Back to Home
Acceptable Use Policy
Effective Date: August 6, 2026 · Version 2.1 (supersedes v2.0, August 6, 2026, and v1.0, July 25, 2026)
1. Purpose
This policy defines acceptable use of the ESXPress platform by customers (tenants) and by the platform operator. It references the platform’s implemented enforcement mechanisms.
2. Scope
This policy applies to all tenant accounts, API key users, email-ingest users, webhook consumers, and the platform operator. Service terms: see the Terms of Service; privacy: see the Privacy Policy.
3. Permitted Use
- Uploading insurance scope-of-loss documents you are authorized to process and converting them to Xactimate ESX files.
- Using generated ESX files for legitimate insurance claims, supplements, and restoration workflows.
- Using the public API (Enterprise and legacy Volume+ plans, or with the API add-on) with tenant-scoped API keys for your own business automation.
- Using the email ingest address to submit scope documents.
- Webhooks configured to your own endpoints, with HMAC secrets where supported.
4. Prohibited Use
| Prohibition | Enforcement |
|---|---|
| Creating multiple accounts to circumvent limits (free tier = 5 conversions/month, trial = 14 days) | Signup limit: max 3 signups per IP per day; trial-cycling block: more than 3 accounts from the same email domain within 30 days; referral-ring detection |
| Reselling conversions / API access | Enterprise accounts with more than 100 conversions in a month and legacy Volume+ accounts with more than 500 are flagged for reselling patterns |
| Abusing the referral program (rings, self-referrals, fake accounts) | Referral ring detection; referrals earn a 20% commission for 12 months on referred paid plans, tracked per account |
| Downgrade/upgrade gaming | Plan changes are recorded with timestamps; repeated rapid downgrades are handled per the consequences in Section 8 |
| Sharing API keys | Each key is tenant-scoped and rate-limited (60 requests per minute); sharing is detectable via usage patterns; keys are revocable immediately |
| Uploading malicious content | Filename sanitization and path containment; 50 MB per-file limit; malware scanning is not currently implemented |
| Automated scraping / denial-of-service | Rate limits: anonymous 60 requests/min/IP, authenticated 600 requests/min/tenant, login 20/min/IP, plus burst limits; returns 503 errors if the rate-limit store is unavailable |
| Unauthorized access to other tenants' data | Tenant isolation: every query is scoped by the authenticated tenant; cross-tenant access requires administrator privileges, and every administrative action is audit-logged |
| Storing unlawful content | The platform may disable accounts that store unlawful content; we do not currently scan uploaded content |
5. Operator (Administrator) Use
The platform operator will:
- Access tenant data only for: support with tenant consent, security incidents, legal obligation, or platform operations, each access via the administrative API is recorded in the admin audit log with actor, action, target, IP, and user agent.
- Not use tenant claim data for any purpose other than platform operation and the documented AI extraction pipeline (DeepSeek, see the Privacy Policy).
- Maintain the confidentiality of internal secrets and tenant data.
- Not create tenant accounts for personal use of the free tier (would violate the abuse controls this policy describes).
6. Monitoring and Enforcement
- The platform monitors: rate-limit violations, abuse signals (trial cycling, referral rings, reselling), lockouts, CSRF failures, and administrative actions (audit log).
- We do not monitor the content of uploaded documents, detection is technical and behavioral, not content-based.
- Enforcement actions: rate-limit throttling (automatic), account suspension, API key revocation (immediate), webhook deactivation.
7. Reporting Violations
Report suspected abuse to hello@esxpress.org or call (918) 9-PDF-ESX. Reports are reviewed within 3 business days.
8. Consequences
Violations may result in: warning, conversion-limit enforcement, temporary suspension, permanent account termination, and, for unlawful activity, referral to law enforcement. Termination follows the Data Retention Policy for data disposition.
9. Document History
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | July 25, 2026 | System Administrator | Initial policy |
| 2.0 | August 6, 2026 | Chaz Jaco | Mapped each prohibition to its verified enforcement control; removed unverified content-monitoring claims |
| 2.1 | August 18, 2026 | Content Revamp: Legal | Corrected the reselling and referral-program enforcement descriptions to match the implemented controls |
Approved By: Chaz Jaco, Owner: ESXPress · August 6, 2026