This policy applies to everyone who uses SpoolStream. It forms part of the terms of service.
1. What you may not do
- Break the law, or use the service to help someone else break it.
- Send documents you have no right to send, or that infringe someone's rights.
- Send malware, or documents built to attack a printer, a computer or the service. A PDF is treated as untrusted input: it is rendered in a single-use child process with size, page and time limits, so a bad file ends the child and not the agent.
- Try to reach another organization's data, or to get around the limits and the separation between organizations. Every table that holds a customer's data carries the organization's identifier, a filter in the application and PostgreSQL row-level security. Our integration tests prove that organization B cannot read or change organization A's data, and receives 404, not 403.
- Overload the service on purpose, or send traffic meant to disrupt it.
- Use the service to harass, to defraud, or to print what is unlawful.
- Resell or share access to the service with third parties without our written agreement.
- Hide who you are when you register, or register on behalf of an organization without the authority to do so.
2. Keys and accounts
Keep your API keys and passwords to yourself. You are responsible for what is done with them. After 5 failed sign-in attempts an account is locked for 15 minutes, and one-time codes count toward the same limit. An organization cannot yet require its members to use a second factor.
3. Looking for weaknesses
We welcome good-faith security research. Test only your own organization, in test mode where you can, and do not read, change or delete anyone else's data. Report what you find to contact@spoolstream.ca with the steps to reproduce it, and give us a reasonable time to fix it before you publish. If you follow these rules, we will not take action against you for the research.
4. What we may do
If you break this policy we may remove content, limit or suspend access, or end the account, as the terms of service describe. We suspend only as far as needed, and we tell you why, except where an attack or a legal duty means we cannot.
5. Reporting
To report abuse or a security problem, write to contact@spoolstream.ca.