Acceptable Use Policy

Version 1.0 · Last updated 13 September 2026 · Canonical URL: https://airhive.ai/legal/aup

1. Scope and purpose

This Acceptable Use Policy ("AUP") forms part of the Terms of Service of Airhive GmbH, Eckernwoort 16, 22607 Hamburg, Germany ("Airhive") and applies to all Accounts, Workspaces, users, guests, shared links, uploads, prompts, Generated Output, APIs, email-in addresses, source connections, AI Features, instruction sets, agents and Connected Services used through Airhive. Capitalised terms have the meaning given in the Terms of Service.

The AUP is intended to protect users, third parties, infrastructure, legal compliance and the integrity and commercial sustainability of the Service. A capability being technically available does not mean that every use is permitted.

2. Illegal, infringing and harmful content

You must not upload, store, process, generate, organise, transmit, publish or share content that:

  • is illegal under applicable EU, Member State or other relevant law;
  • sexually exploits, abuses or endangers minors or appears to involve child sexual abuse material;
  • promotes terrorism, violent extremism, credible threats, targeted harassment or unlawful incitement;
  • is defamatory, fraudulent, deceptive, phishing-related, impersonating or intended to mislead recipients;
  • contains malware, ransomware, spyware, credential-stealing code, malicious macros, botnet tools or instructions intended to compromise systems;
  • infringes copyright, trade marks, database rights, trade secrets, confidentiality, privacy, publicity or other third-party rights;
  • contains Personal Data that you are not authorised or lawfully entitled to upload, process or share;
  • evades sanctions, export controls, court orders, regulatory restrictions or lawful authority requests.

3. Sensitive, regulated and high-risk information – your responsibility

Airhive is built for the documents that knowledge workers and organisations actually handle, which routinely include contracts, invoices, HR and employment records, correspondence and identification documents. You may use Airhive for such content. When you do, you are responsible for:

  • having a lawful basis and, where required, the consent of the persons concerned;
  • configuring Workspace permissions, sharing, AI scope and connectors so that only authorised persons and services can access the content;
  • assessing whether the selected Plan, configuration and contractual safeguards (including the DPA) are appropriate for special-category Personal Data, criminal-offence data, children's data, health records, payment-card data, classified or export-controlled information, and information subject to legal privilege or professional secrecy;
  • complying with sector-specific rules that apply to you (for example professional secrecy, financial-services or public-sector requirements).

Payment-card data must not be stored in Airhive unless you are entitled to do so under the PCI DSS. Airhive may restrict categories of data or require an enterprise agreement, additional security or a data-protection assessment before permitting certain use cases.

4. Security abuse and unauthorised access

You must not:

  • access or attempt to access another Account, Workspace, Hive, file, metadata, log, instruction set, token or API without authorisation;
  • probe, scan, test or exploit vulnerabilities except as permitted in Section 10;
  • bypass authentication, permissions, storage limits, seat limits, rate limits, AI limits, review controls, consent layers, paywalls or technical safeguards;
  • interfere with availability through denial-of-service, abusive automation, resource exhaustion, malicious files or excessive requests;
  • introduce code or content designed to compromise Airhive, its providers, users or connected systems;
  • obtain, trade, share or use credentials, tokens, upload addresses or session information without authority.

5. AI, agents and automated decision-making

When using AI Features, instruction sets, agents or connected AI providers, you must not:

  • attempt to extract system prompts, model weights, hidden instructions, security rules, proprietary taxonomies or other non-public technical information;
  • use prompt injection, malicious documents or other techniques to exfiltrate data beyond the authorised scope;
  • misrepresent Generated Output as verified, official, professional or human-authored when it has not been reviewed, or remove the AI-generated marking that Airhive applies to Generated Output;
  • use Generated Output as the sole basis for legal, financial, employment, educational, medical, housing, credit, insurance, public-sector or similarly significant decisions about individuals;
  • enable an agent or connector for Personal Data, confidential information or regulated data without authority and appropriate assessment;
  • use Airhive to deploy a practice prohibited by Article 5 of the EU AI Act, or to evade transparency, human-oversight, recordkeeping or impact-assessment obligations that apply to you as deployer;
  • use AI Features to generate or facilitate illegal, infringing, deceptive or harmful content.

6. Protection of Airhive technology and business model

You must not:

  • reverse engineer, decompile, disassemble, copy or create derivative works from the Service except where mandatory law expressly permits;
  • scrape, crawl, systematically download, mirror or reproduce the interface, Documentation, taxonomies, workflows or databases;
  • use the Service, outputs or non-public information to train, benchmark or develop a competing document-management, knowledge-workspace or AI-agent platform without written permission;
  • resell, sublicense, white-label, timeshare or provide Airhive as a managed service without a written commercial agreement;
  • remove trade marks, copyright notices, attribution, access controls or other proprietary identifiers.

7. Resource abuse and prohibited automation

Automated access is permitted only through documented APIs, connectors or tools and within applicable limits. You must not use scripts, bots, parallel Accounts or artificial traffic to circumvent Plan restrictions, consume disproportionate infrastructure, manipulate metrics, create fake referrals or interfere with other users.

Airhive may apply fair-use limits, throttling, file-size restrictions, malware scanning, rate controls and temporary processing restrictions to preserve availability and security, within the limits set out in Section 5 of the Terms of Service.

8. Collaboration, sharing and communications

You are responsible for invitations, public links, guest rights and Workspace permissions. You must not use Airhive sharing or email functions for spam, unsolicited bulk communications, harassment, phishing, deceptive links or unlawful dissemination.

You must not share content with a person or Connected Service unless that recipient is authorised and the disclosure is lawful. Public links must not be used to bypass access restrictions or publish illegal content.

9. Intellectual-property and illegal-content notices

Any person or entity may report allegedly illegal or infringing content to abuse@airhive.ai. A notice should include:

  • the specific file, link, Workspace or activity, including the URL, and enough information to locate it;
  • a sufficiently substantiated explanation of why the content is considered illegal or infringing;
  • the notifier's name and email address, unless the notice concerns child sexual abuse material;
  • a statement confirming the notifier's good-faith belief that the information in the notice is accurate and complete.

Airhive will confirm receipt of the notice without undue delay, will process it in a timely, diligent, non-arbitrary and objective manner, and will inform the notifier of its decision without undue delay, including whether automated means were used and the available redress options. Airhive may request further information and may reject notices that are vague, manifestly unfounded, abusive or fraudulent. Notices relating to copyright or trade marks should identify the protected work or right and the notifier's authority. Persons who repeatedly submit manifestly unfounded notices may have their notices deprioritised or rejected after a warning.

10. Vulnerability reporting and good-faith security research

Security vulnerabilities should be reported privately to security@airhive.ai. Airhive will acknowledge a report within three business days.

Safe harbour. Airhive will not pursue civil claims, refer to law enforcement or terminate the Account of a person who, in good faith, discovers and reports a vulnerability in accordance with this Section, provided the person: (a) tests only against their own Account and Workspace, or against Accounts they are expressly authorised to test; (b) does not access, modify, download or retain data that is not their own beyond the minimum necessary to demonstrate the vulnerability; (c) does not disrupt the Service or degrade it for other users; (d) does not use social engineering, phishing, physical attacks or denial-of-service techniques; (e) does not demand payment as a condition of disclosure; and (f) does not publicly disclose the vulnerability before Airhive has had a reasonable opportunity, and at least 90 days, to investigate and remediate it. Testing outside these conditions requires Airhive's prior written authorisation and scope.

A report made in good faith does not create a right to compensation unless a separate bounty programme expressly applies.

11. Investigation and enforcement

Airhive may investigate suspected violations and may request information, preserve evidence, scan files for malware, disable links, quarantine content, restrict imports or exports, suspend AI or connector access, throttle processing, remove content, suspend users or terminate Accounts. Measures are proportionate to the violation.

Airhive may act without prior notice for urgent security risks, child-safety issues, malicious activity, fraud, illegal content, repeated violations or material risk to other users or third parties. For less serious issues, Airhive will provide notice and an opportunity to remedy where reasonable.

Airhive may cooperate with courts, regulators and law enforcement where required or appropriate and may recover reasonable costs caused by a violation where permitted by law.

12. Statements of reasons and review

Where Airhive restricts, removes or disables access to content, suspends or terminates an Account, or restricts a feature on the basis of this AUP or applicable law, Airhive will give the affected user a clear and specific statement of reasons at the latest when the measure takes effect, stating the facts and circumstances relied on, whether automated means were used, the contractual or legal ground, and the available means of redress. Airhive may withhold details where disclosure would compromise security, fraud prevention, an investigation, another person's rights or a legal prohibition.

The affected user may request review of the decision within six months by email to abuse@airhive.ai or through the review function in the Service. A review request must identify the decision and explain why it should be changed. Reviews are decided by a person, not solely by automated means, without undue delay, and the outcome is communicated to the user with reasons. Repeated abusive appeals may be restricted after a warning.

13. Changes and contact

Airhive may update this AUP to address new risks, features, laws or abuse patterns. Changes are notified in accordance with Section 25 of the Terms of Service. The version number and effective date are shown at the top of this AUP.

Abuse and illegal-content reports: abuse@airhive.ai | Security reports: security@airhive.ai | Legal questions: legal@airhive.ai