Acceptable Use Policy
This Acceptable Use Policy (“Policy”) establishes the standards for accessing and using XPM360, operated by Hexadot Solutions LLC (“XPM360,” “we,” “us,” or “our”). It applies to our websites, applications, client portals, APIs, integrations, and related services (collectively, the “Services”).
This Policy applies to each customer organization and every individual who accesses the Services through that organization, including administrators, employees, contractors, consultants, and invited clients (collectively, “Users”). It supplements the Terms of Service and any applicable agreement governing your use of XPM360.
1. Authorized Use
XPM360 provides tools for project management, business administration, financial workflows, document management, and collaboration. You may use the Services only for lawful purposes, within the permissions granted to you, and in accordance with your subscription and applicable agreements.
You must have authority to act on behalf of any organization you represent. Access to a project, workspace, client portal, or connected system does not authorize you to use information beyond the purpose for which access was granted.
You must not resell, sublicense, or make the Services available to unauthorized parties except as expressly permitted by your agreement with XPM360.
2. Account Security and Administration
Users are responsible for protecting their account credentials and using reasonable security practices when accessing the Services.
Customer organizations are responsible for administering access to their workspaces, assigning appropriate permissions, and promptly revoking access when it is no longer required.
You must not:
Share individual account credentials or allow another person to use your identity.
Impersonate another User, organization, or representative of XPM360.
Access an account, workspace, project, or record without authorization.
Circumvent authentication, role restrictions, or organization boundaries.
Disclose passwords, access tokens, private keys, or integration credentials to unauthorized parties.
Suspected account compromise or unauthorized access must be reported promptly through XPM360’s available support channels.
3. Customer Content and Information
You are responsible for the content and information you upload, create, submit, transmit, or share through the Services (“Customer Content”). This includes project records, drawings, contracts, photographs, financial documents, time entries, employee information, and communications.
You must hold the rights, permissions, and lawful authority necessary to process and share Customer Content through XPM360. You must also ensure that access and sharing settings are appropriate for the information involved.
Customer Content must not:
Violate applicable law or another party’s contractual, intellectual property, privacy, or other rights.
Contain fraudulent, defamatory, threatening, or unlawfully discriminatory material.
Facilitate harassment, exploitation, violence, or other unlawful conduct.
Include malicious software, harmful scripts, or deceptive links.
Misrepresent its source, ownership, authenticity, or approval status.
This Policy does not transfer ownership of Customer Content. Ownership and permitted processing of Customer Content are governed by the applicable service agreement.
4. Integrity of Business Records
The Services must not be used to create, conceal, or facilitate fraudulent or deliberately misleading business activity.
Prohibited conduct includes:
Fabricating invoices, expenses, time entries, payment records, or supporting documentation.
Falsifying project progress, inspection results, completion records, or approvals.
Misrepresenting a person’s identity, authority, qualifications, or participation in a project.
Altering records without authorization or attempting to conceal unauthorized changes.
Submitting false employment opportunities or collecting applicant information under deceptive pretenses.
Using financial workflows to facilitate unauthorized transactions, money laundering, or other unlawful activity.
Customers remain responsible for reviewing business records and approving transactions performed through their accounts.
5. Platform and Network Security
You must not compromise, disrupt, or attempt to gain unauthorized access to the Services or to any systems connected to them.
Unless expressly authorized by XPM360 in writing, you must not:
Conduct vulnerability scans, penetration tests, or other security testing against the Services.
Exploit vulnerabilities or bypass security controls.
Intercept communications or obtain data belonging to another customer.
Introduce malware, ransomware, or other harmful code.
Conduct denial of service attacks or generate traffic intended to impair availability.
Manipulate session credentials, access tokens, or application requests to exceed your permissions.
Disable, interfere with, or evade security monitoring or audit mechanisms.
If you discover a potential vulnerability, stop any activity that could expose data or disrupt service and report the issue through XPM360’s available support channels. Do not access, copy, modify, or disclose other customers’ information.
6. APIs, Automation, and Resource Usage
APIs, integrations, and automated processes must operate within the access permissions, published limits, and subscription entitlements applicable to your account.
You must not bypass storage quotas, rate limits, licensing restrictions, or other usage controls. You must not use multiple accounts, credentials, or technical methods to evade those restrictions.
Automated activity must not materially impair the Services or interfere with other customers’ access. Unauthorized scraping, bulk harvesting of information, and extraction of data outside your account permissions are prohibited.
Authorized integrations and routine business automation are permitted when they comply with this Policy and applicable documentation.
7. Communications and Collaboration
Messaging, invitations, notifications, support tools, and client collaboration features must be used for legitimate business purposes.
You must not use these features to distribute spam, phishing attempts, fraudulent solicitations, malicious attachments, or unsolicited bulk communications. Communications must not falsely imply endorsement by XPM360 or misrepresent the sender’s identity.
You must respect recipients’ privacy and comply with applicable requirements governing business communications.
8. Personal and Restricted Information
Customers are responsible for determining whether particular information may lawfully and appropriately be processed through the Services.
Collect and share only the personal information needed for your business purposes. Restrict access to individuals who have a legitimate need to use it.
Do not place passwords, private keys, payment card security codes, or other authentication secrets in ordinary project fields, documents, messages, or support requests.
Payment card information, government identification numbers, health information, and other information subject to special handling requirements may be submitted only where the relevant feature is expressly designed for that purpose and applicable contractual, security, and legal requirements have been satisfied.
Availability of a field or upload function does not, by itself, establish that XPM360 is suitable for every category of regulated information.
9. Third-Party Services and Payments
When connecting a third-party service, you must have authority to establish the connection and share the relevant information. You are responsible for selecting appropriate access permissions and disabling connections that are no longer needed.
Use of third-party services, including payment processing and financial integrations, is subject to the applicable provider’s terms and restrictions. You must not use XPM360 to circumvent those requirements or facilitate prohibited transactions.
10. Investigation and Enforcement
Where we reasonably believe that activity violates this Policy, threatens the security or availability of the Services, or creates a legal risk, we may investigate and take proportionate action.
Subject to applicable law and our agreement with the customer, action may include:
Requesting corrective measures or additional information.
Restricting access to affected content or features.
Disabling an integration or automated process.
Suspending a User or customer account.
Terminating access in cases of serious or repeated violations.
Where reasonably practicable, we will notify the affected customer and provide an opportunity to resolve the issue. Immediate action may be necessary where delay could expose information, disrupt service, enable unlawful activity, or harm another party.
Any review, preservation, or disclosure of information will be subject to applicable law, the Privacy Policy, and our contractual obligations. This Policy does not create an obligation to monitor all Customer Content or User activity.
11. Reporting Concerns and Requesting Review
Report suspected misuse, security concerns, or violations through the support options available on the XPM360 website or within your account.
Provide sufficient information to identify the affected account, project, content, or activity. Do not include passwords, authentication tokens, or unnecessary personal information in your report.
If you believe an enforcement action was taken in error, you may request review through the same support channels and provide information relevant to the decision.
12. Policy Updates
We may revise this Policy to reflect changes to the Services, operational requirements, or applicable law. The effective date displayed with the published Policy identifies the version currently in effect.
Notice of material changes will be provided as required by applicable law or the agreement governing your account.
Questions about this Policy may be directed to Hexadot Solutions LLC through XPM360’s published support channels.
