Acceptable Use Policy

This Acceptable Use Policy ("AUP") applies to everyone who accesses the Ustawi platform — tenant staff, field collection agents, and any other authorized user — and is incorporated into the Terms of Service (/legal/terms-of-service). Violating this AUP may result in suspension of the offending user's access or, for serious or repeated violations, suspension of Customer's account.

• ✓Using the Service to originate, service, and collect loans or savings products your institution is legally authorized to offer.
• ✓Configuring loan products, branches, and staff roles for your own institution's legitimate operations.
• ✓Exporting your own institution's data for your own regulatory filings and business purposes.
• ✓Using the mobile field-collection app for genuine borrower visits within your assigned branch/route.

• ✕Attempting to access another tenant's data. Each tenant's data is isolated in its own database; attempting to probe, access, or exfiltrate another tenant's data by any means is a severe violation.
• ✕Circumventing AML/KYC controls — e.g. structuring transactions to avoid sanctions/PEP screening, disabling or ignoring screening alerts without documented resolution, or "tipping off" a subject of a Suspicious Transaction Report.
• ✕Falsifying records — e.g. backdating loan documents, fabricating collection visit GPS data, or misrepresenting collateral valuations.
• ✕Circumventing dual-control (maker-checker) approval flows on sensitive role grants or other actions designed to require a second authorizer.
• ✕Unauthorized data export or sharing — extracting borrower PII, KYC documents, or loan data for purposes outside your institution's legitimate business, or sharing platform credentials/device-bound sessions with unauthorized individuals.
• ✕Using the Service for unlawful lending practices — e.g. usurious rates prohibited by law, lending to ineligible or sanctioned individuals, or discriminatory lending practices.
• ✕Interfering with platform security — attempting to bypass device-trust/device-binding controls, probing for vulnerabilities without following the Vulnerability Disclosure Policy (/legal/vulnerability-disclosure-policy), or introducing malware.
• ✕Excessive automated use that degrades Service performance for other tenants (e.g. unauthorized scraping or bulk API abuse outside agreed integration terms).

Field agents must only capture GPS location data during legitimate collection visits and must not misrepresent their location. Staff must not share device-bound login sessions and must report a lost/stolen device immediately so it can be revoked from the device-trust registry.

Ustawi logs sensitive actions via full audit logging and may investigate suspected AUP violations, including reviewing audit-log entries. Ustawi may suspend an individual user's access immediately where there is reasonable suspicion of a severe violation (e.g. cross-tenant access attempts, AML circumvention), pending investigation, and will notify Customer's designated admin promptly.

Customer admins or any user who suspects an AUP violation should report it via /contact or legal@ustawi.co.tz. Security vulnerabilities specifically should go through the Vulnerability Disclosure Policy (/legal/vulnerability-disclosure-policy) instead.

Depending on severity: a warning and required remediation; suspension of the individual user's access; suspension or termination of Customer's account per the Terms of Service; and, where the violation involves unlawful activity, referral to relevant authorities.