Newtown Platform — Acceptable Use Policy
Effective date: 2026-08-27 Version: 1.0
This Acceptable Use Policy (the "AUP") is part of the [Newtown Platform Terms of Service](./terms-of-service.md) (the "Terms"). Capitalized terms have the meanings given there.
You are responsible for compliance with this AUP by all of your Authorized Users — including anyone admitted to your Workspace through your email domain and anyone holding one of your access tokens.
1. Data restrictions
These mirror the *Data restrictions* section of the Terms. Where the two differ, the Terms govern.
Never connect or submit:
- Protected health information subject to HIPAA, unless we have signed a Business Associate Agreement with you first.
- Export-controlled or classified material subject to ITAR, EAR, or comparable regimes.
- Data about children under 13, or under 16 where local law requires parental consent.
- Data you do not have the right to have processed, or whose processing would breach an agreement you have with a source provider or a data subject.
Permitted, but only as it arrives through a standard source connector: financial account and routing numbers, government-issued identification numbers, cardholder data, biometric identifiers, and precise geolocation. Newtown supplies a restricted-scope key requirement for sources it reads directly, but you are responsible for issuing that key with read-only scopes — see *Source credentials* in the Terms. Accounting, payroll, banking, and payment connectors routinely carry these and the Service is built to handle them. Notify us before connecting a payroll or bank-feed source so we can agree column-level exclusions at ingestion if you want them. Do not upload data in these categories outside a connector, and do not use the Service as a store for it.
No compliance posture is asserted. The Service has not been assessed against HIPAA, PCI DSS, GLBA and the FTC Safeguards Rule, FedRAMP, CJIS, or IRS Publication 4557. Raise a specific requirement with us before you connect the source and we will tell you honestly whether we can meet it.
There is no technical enforcement of any of the above. The Service does not detect or block prohibited data, and the connector catalogue is not restricted by category. This is a contractual restriction that depends on you.
2. Access, credentials, and tokens
Do not:
- Share an access token, or a URL containing one, outside your organization. Treat it as a password — anyone holding it can query your models and run up cost in your Warehouse.
- Put a token in a public repository, a shared document, a support ticket, or a screenshot.
- Give Workspace access to anyone outside your organization. Note the practical limit here: the Service admits people by verified email domain, so an outside contractor on their own domain cannot be added, and giving them a mailbox on your domain or handing them your token are both breaches of this AUP.
- Attempt to reach another customer's Workspace, data, project, repository, or token, or to probe whether one exists.
- Circumvent authentication, Workspace scoping, quotas, per-query limits, or the guardrails on the SQL escape hatch.
- Register OAuth clients, redeem invites, or create accounts by automated means, or in volumes beyond your own genuine use.
- Create or join a Workspace using an email domain you do not control.
Section 6 (*Security research*) is a narrow, express exception to this Section and to Section 4, and only within the boundaries Section 6 states. Nothing in Section 6 permits you to give a third party access to your Workspace, or to touch anyone else's data.
Report a suspected token exposure to security@newtowndata.io and we will rotate it.
3. Load, queries, and cost
Do not:
- Generate query volume materially beyond what your team's genuine analytical use requires, or run automated query loops or load tests against the Service without our written consent.
- Use the SQL escape hatch to extract your entire warehouse on a schedule, to build a mirror of it elsewhere, or to work around plan limits on connected sources.
- Deliberately construct queries designed to maximize bytes scanned, to exhaust a quota, or to degrade the Service for anyone else.
- Use the Service to attack, scan, or probe any third-party system, including your own Data Sources.
Query costs land on the Warehouse. Where it is one we provisioned, sustained abusive volume is a breach of this AUP and grounds for suspension. Where it is your own, the bill is yours regardless — see *Third-party costs are yours* and *Limitation of Liability* in the Terms.
4. Reselling, multi-client use, and competitive use
Do not:
- Resell, sublicense, rent, or provide the Service to a third party as a service bureau, or serve your own clients' data through a Workspace, unless your Order Form includes a firm, agency, or multi-client plan. If you are a fractional CFO firm, an outsourced accounting practice, or an agency, talk to us before you subscribe — a plan exists for that, and a single-company self-serve Workspace is not it. Running a book of clients through one domain-keyed Workspace commingles their data behind a single boundary, and that is a breach of this AUP as well as a bad idea.
- Expose the MCP endpoint, or Output from it, as part of a product or service you offer to others.
- Reverse engineer, decompile, or attempt to derive the source of the Service, except under Section 6 or to the extent the restriction is unenforceable by law.
- Use the Service, or Output, to develop or train a competing product, or to publicly publish benchmarks or performance results without our written consent. Internal evaluation, and sharing the results with your own professional advisers under confidentiality, are permitted.
- Scrape or systematically copy the application, the generated documentation, or the prompts and templates behind it.
5. Content and conduct
Do not use the Service to:
- Break the law, or facilitate anyone else's breaking of it.
- Infringe or misappropriate anyone's intellectual property, privacy, or publicity rights.
- Transmit malware, or store or distribute unlawful content.
- Harass or defame anyone.
- Make or support a decision about an individual's employment, credit, insurance, housing, or eligibility for a benefit, or use the Service or Output for any purpose regulated by the Fair Credit Reporting Act. This is prohibited outright, not merely conditioned on legality. See *No Professional Advice; Your Duty to Verify* in the Terms.
- Present Output as verified, audited, or reconciled when it is not.
- Evade sanctions or export controls, or operate from a country subject to comprehensive U.S. sanctions.
6. Security research — express authorization
We welcome good-faith reports. Email security@newtowndata.io with enough detail to reproduce.
Within the boundaries below, this Section is our express authorization, and to that extent it overrides the restrictions in Sections 2 and 4 of this AUP on probing, circumventing guardrails, and reverse engineering, and the corresponding restriction in the Terms. It does not override anything else in this AUP. While you stay inside these boundaries we will not pursue you and will not treat your testing as a breach:
- Test only against your own Workspace and your own account.
- Do not access, modify, or exfiltrate another customer's data, and stop as soon as you can tell you have crossed into someone else's.
- No denial-of-service, volumetric, or stress testing.
- No social engineering of our staff, our customers, or our vendors, and no physical testing.
- Do not test our subprocessors' infrastructure.
- Give us reasonable time to fix an issue before disclosing it publicly.
We do not currently run a paid bounty programme.
7. Enforcement
If you violate this AUP we may throttle or suspend access, disable a token, remove offending content, or terminate for cause, in accordance with the *Suspension* and *Termination for cause* provisions of the Terms — which give you notice and a cure period for non-urgent matters, and allow immediate action where the risk is immediate. We will tell you what happened and what would resolve it. Refunds and credits for a suspended period are governed by the Terms.
We will report to law enforcement where the law requires it, and may do so where we believe there is a risk to life or of serious harm.
8. Changes
We may update this AUP. Material changes get at least 30 days' notice to your Notice Address or by in-product notice, effective at the start of the second billing period beginning after the notice.
Report abuse or a security issue: security@newtowndata.io · Questions: legal@newtowndata.io
Newtown Analytics LLC · New York