Acceptable Use Policy

PrysM renders business documents. The list below is not exhaustive: it describes categories of misuse, and we apply it to conduct of the same kind even where it is not spelled out. If you are unsure whether a use is allowed, ask at legal@prysm.tools before you build on it.

This policy applies to everything you generate, store or transmit through the Service, and to how you interact with our infrastructure, whether from the editor, the API, or any other client.

You must not use the Service to produce or assist in producing:

• Identity documents. Passports, identity cards, driving licences, residence permits, or anything designed to resemble one.
• Documents to defeat identity or funds checks. Counterfeit bank statements, fabricated pay slips, forged utility bills, false proof of address, false proof of income, or any document intended to pass a know-your-customer, anti-money-laundering, credit, immigration, rental or employment check under false pretences.
• Fraudulent commercial documents. Invoices for goods or services never supplied, invoices from an entity you are not, duplicate invoices sent to obtain double payment, or documents designed to deceive a tax authority, an auditor, an insurer or a financial institution.
• Payment redirection and phishing. Invoices carrying bank details you are not entitled to receive money at, deceptive payment instructions, malicious links, or documents impersonating a supplier in order to divert a payment.
• Documents impersonating an institution. Anything presented as issued by a government body, a court, a bank, a regulator or PrysM itself.

Generating a document with placeholder or sample data for your own testing is fine. Generating a realistic document intended to deceive somebody is not, whatever it is called internally.

• Content that is unlawful under French or European Union law, or under the law of any jurisdiction where the document will be used.
• Child sexual abuse material, in any form. We report this to the competent authorities without exception and without notice.
• Content promoting or financing terrorism or violent extremism.
• Content that is defamatory, harassing, or that promotes violence, hatred or discrimination against a person or a group.
• Material that infringes copyright, trade marks, trade secrets or any other right of a third party, including invoicing for the sale of counterfeit goods.
• Documents supporting the sale of goods or services whose sale is prohibited or requires a licence you do not hold, controlled substances, weapons, prescription medicines, and comparable categories.

The API drives a headless browser to render your document. That architecture must not be turned into an attack surface. You must not:

• Inject executable payloads. Submit HTML, CSS, SVG, fonts or JavaScript crafted to achieve cross-site scripting, server-side request forgery, local file access, container escape or arbitrary code execution on our infrastructure or that of our providers.
• Reach internal networks. Reference image or resource URLs that resolve to private, loopback, link-local or cloud metadata addresses, or otherwise attempt to make the renderer act as a proxy into a network it should not reach.
• Mine cryptocurrency. Inject WebAssembly or scripts that consume compute during rendering for any purpose other than producing your document.
• Scrape or attack third parties. Use the renderer to fetch, crawl or archive third-party sites, to bypass a paywall or access control, or to direct traffic at an external target.
• Exhaust resources. Submit payloads designed to consume disproportionate CPU, memory, time or bandwidth, decompression bombs, pathological recursion, documents with thousands of pages, or deliberately unbounded content.
• Evade limits. Circumvent rate limits, credit accounting or quotas through multiple accounts, key rotation, IP rotation, concurrency abuse, or tampering with the Idempotency-Key mechanism.
• Go beyond fair use. Every plan includes the rendering time, concurrent renders, cloud storage and downloads that normal use of that plan needs, sized well above it. These fair-use limits are not published and may change. Requests beyond them may be slowed, queued or refused, a refused request is not charged. Use far beyond what a plan is priced for, sustained over time, in particular documents built to take as long as possible to render, may lead us to contact you, to restrict the account, or to act under Enforcement.
• Load test without permission. Run stress or benchmark tests against the production API. Ask us and we will arrange a window.
• Launch denial of service. Any attempt, successful or not, results in an immediate permanent ban.

Cloud storage exists to hold documents you generated, so you can retrieve them. You must not:

• Upload or host malware, ransomware, exploit kits or any malicious payload, including one disguised as a PDF.
• Use it as a general-purpose content delivery network, file locker or asset host, or hotlink stored files from an external site or application.
• Distribute signed URLs publicly in order to share prohibited, infringing or malicious material.
• Store content unrelated to documents generated by the Service.

• Do not use the Service, or documents generated with it, to send unsolicited bulk communications.
• Do not impersonate PrysM, suggest an affiliation, partnership or endorsement that does not exist, or use our name, logo or templates in a way that implies we vouch for your documents.
• Do not create accounts by automated means, use credential stuffing, or register with details that are not yours.
• Do not use the Service to process the personal data of people who have not been informed, or for which you have no lawful basis, see your obligations in the Data Processing Agreement.

• Do not decompile, disassemble or reverse engineer the web application, the API or the rendering templates, except to the narrow extent that such a restriction is unenforceable under applicable law.
• Do not defeat the watermark. Removing, obscuring, cropping or overlaying the PrysM watermark on a free-plan export, by CSS manipulation, absolute positioning, post-processing of the PDF, or any other means, is both a breach of this policy and a circumvention of a technical protection measure.
• Do not sell, resell, lease, sublicense or share API keys, or offer the Service to third parties as your own, without our written agreement.
• Do not use the Service to build, train or benchmark a competing product, including by using outputs as training data for a machine learning model.

Boundaries

• Use only your own account and your own data. Do not access, modify or exfiltrate another customer’s data; if you reach it accidentally, stop and tell us.
• No denial of service, no volumetric testing, no spam, no social engineering of our people or our providers.
• Do not test our providers’ infrastructure. Their programmes are theirs, and their rules apply.
• Give us a reasonable period to fix an issue before disclosing it.

Where we determine that this policy has been breached, we may take one or more of the following measures, proportionate to the seriousness of the breach:

1. 1Restrict, suspend or permanently terminate the account and every API key attached to it, immediately and without prior notice where the breach is serious or ongoing.
2. 2Remove or disable access to specific documents or stored files.
3. 3Irreversibly delete the data held in PrysM Cloud for that account.
4. 4Forfeit remaining API credits, unlocked documents and subscription time. No refund is issued for an account terminated under this policy.
5. 5Refuse future registration by the same person, entity or payment instrument.
6. 6Report the matter to law enforcement or the competent authority, and provide account details, connection logs and the documents concerned, where we suspect a criminal offence or where a threat to the life or safety of a person exists.

Anyone, user or not, may notify us of content or behaviour they believe breaches this policy or the law.

• Abuse and illegal content — abuse@prysm.tools
• Copyright and trade mark — abuse@prysm.tools
• Security vulnerabilities — security@prysm.tools
• Authorities and trusted flaggers — legal@prysm.tools, in French or English.

A useful notice includes: the signed URL or document reference, an explanation of why the content is unlawful or breaches this policy, your contact details, and a statement that your report is made in good faith and is accurate to the best of your knowledge. We acknowledge receipt, decide without undue delay, and tell the reporter and the affected user what we decided.

If we restrict, suspend or terminate your account, or remove content you uploaded, you may contest that decision free of charge for six months from the day we notified you, by writing to legal@prysm.tools with the reference of the decision and the grounds on which you dispute it.

Complaints are reviewed by a person, not by the automated system that may have flagged the case, and we reverse the decision without delay where the complaint is well founded. If you disagree with the outcome you may pursue an out-of-court dispute settlement body or the courts; nothing here limits your right to do so.