Acceptable Use Policy

1. Purpose & Scope

This Acceptable Use Policy (“AUP”) defines the rules governing the use of the Pochyaa platform. Pochyaa safeguards commercial disbursement capital; maintaining the integrity, security, and reliability of the platform is paramount for all tenants.

2. Prohibited System & Network Activities

You agree that you will not engage in any of the following activities:

• Tenant Boundary Violations: Attempting to access, query, or manipulate data belonging to another organization tenant (e.g., Insecure Direct Object Reference / IDOR attempts or multi-tenant scope tampering).
• Access Key & Invite Code Abuse: Brute-forcing, guessing, enumerating, automating, or publicly distributing beta invitation codes or registration tokens.
• Security Testing Without Authorization: Conducting automated vulnerability scanning, denial-of-service (DoS/DDoS) stress tests, or penetration tests against Pochyaa infrastructure without prior written authorization.
• Malicious File Uploads: Uploading or transmitting files containing malicious code, viruses, Trojan horses, ransomware, web shells, or executable payloads disguised as invoice or contract documents.
• Credential Stuffing & Brute Force: Automating authentication attempts against sign-in or password-reset interfaces.
• Scraping & Reverse Engineering: Scraping, harvesting, or extracting application interface code, audit rule logic, or underlying proprietary databases through automated spiders or bots.

3. Commercial Integrity & Fraud Prevention

You may not use Pochyaa to:

• Facilitate invoice fraud, fictitious vendor creation, or illicit fund diversion.
• Knowingly upload fraudulent or forged contract amendments to bypass purchase order ceilings.
• Conceal commercial kickbacks or unauthorized price-fixing arrangements.

4. Responsible Vulnerability Disclosure

We welcome responsible security research. If you discover a potential security flaw or tenant-isolation concern:

1. Disclose the details confidentially to contact@pochya.com.
2. Provide sufficient detail to reproduce the issue without attempting to access or exfiltrate customer data.
3. Allow our engineering team reasonable time to remediate the vulnerability before public disclosure.

5. Enforcement & Account Termination

Pochyaa reserves the right to immediately suspend or terminate access for any user or organization that violates this AUP. Violations involving unauthorized access attempts or intentional data compromise may be referred to civil and criminal law enforcement authorities.