Acceptable use policy

The principle

Stratum exists to help regulated businesses meet their own legal duties. The data it holds and checks is about real people. Misusing it harms them and threatens our ability to keep operating, so we take misuse seriously.

You may not

• Add people your work doesn’t need. Keep in your register your clients and the people connected with them, nobody else.
• Collect more than you need. Send a details link only to your own client, for details your checks need.
• Build a competing dataset or API product. You may not bulk-extract responses to resell them as a competing data feed, search service or API.
• Train models on our responses to replicate the service or generate similar data.
• Harass, dox or smear anyone. Data about regulated individuals, directors and your clients is for legitimate checks, not for harassment, public shaming or malicious profiling.
• Make automated decisions about people without a lawful basis. Where a result feeds a decision about someone (refusing service, ending a contract), you stay responsible for its lawfulness, accuracy and explanation under UK GDPR Article 22.
• Get round the limits or pricing. Sharing keys or sign-ins across organisations, rotating keys to evade allowances, or scripting around our limits breaches this policy.
• Use a test key for real work. A test key is for building and testing, not for checking real clients.
• Probe, scan or attack the service. Penetration testing needs our written consent first. Vulnerability reports are welcome at security@stratumapis.com.
• Use the service for anything unlawful or fraudulent, or to help others do so.

Keeping and re-using results

Keeping results, certificates and documents as part of your compliance records is what Stratum is for. Caching API responses in your own software for speed is fine. Republishing results to the public web in a way that competes with the original register (or with us) is not.

If you are unsure whether a use crosses the line, ask us: usually the answer is yes, sometimes with a small change.

Reporting concerns

If you believe someone is misusing Stratum, or that data about you is being misused by one of our customers, write to dpo@stratumapis.com. We look into every report.

Enforcement

We may pause, limit or end access without notice if we reasonably believe this policy is being broken. Where we can, we tell you and give you the chance to put it right; where the breach is serious or ongoing we may act first and explain after. Commercial questions about a particular use: support@stratumapis.com.