Acceptable Use Policy

1. Scope

1. a)
   a)

   This AUP applies to every user of the Services, including Direct Subscribers, Partners, Partner Personnel, End Clients, Authorized Users, and any other person accessing the Platform through any Hobasa Agreement.

2. b)
   b)

   Every Subscriber, Partner, and End Client is responsible for its own Authorized Users’ compliance with this AUP. An act or omission by an Authorized User is treated as an act or omission by the Subscriber, Partner, or End Client (as applicable). A Partner is additionally responsible for ensuring that its Partner Personnel comply with this AUP as Authorized Users.

3. c)
   c)

   The obligations in this AUP apply to all users of the Services, subject to the terms of any applicable negotiated agreement. A negotiated Partner Agreement may expressly modify specific provisions of this AUP with respect to that Partner’s rights and obligations, provided the modification is set out in express terms and identifies the specific AUP section being modified. No implied modification of this AUP is permitted. The following provisions of this AUP are non-waivable and may not be modified by any Partner Agreement under any circumstances:

   1. a.
      a.

      Authorized User rules, including the prohibition on credential sharing;

   2. b.
      b.

      Mandatory Review of AI Outputs;

   3. c.
      c.

      Restricted Decisions and the reviewer standard;

   4. d.
      d.

      Disclosure of AI Outputs and confidentiality thereof;

   5. e.
      e.

      Excluded Data categories and the Business Associate Agreement requirement;

   6. f.
      f.

      Prohibitions on reverse engineering, competitive use, and benchmarking disclosure; and

   7. g.
      g.

      this Section.

4. d)
   d)

   Subject to the non-waivable provisions set forth in clause c) above, nothing herein limits Hobasa's right to enforce reasonable security, lawful-use, and data protection requirements that do not conflict with the Partner Agreement.

2. Authorized Users, Credentials

1. a)
   a)

   Only an individual employee of the Subscriber or End Client (as applicable) may be an Authorized User. Contractors, consultants, temporary staff, secondees, advisers, auditors, and personnel of any affiliate or third party may not be issued credentials without Hobasa's prior written consent, which Hobasa may condition on that individual signing a direct undertaking in a form Hobasa provides.

2. b)
   b)

   Credentials are personal to the individual and must not be shared. No credential may be used by more than one individual. No Authorized User may disclose a credential to any other person. No generic, shared, service, role-based, or departmental account may be used to access the Platform.

3. c)
   c)

   Each Subscriber, Partner, and End Client (as applicable) must maintain an accurate record of its Authorized Users and must revoke access promptly, and in any event within 5 (five) business days, where an individual ceases to be an employee, changes role such that access is no longer required, or is suspected of breaching this AUP.

4. d)
   d)

   Each Subscriber, Partner, and End Client must notify Hobasa at support@hobasa.com without undue delay, and in any event within 72 (seventy-two) hours, on becoming aware of any unauthorized access to the Platform, any credential compromise, or any use of a credential by a person other than the Authorized User to whom it was issued. Hobasa may suspend any credential immediately on reasonable belief of sharing, compromise, or unauthorized use.

3. Mandatory Review of AI Outputs

1. a)
   a)

   No AI Output may be used, relied on, circulated, filed, exported, or acted on in any form without prior review by a qualified person with authority over the decisions being made using AI Output at the Subscriber, Partner, or End Client (as applicable). This applies to every form in which an AI Output may leave the Platform, including exports, scheduled reports, screenshots, copied text, alerts, and conversational answers.

2. b)
   b)

   Every decision taken is the decision of the Subscriber, Partner, or End Client (as applicable), made at its sole discretion and on its own judgement. The user does not rely and will not represent to any third party that it relies on Hobasa or on any AI Output as the basis for a decision.

3. c)
   c)

   Where the Platform indicates the source of a figure, provides a confidence indicator, or flags that a value is computed rather than retrieved, those indicators assist the user’s review. They are not a warranty of correctness and do not reduce the user's obligation to verify AI Outputs.

4. Restricted Decisions

1. a)
   a)

   A “Restricted Decision” is any decision in the following categories: (a) termination, discipline, demotion, suspension, non-renewal, compensation reduction, reclassification, or any other adverse employment action affecting an individual; (b) hiring, promotion, or any eligibility determination affecting an individual; (c) any determination relating to leave, accommodation, disability, or an individual's health status; (d) any filing, certification, disclosure, or submission to a regulator, tax authority, auditor, or court; (e) financial statement preparation, audit response, or a representation to a lender, investor, or acquirer; and (f) any material business decision including a reduction in force, restructuring, divestment, acquisition, or material change in financial position.

2. b)
   b)

   No user may use any AI Output as a basis for a Restricted Decision without first obtaining independent meaningful review by either (i) qualified legal counsel, a qualified HR professional, or another appropriate specialist adviser, or (ii) an executive of the Subscriber or End Client with authority over the relevant decision. The reviewer must be independent of the AI Output in the sense that the reviewer applies independent professional judgement rather than merely transmitting the Output.

3. c)
   c)

   No user may configure or use the Platform to make, or to substantially determine, any Restricted Decision without meaningful human review. Each user is solely responsible for compliance with any law governing automated employment decision tools, artificial intelligence in employment or consequential decisions, or algorithmic accountability, including any notice, consent, bias audit, or impact assessment obligation.

5. Excluded Data

1. a)
   a)

   The Platform is not designed, contracted, or priced to receive the following categories of data (each, “Excluded Data”), and no user may submit them: (a) protected health information under the Health Insurance Portability and Accountability Act, including data held as a covered entity or a business associate; (b) payment card data subject to the Payment Card Industry Data Security Standard; (c) data subject to the Gramm-Leach-Bliley Act, the Family Educational Rights and Privacy Act, or any classified, export-controlled, or government-restricted data; (d) biometric identifiers, genetic information, criminal history, or consumer report data obtained for employment screening purposes (where an Integrated System supplies such data, the user is solely responsible for Fair Credit Reporting Act compliance; Hobasa is not a consumer reporting agency and AI Outputs must not be used as a consumer report); and (e) any data the user is prohibited by law or contract from disclosing to a third-party processor.

2. b)
   b)

   Benefits enrollment, coverage level, contribution and deduction records, leave records, and accommodation records that an employer holds in its capacity as employer and which form part of Client Data are employment records and may be processed under the applicable Agreement.

3. c)
   c)

   Where a user requires protected health information to be processed, the parties must execute a Business Associate Agreement before any such data is submitted. In the absence of an executed Business Associate Agreement, the user has no right to submit protected health information and Hobasa has no obligation to accept or protect it as such.

4. d)
   d)

   If a user submits Excluded Data, it must notify Hobasa immediately. Hobasa may delete the Excluded Data without liability and suspend the affected Integrated System connection. The user indemnifies Hobasa and any Partner against all claims, losses, liabilities, penalties, and costs arising from the submission of Excluded Data.

6. Output Disclosure

1. a)
   a)

   Disclosure of AI Outputs, reports, and financial analyses outside the user's organization is permitted to the Subscriber's or End Client's auditors, accountants, legal advisers, financial advisers, lenders, investors, board members, regulators, and other professional or business representatives for legitimate business purposes, provided: (i) such Outputs have been reviewed in accordance with the Mandatory Review requirements of this AUP; (ii) the recipient is bound by a duty of confidence (whether by professional obligation, contract, or fiduciary duty) that extends to the Output and to Hobasa’s underlying intellectual property embedded in the Outputs; and (iii) the disclosing party remains responsible for the recipient’s handling of the Output. Such disclosure does not grant any third-party access to the Hobasa Platform or rights to Hobasa's underlying software, technology, or proprietary intellectual property. An Authorized User must not share, forward, export, screenshot, republish, present, or otherwise disclose any AI Output, dashboard, report, metric, or conversational answer to any person who is not an Authorized User or an officer of the Subscriber or End Client with a legitimate need to know.

2. b)
   b)

   Disclosure outside the user's organization is permitted only where (a) the recipient is the user's external auditor, legal adviser, or regulator; (b) the disclosure is necessary for that person's engagement; (c) the recipient is bound by a duty of confidence; and (d) the user remains responsible for the recipient's handling of it. Disclosure required by law, court order, or regulatory authority is permitted, provided the disclosing party gives prompt written notice to Hobasa where lawful and limits disclosure to what is strictly required.

3. c)
   c)

   No user may disclose to any third party any performance, security, architecture, or benchmarking information about the Platform, nor any material Hobasa provides for the user's internal use, without Hobasa's prior written consent.

7. Acceptable Use

As a condition of your access and use of the Services, you agree that you may use the Services only for lawful purposes (and shall not be used where prohibited or embargoed), for the intended and explicitly stated purposes, and in accordance with these Terms. You are responsible for making sure that your use of the Service complies with applicable laws in your jurisdiction.

No user shall, and no user shall permit an Authorized User to:

1. a)
   a)

   use the Services other than for the user's internal business purposes or make the Services available to any third party;

2. b)
   b)

   rent, lease, loan, export, or sell access to the Services to any third party, or sign up for the Services on behalf of a third party, except as expressly permitted under these Terms;

3. c)
   c)

   interfere with, disrupt, alter, or modify the Services or any part thereof, or create an unreasonable burden on the Services or networks connected to the Services;

4. d)
   d)

   undermine the security or integrity of Hobasa’s computing systems or networks, or access any Hobasa system or third-party system through the Services without permission;

5. e)
   e)

   access or use the Services in a manner that violates or is intended to circumvent any applicable law or regulation, or any third-party rights;

6. f)
   f)

   reverse-engineer, disassemble, decompile, or otherwise attempt to derive the source code, underlying ideas, algorithms, or trade secrets of the Services, including any AI models, LLM pipelines, or data pipelines;

7. g)
   g)

   copy, modify, create derivative works of, or distribute any component of the Services;

8. h)
   h)

   introduce or transmit any malware, virus, Trojan horse, worm, or other harmful or disruptive code;

9. i)
   i)

   use automated scripts, bots, or other tools to extract data from the Services in a manner that places excessive load or disproportionate load on our infrastructure, or that circumvents any rate limit, access control, or technical restriction imposed by Hobasa;

10. j)
    j)

    misrepresent your identity, impersonate another Partner, or End Client, or use another's API keys or credentials without authorization;

11. k)
    k)

    use the Services, the AI features, or any LLM functionality to generate, produce, store, transmit, or distribute any content that is harmful, abusive, threatening, harassing, defamatory, obscene, discriminatory, or otherwise objectionable, or that could cause harm to any individual, group, or organization;

12. l)
    l)

    use the AI features to generate content that facilitates or promotes illegal activity, self-harm, violence, exploitation, or discrimination on the basis of any protected characteristic;

13. m)
    m)

    use AI-generated content in any way that misrepresents its nature or origin to any End Client, regulator, or third party;

14. n)
    n)

    use the Services to process or store data in violation of applicable export control, sanctions, or data localization laws; attempt to gain unauthorized access to any part of the Services or another Subscriber’s or End Client’s data environment;

15. o)
    o)

    attempt to penetrate, probe, scan, test, or circumvent the security of the Services or any system, network, or infrastructure operated by Hobasa or its sub-processors, whether by automated or manual means, including through the use of vulnerability scanners, password-cracking tools, packet sniffers, denial-of-service attacks, man-in-the-middle attacks, SQL injection, cross-site scripting, or any other technique designed to gain unauthorized access to, disrupt, degrade, or compromise any part of the Services or any data held within them;

16. p)
    p)

    publish, disclose, or distribute to any third party any benchmarking, performance testing, or comparative evaluation results relating to the Services, including any AI Output accuracy assessments, without our prior written consent, which may be withheld in our sole discretion;

17. q)
    q)

    use HR Compliance Outputs as the sole or primary basis for any adverse employment action, including termination, demotion, disciplinary action, or changes to pay or classification, without independent review by a qualified HR professional or employment lawyer;

18. r)
    r)

    present HR Compliance Outputs to employees or regulators as a confirmed determination of violation or a formal HR audit finding without independent professional verification;

19. s)
    s)

    use Financial Intelligence outputs as the sole basis for tax filings, audited financial statements, regulatory submissions, or certified professional advice;

8. Flow Down and Enforcement

1. a)
   a)

   Each Subscriber, Partner, and End Client must flow down the obligations in this AUP to its Authorized Users (and, for Partners, Partner Personnel) by appropriate internal policy, employment undertaking, or contractual term. Breach of this AUP by an Authorized User, Partner Personnel, or officer or employee of the Subscriber or End Client is deemed a breach by the Subscriber, Partner, or End Client itself.

2. b)
   b)

   Hobasa may suspend access to the Services immediately on reasonable belief of a material breach of this AUP, submission of Excluded Data, credential sharing, or security risk. Hobasa will limit suspension to what is necessary and will restore access once the cause is resolved.

3. c)
   c)

   A material breach of this AUP constitutes a material breach of the applicable Agreement and may be grounds for immediate termination of that Agreement in addition to any other rights or remedies available to Hobasa.