Draft. This document is under review by counsel and is not yet in force (version 2026-10-03.1).
Acceptable Use Policy
DRAFT for counsel review. Not legal advice.
Version: 2026-10-03.1
This policy is part of the Terms of Service. It applies to every user of an organization's OSINTTotal account. "We" is [Company legal name]. "You" is the customer organization and its users.
1. What OSINTTotal is for
OSINTTotal builds due diligence reports on companies and people from public and lawfully accessible sources. Every case records a purpose, the decision the report supports, a lawful basis and a retention date (the case gate) before collection starts. Reports are leads for a trained analyst to review, not final findings.
2. Allowed purposes
At signup you choose one of these; each case must fit the purpose your organization was approved for.
| Code | Purpose |
|---|---|
kyb | Know your business: customer, partner or supplier onboarding |
third_party_risk | Third-party and supply chain risk review |
investment_dd | Investment, M&A or lending due diligence |
aml_compliance | AML, sanctions or anti-bribery compliance |
fraud_investigation | Fraud, corruption or misconduct investigation |
legal_support | Litigation support or asset tracing by or for counsel |
security_exposure | Security exposure review of your own organization and its staff |
employment_non_us | Pre-engagement screening outside the US, with the candidate informed |
Investigating a person is allowed only as part of one of these purposes, for example the directors and owners of a company you are onboarding, or a candidate who has been told about the check.
3. Never allowed
- US employment, tenant, credit or insurance screening, or any other purpose under the US Fair Credit Reporting Act (FCRA), including a decision on hiring, promotion, retention, housing, credit or insurance about a person in the US or about a US role. OSINTTotal is not a consumer reporting agency and its reports are not consumer reports.
- Locating or contacting a person: finding where someone lives or is, tracing a person to approach, serve, confront, follow or monitor them, or giving their contact details to someone who will.
- Minors: investigating anyone under 18. If a case shows the subject may be a minor, stop and close it.
- Profiling by protected traits: collecting or inferring health, religion or belief, sexual life or orientation, political opinion, trade union membership, ethnic or racial origin, genetic or biometric data, or immigration status, or using them in a decision. Face matching to identify a person is not offered and must not be done with OSINTTotal output.
- Reselling or redistributing raw data: selling, licensing or bulk exporting collected evidence, selectors or search results, or building a people database from them. Finished reports may go to your own client for the case's purpose.
- Investigating without a lawful basis recorded in the case gate: every case needs a purpose, the decision supported, a lawful basis (and a consent reference where consent is the basis) and a retention date before collection. Do not enter a basis you do not have.
- Personal disputes, journalism or activism outside a professional engagement, stalking, harassment, intimidation, doxxing, discrimination, or any unlawful purpose.
- Pretexting, logging in under a false identity, using leaked credentials, buying leaked datasets, or asking OSINTTotal to collect behind a login it does not hold lawfully.
- Investigating a person who has asked you not to be processed, where the law gives them that right and you have no overriding ground.
- Testing, scraping or overloading the service, getting around rate limits, quotas or the case gate, or sharing accounts between people.
4. What you must do
- Keep the case gate accurate. A wrong purpose or basis is a breach of this policy.
- Collect only what the decision needs. Turn off modules you do not need on the launch screen.
- Have an analyst review every report before it is used. Treat identity matches below CONFIRMED as unverified.
- Never tip off the subject when the purpose requires discretion (AML, fraud), and never contact the subject through OSINTTotal.
- Give the notice the law requires to the people you investigate (see privacy.md part B), or record why an exemption applies.
- Set the shortest retention that fits the purpose. Purge cases when it ends.
- Tell us within 48 hours at
[abuse@domain]if you think the service was misused under your account.
5. Enforcement
We vet every organization before its first case (vetting_procedure.md) and may re-vet at any time. We may ask about any case, its gate and its use. If we believe this policy was breached, we may suspend the organization at once (cases and jobs stop, data stays readable for export), require changes, terminate the account, and report to authorities where the law requires. Suspension and its reason are recorded in the audit log.