-of-service attacks, flooding, or automated traffic beyond normal use.
• Scrape, crawl or harvest the Service or the information in it, other than through the API as documented.
• Reverse engineer, decompile or disassemble the Service, except to the extent the law allows despite this restriction.
• Upload files built to exploit software, such as malicious or malformed PDFs.
• Create accounts with bots or false information, or create many accounts to get around Free plan limits.

11. Accounts and access

• Each member account is for one person. Do not share sign-in links, passkeys, codes or API keys.
• Keep your account details accurate, and keep at least one workspace admin with a working email address.
• Do not sell, rent, sublicense or resell access to the Service, or offer it as part of your own product, without a written agreement with us.
• Remove people from your workspace promptly when they should no longer have access.

12. API, integrations and embedded signing

• Keep API keys and webhook secrets confidential, store them securely, and rotate them if they may have been exposed.
• Stay within the documented rate limits and do not hide or rotate keys or accounts to get around them.
• Verify the signature on every webhook before trusting it.
• If you embed signing in your own app, show signers who is asking them to sign and do not hide or change our consent and disclosure screens.
• Do not use the API or data from it to build a competing e-signature product, or to benchmark the Service for publication without our written permission.

13. AI agents and AI features

• You are responsible for every action an agent takes in your workspace, exactly as if you had taken it yourself.
• An agent may prepare, route and remind. It must not sign on anyone's behalf, approve documents without a human approval rule, or send requests outside the rules you set.
• Do not use AI features to create misleading or fraudulent documents, to impersonate anyone, or to produce content this policy prohibits.
• Do not try to get around safety controls through prompt injection or similar techniques, or try to extract the underlying models, prompts or data.
• Check AI output before you rely on it. Summaries, translations and contract review can be wrong and are not legal advice. See our AI features terms.

14. eSora PDF tools

• Only upload files you own or have the right to process.
• Use Unlock PDF only on files whose password you are entitled to know. Do not use the tools to get around copy protection, digital rights management or access controls that you are not authorized to remove.
• Check redacted files before you share them. Redaction removes the matching text, but you are responsible for making sure everything sensitive is covered.

15. How we enforce this policy

We do not monitor every document, but we may review accounts, documents, links and activity when we receive a report, when our automated systems flag a risk, when the law requires it, or to protect the Service and its users. Our staff access customer content only as described in our Terms of service and Privacy notice, and every access is logged.

If we believe this policy has been broken, we may, at our discretion and without liability:

• Warn you and ask you to fix the problem.
• Remove or disable content, documents, links or templates.
• Pause or cancel requests that are out for signature, and tell recipients that a request was stopped.
• Limit features such as bulk send, public links, SMS, the API or AI features.
• Suspend or close accounts and workspaces, and refuse future service.
• Keep relevant records and evidence, and share them with the authorities or affected people where the law requires or allows it.

We usually give notice and a chance to fix the problem first. We may act immediately and without notice where there is a risk of harm, fraud, legal liability, or damage to the Service. Fees are not refunded for accounts suspended or closed because this policy was broken, except where the law requires.

16. Reporting misuse

If you receive a request you did not expect, or think someone is misusing eSora Sign, write to abuse@esorasign.com. Include the sender, the date, the document name or Document ID, and what happened. Do not forward the signing link to anyone else.

Report security problems under our Responsible disclosure policy at security@esorasign.com. Report copyright issues to copyright@esorasign.com.

If someone is in immediate danger, contact local emergency services first. Child sexual abuse material can also be reported directly to Cybertip.ca in Canada or the NCMEC CyberTipline in the United States.

17. Appeals

If you think we acted in error, reply to our notice or write to abuse@esorasign.com within 30 days. A person who was not involved in the original decision will review it and reply, usually within 5 business days. We may keep a restriction in place while we review it.

18. Your responsibility and changes to this policy

You are responsible for the conduct of everyone who uses your workspace and every agent or integration you connect. You agree to defend and compensate us for claims that arise from a breach of this policy, as set out in the Terms of service.

We may update this policy as laws, risks and the Service change. We will post the new version here with a new date, and will email workspace owners about significant changes. Continuing to use the Service after a change takes effect means you accept it.