Acceptable Use Policy Template For SaaS Platforms

Mia runs a Wellington SaaS platform that helps teams share project updates. One Monday morning, her support inbox is full of complaints: one customer account has started posting abusive comments, another is sending thousands of invite emails, and someone is scraping user profiles through the search page.

Her SaaS terms say users must not misuse the platform, but they don't explain what misuse means or what Mia can do about it. Can she suspend the accounts? Remove the content? Keep the platform running for everyone else?

This is where a well-drafted acceptable use policy can do a lot of heavy lifting. It gives your users clear rules, gives your team a practical playbook, and helps you act quickly when harmful use threatens your platform.

What Should An Acceptable Use Policy Do For Your SaaS Platform?

An acceptable use policy should turn your platform rules into clear, enforceable standards for how users can and can't use your SaaS product.

Your AUP isn't just a list of bad behaviour. A good one helps you:

• Set rules for user conduct, content and technical use
• Explain what users can't upload, send, scrape, copy or attack
• Reserve your right to suspend accounts, remove content or limit features
• Protect other customers from spam, security abuse and harmful material
• Give your internal team a consistent process when something goes wrong

For New Zealand SaaS businesses, your AUP should also sit neatly beside laws that often affect digital platforms. Depending on what your platform does, this may include the Privacy Act 2020, the Fair Trading Act 1986, the Consumer Guarantees Act 1993, the Unsolicited Electronic Messages Act 2007, the Harmful Digital Communications Act 2015 and the Copyright Act 1994.

You don't need to turn your AUP into a legal textbook. In fact, that usually makes it harder to use. The goal is to write rules that your customers, your support team and your product team can actually understand.

Do You Need A Separate AUP If You Already Have SaaS Terms?

Yes, most SaaS platforms should have a separate AUP if user behaviour, content, integrations or technical activity could create risk for the platform or other users.

Your SaaS terms usually cover the broader commercial relationship. For example, they deal with fees, payment, subscription periods, liability, intellectual property, support, privacy references and termination.

Your AUP is more operational. It answers questions like:

• Can a user send bulk messages through your platform?
• Can they upload adult, hateful, misleading or infringing content?
• Can they use bots, crawlers or automated scripts?
• Can they test your security controls without permission?
• What happens if their account is used to attack other users?

You can keep the AUP as a separate document, but your SaaS terms should clearly incorporate it. That way, when a user accepts your platform terms and conditions, they also agree to the AUP.

Be careful with how you change it. If you reserve a broad right to change your AUP at any time, the change process should still be fair and transparent. Under the Fair Trading Act 1986, you shouldn't say one thing in your sales materials and then hide a very different rule in your AUP. If consumers use your platform, the Consumer Guarantees Act 1993 may also affect how far you can limit your obligations.

A practical approach is to let yourself update the AUP for security, legal, technical or product reasons, while giving notice where the change materially affects normal use.

What Should You Put In An Acceptable Use Policy Template?

Your AUP template should cover the main ways your platform could be misused, then connect those rules to the actions you can take if a user breaches them.

Here is a drafting outline you can adapt. It isn't a finished legal document, and it should be tailored by a lawyer or legal team before you use it with customers.

1. Purpose: Explain that the AUP protects the platform, other users, data security and lawful use.
2. Who It Applies To: Cover customers, authorised users, admins, contractors, invitees and anyone using an account or API key.
3. General User Responsibilities: Require users to comply with laws, keep credentials secure and use the platform only for permitted business purposes.
4. Prohibited Content: Ban content that's unlawful, harmful, abusive, misleading, discriminatory, sexually exploitative, infringing or privacy invasive.
5. Spam And Messaging Rules: Set limits on unsolicited messages, bulk invitations, scraping contacts and using your platform to send unlawful commercial electronic messages.
6. Security Abuse: Prohibit malware, credential stuffing, vulnerability scanning, bypassing access controls, excessive load testing and unauthorised penetration testing.
7. Scraping And Automated Use: Restrict bots, crawlers, data harvesting, reverse engineering and automated account creation unless you have given written permission.
8. User-Generated Content Licence: Say what licence the user gives you to host, process, display and remove content as needed to operate the platform.
9. API And Integration Rules: Cover rate limits, API key security, resale, excessive calls and use of third-party integrations.
10. Enforcement Rights: Set out when you can warn, throttle, remove content, suspend access, terminate accounts or report serious misuse.
11. Investigation Process: Explain that you may review logs, preserve evidence, contact admins and ask for information where reasonably needed.
12. Changes To The AUP: Say how updates will be made and when users will be notified of material changes.

The exact wording depends on your product. A project management tool, an AI writing platform, a marketplace and a developer API all need different acceptable use rules.

How Should Your AUP Deal With Harmful Use, Spam And Security Abuse?

Your AUP should name the behaviours you need to stop quickly, especially where one user's conduct can harm other users or the platform itself.

Harmful Use

Harmful use rules should cover content or conduct that creates real risk for your business. This might include harassment, threats, hate content, non-consensual intimate material, impersonation, scams, misleading claims or content that encourages self-harm.

The Harmful Digital Communications Act 2015 may be relevant where online communications cause serious emotional distress. You don't need to decide every legal issue yourself, but your AUP should give you room to remove content or suspend access where a safety risk is credible.

Spam

If your platform allows invites, notifications, direct messages, email campaigns or user outreach, your AUP should have a clear anti-spam clause in your user terms.

In New Zealand, the Unsolicited Electronic Messages Act 2007 deals with commercial electronic messages. In practical terms, users shouldn't use your platform to send commercial messages unless they have consent, identify themselves properly and include a working unsubscribe facility where required.

Security Abuse

Security abuse clauses should cover both obvious attacks and quieter misuse. For example:

• Introducing malware or malicious code
• Trying to access another user's account or data
• Testing vulnerabilities without written approval
• Using stolen credentials or automated login attempts
• Overloading the platform with excessive requests
• Mining cryptocurrency or running unauthorised background processes

Say Mia's platform usually sends about 400 invite emails per day. One account suddenly sends 10,000 invites in two hours, with identical promotional text and a high bounce rate. Her AUP lets her pause the account's invite feature, preserve the sending logs, contact the customer's admin and require them to explain the activity before reactivating it. That's much cleaner than arguing over whether a vague don't misuse our system clause is enough.

How Do Suspension Rights Work Without Upsetting Good Customers?

Suspension rights work best when they're specific, graduated and tied to real risk.

You want enough control to act fast when there's spam, abuse or a security threat. At the same time, a legitimate customer shouldn't feel like you can switch off their business tools for no reason.

A balanced AUP usually separates enforcement options into levels:

• Content removal: You can remove or disable specific content that breaches the AUP.
• Feature limits: You can pause risky features, such as messaging, API access or file uploads.
• Rate limiting: You can slow or cap traffic that creates load, scraping or security concerns.
• Temporary suspension: You can suspend an account while you investigate a serious or urgent issue.
• Termination: You can end access for repeated, serious or unfixable breaches, if your SaaS terms allow it.

Your AUP should also say whether you'll give notice. A common approach is to give notice and a chance to fix the issue where the risk is low. For urgent risks, you may need to act immediately and explain afterwards.

For example, you might give a customer 48 hours to remove prohibited marketing content. But if their account is actively serving malware or scraping other users' personal information, immediate suspension is usually more appropriate.

Keep records of what happened, what you saw, what action you took and who approved it. If a customer complains later, good records help show that you acted consistently and for a valid platform protection reason.

How Should Your AUP Handle User-Generated Content And Scraping?

Your AUP should deal with user-generated content and scraping because both can create legal, privacy and commercial risk for a SaaS platform.

User-Generated Content

If users can upload, post, message, store, publish or share content, your AUP should make users responsible for what they put into the platform.

You should usually prohibit content that:

• Infringes copyright, trade marks or someone else's licence rights
• Contains personal information that the user has no right to share
• Is misleading, deceptive or impersonates another person or business
• Is abusive, threatening, discriminatory or harmful
• Contains malware, tracking tools or hidden code
• Breaches confidentiality obligations

Your terms should also include a content licence so you can host, copy, process, display and transmit user content as needed to provide the service. Without that licence, normal platform functions can become awkward from an intellectual property perspective.

The Privacy Act 2020 can matter even where content is uploaded by your customer, especially if it includes identifiable personal information. Your AUP and privacy policy should work together so users know they must have a lawful basis to upload and use that information.

Scraping And Automated Collection

Scraping rules are especially useful for marketplaces, directories, analytics tools and platforms with searchable user profiles.

Your AUP can ban users from:

• Using bots, crawlers or scripts to collect data
• Copying large parts of your database or user profiles
• Creating fake accounts to harvest information
• Bypassing rate limits, robots instructions or access controls
• Using scraped information for spam, profiling or competing products

Publicly visible data can still be personal information under the Privacy Act if it identifies someone. Your AUP shouldn't assume that anything visible on the platform is free for anyone to collect and reuse.

Common Mistakes To Avoid

The most common AUP mistakes are usually drafting problems, not complex legal problems.

Watch out for these issues:

• Using a generic overseas template: A US-style AUP may miss New Zealand privacy, consumer and spam law issues.
• Not linking the AUP to your SaaS terms: If the AUP isn't incorporated properly, you may struggle to rely on it.
• Writing rules that are too vague: A clause that only says users must behave appropriately gives your team little guidance.
• Forgetting admins and authorised users: Your customer may be the contracting party, but the risky conduct often comes from an invited user.
• Having suspension rights in one document and your internal process in another: Your terms, AUP and internal playbook should line up.
• Ignoring consumer-facing use: If individuals use your platform, the Consumer Guarantees Act 1993 and Fair Trading Act 1986 may affect your risk position.
• Promising moderation you can't deliver: If you say you review all content, make sure you can actually do that.
• No evidence trail: Without logs, screenshots and decision records, it's harder to explain why you acted.

Templates can be a useful starting point, but they often miss the details that matter most to your platform. The better question isn't whether you have an AUP. It's whether your AUP matches how your product is actually used and misused.

Key Takeaways

• An acceptable use policy gives your SaaS platform clear rules for user conduct, prohibited content, spam, scraping and security abuse.
• Your AUP should sit alongside your SaaS terms, not replace them.
• New Zealand laws such as the Privacy Act 2020, Fair Trading Act 1986 and Unsolicited Electronic Messages Act 2007 may shape your platform rules.
• Suspension rights should be specific, proportionate and linked to risk, with immediate action reserved for urgent harm.
• User-generated content clauses should cover responsibility, prohibited content, licence rights and takedown powers.
• A template is only a starting point. Your AUP should be tailored to your platform, customers, features and enforcement process.

If you'd like help with your acceptable use policy, SaaS terms, platform rules and user-generated content clauses, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.