Abuse Policy

This policy applies to everyone who uses SorviAI: customers, their users, people accessing a Portal, visitors to a storefront built on the platform, and anyone opening a shared link we host. It forms part of our Terms of Service, and it is the rules and regulations the IT Rules ask an intermediary to publish. It is written in English, and complaints in other languages are answered in English.

Where the other policies take over

Do not use SorviAI to do something unlawful, to harm another person, to damage the platform, or to interfere with anyone else’s use of it.

The lists that follow are examples, not an exhaustive catalogue. Something is not permitted merely because it is not listed. If a use is obviously harmful and obviously not what business software is for, treat it as prohibited, and ask us if you are unsure.

Do not host, display, upload, publish, transmit, store or share through SorviAI any material that:

• Belongs to someone else and that you have no right to use.
• Is obscene, pornographic or paedophilic, invades another person’s privacy, including bodily privacy, insults or harasses on the basis of gender, or is racially or ethnically objectionable.
• Sexually exploits or abuses children, sexualises a minor in any way, or is otherwise harmful to a child. We report this to the authorities in every case, without warning and without exception. Reporting crime names the routes.
• Relates to or encourages money laundering or gambling, or promotes enmity between groups on grounds of religion or caste with intent to incite violence.
• Depicts or incites terrorism, extreme violence, or violence against a person or group; harasses, threatens, bullies or defames a person or group.
• Threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States or public order, incites the commission of a cognisable offence, or prevents the investigation of an offence.
• Infringes a patent, trade mark, copyright or other proprietary right, or a trade secret.
• Deceives or misleads people about where a message comes from, or knowingly spreads information that is patently false or misleading: forged documents, counterfeit listings, fake credentials or fraudulent invoices included.
• Impersonates another person or business.
• Is malware, ransomware, spyware, a virus, or code designed to interrupt, damage, limit or gain unauthorised access to a computer resource.
• Is an online game the law does not permit, or an advertisement for one or for a service offering one.
• Contains someone’s personal information published without a lawful basis, including doxxing.
• Breaks any other law in force.

This list follows the categories in rule 3(1)(b) of the IT Rules, in our own words; the Rules’ own text governs.

Do not use SorviAI to:

• Operate a fraudulent business, a pyramid or Ponzi scheme, or an advance-fee scam.
• Launder money, evade sanctions, or process transactions for a business you have concealed from us.
• Issue GST invoices without a real supply of goods or services, for example to pass on input tax credit that is not due.
• Collect Aadhaar numbers where the law does not allow it, or phish for UPI, card or bank details.
• Sell counterfeit, stolen or illegally imported goods, or goods you are not licensed to sell.
• Falsify accounting records to deceive an auditor, a tax authority, a lender or an investor.
• Impersonate another business or person, or misrepresent your affiliation with one.
• Collect or process personal data unlawfully, including employee data in Worklink.
• Evade a suspension or termination we have applied, including by opening a new account.

Some features let you make content publicly reachable without a login: a storefront, a shared file link, a quote or invoice preview sent to a customer, self check-in or kiosk links for Worklink, and a short-lived link that lets a user upload photos from their phone into a record. These carry extra responsibility, because the content is served from our systems to the open internet.

Rules for anything you publish publicly

• Everything in Prohibited content and Prohibited activities applies, and we enforce it more actively here because the exposure is public.
• Do not build a page designed to collect credentials, card details or bank details under false pretences. Phishing pages hosted on our infrastructure are removed immediately and reported.
• Do not use public links as general file hosting or a content delivery network. They exist to share a document with a counterparty, not to distribute media at scale.
• Do not publish a storefront selling anything you are not lawfully entitled to sell in the territories you ship to.
• Keep shared links current. Revoke a link when the person no longer needs it, and do not share a link to data you would not hand over on paper.
• You are responsible for what your own users publish, including anyone you invite into your workspace.

Your duties as the business publishing a storefront

A storefront you publish is your own website, and Indian law places its own duties on you as the business behind it. If you sell to consumers, the Consumer Protection Act 2019 and its e-commerce rules expect you to show who you are, your address and contact details, a grievance contact, and your return, refund and delivery terms. A privacy notice is needed if you collect personal data through the storefront, such as an enquiry form. SorviAI storefronts take enquiries and have no checkout, so the storefront itself takes no order; the rules may still apply to any sale you conclude afterwards. SorviAI’s storefront themes have no dedicated place for your company details, a grievance contact or a privacy notice today, so check how you will meet these duties before you publish.

SorviAI keeps every customer’s data in a separate database schema. Attempting to cross that boundary is the most serious thing you can do on this platform, and we treat it accordingly.

Unauthorised access to a computer system, and acts that damage or disrupt one, can lead to a claim for compensation under section 43 of the Information Technology Act 2000 and, where done dishonestly or fraudulently, to an offence under section 66; they are offences in the United Kingdom, where our systems are, too. We report attacks on the platform to the police where we consider it appropriate, and report the cyber incidents CERT-In lists to CERT-In within 6 hours.

The platform applies rate limits and size limits so that one account cannot degrade the service for others. Attachments are capped at 10 MB per file and Nest files at 100 MB per file. Storefront endpoints, the Worklink kiosk and the phone-upload link are rate limited per IP address. Nest public links and public quote and invoice pages are not rate limited today.

Do not:

• Work around a rate limit by rotating IP addresses, accounts, workspaces or API credentials.
• Automate the interface to place load a human user could not generate, other than through our documented API within its limits.
• Scrape or bulk-extract data from the platform, from a storefront, or from another customer’s public pages.
• Use the platform for cryptocurrency mining, distributed computing or any workload unrelated to running your business.
• Use storage as a general file archive or backup target unrelated to your records in the product.
• Generate artificial load, including load testing, without our written agreement.

The ban on bulk extraction is about other people’s data and about load. It never stops you taking your own records out of your own workspace through the exports the product provides.

• A single account per person. Do not share a login between people. Seats exist so that each person has their own identity, and the audit log is worthless if three people share a sign-in.
• Do not create accounts to extend free trials or to avoid seat charges.
• Do not register accounts using false details or someone else’s identity.
• Do not resell or sublicense access to your workspace unless your agreement with us permits it.
• Keep credentials secure. Turn on two-factor authentication for your own sign-in (each user sets it up for themselves, with recovery codes; administrators cannot yet require it for their users), do not share codes, and tell us promptly if you believe an account has been compromised.
• Remove access when someone leaves. Deactivating a departing user is your responsibility, not ours.

Security abuse bans probing the platform. That ban is not aimed at people trying to help us, and we do not want it to stop you reporting a genuine flaw.

If you find a vulnerability, tell us at [email protected]. We acknowledge reports within 2 working days. What we ask of you:

• Report it to us promptly and give us a reasonable chance to fix it before telling anyone else.
• Only test against your own account or an account whose owner has permitted it. Never against another customer’s data.
• Stop as soon as you confirm a vulnerability exists. Do not pivot further into the system, and do not access, copy, modify or delete data that is not yours.
• Do not degrade the service, and do not run automated scanning that generates significant load.
• Do not extort us. A report conditioned on payment is not a disclosure.

We will not pursue legal action against a researcher who reports in good faith and stays within the boundaries above, we will keep you informed as we work on the issue, and we will credit you if you would like to be credited. This is a promise about what we will do: we will not file a police complaint or bring a civil claim. It cannot grant immunity from the law, and it does not bind the police, prosecutors or any third party. In India, unauthorised access to a computer system can lead to a claim under section 43 of the Information Technology Act 2000 and, where it is done dishonestly or fraudulently, to an offence under section 66, and the Act has no defence for good-faith security research, which is why the boundaries above matter. A report that shows a system has actually been compromised may itself be an incident we must report to CERT-In.

We run no bug bounty programme at present and offer no payment for reports. We would rather say that plainly than leave it ambiguous.

Report abuse to [email protected], or through the form on our contact page. Every report is a complaint to our Grievance Officer, Deepak Gupta, Director, SORVI AI LTD, whose full details are on our Legal Notice and Grievance Officer page. Tell us what you saw, where (the full web address), when, and how to reach you. A screenshot helps. You do not need to be a SorviAI customer or have an account to report: visitors to a storefront, portal users and anyone who received a shared link can use this route.

The times we work to

Complaints can be sent at any time, and our clocks run in calendar time, weekends and public holidays included:

• We acknowledge every complaint within 24 hours.
• We resolve it within 7 days of receiving it.
• A complaint asking us to remove content in one of the categories the IT Rules list (rule 3(1)(b)) is acted on within 36 hours, except a complaint that content belongs to someone else, infringes a patent, trade mark, copyright or other proprietary right, or otherwise breaks the law, which follows the 7 days clock.
• Content that exposes a person’s private area, shows them in full or partial nudity or in a sexual act, or impersonates them in such material, including morphed images, is removed or disabled within 2 hours of a complaint by that person or someone acting for them.
• Reports involving child sexual abuse material, an active phishing page or an imminent security risk are escalated immediately.

There is no report button in the product today: no storefront, portal page or shared-link page links to this route, so it is reached from this page, our contact page or by email. We record each report and our decision by hand.

We tell the person who complained what we decided. We do not usually tell them what action we took against a specific account beyond that, because it is confidential to that customer.

We aim to be proportionate. Most reports turn out to be a misunderstanding, a misconfiguration or a dispute between two businesses that is not ours to settle.

• We look at what we can see without opening your records: public pages, audit metadata, delivery and error logs, and the report itself.
• We access workspace content only where it is necessary to investigate a credible report, or where the law requires it, and we limit that access to what is needed.
• When support staff need to see inside a workspace, they use an impersonation route, and a senior engineer approves each use. Entering it writes a record of who did it, when and against which workspace, in the same transaction as the access itself, so the access cannot happen without the record. A banner in your interface shows that the session is running. The record covers the start of the session; the individual actions taken during it are not logged separately.
• Impersonation is not the only way staff can reach customer data. Our director and one or two senior engineers can connect directly to the production databases for maintenance; that list is reviewed every quarter, and those connections leave no audit record today.
• We will normally contact you and give you a chance to explain or fix the issue before acting.
• We act first and explain afterwards only where the harm is immediate: child safety, an active phishing page, malware distribution, or an attack in progress.

Depending on what we find, and how serious it is, we may:

• Contact you and ask you to fix it.
• Remove or disable access to specific content or a specific public link. Today our staff can do this only by entering your workspace through the impersonation route described above, so the entry is recorded and you will see the session banner if you are signed in at the time.
• Suspend the account until the matter is resolved. Suspension applies to the whole workspace, sign-in included; we lift it by hand, and we tell you ourselves because the platform sends no automatic notice.
• Terminate the account for serious or repeated breaches.
• Report to the authorities where we are required to, or where the conduct is criminal. Reporting illegal content to the authorities lists the routes we use.

We aim to use the least disruptive measure that resolves the problem. Removing one link is better than suspending a company’s accounting system.

Whenever we remove or disable content, or suspend or end an account, we send the customer a statement of reasons, at the latest when the measure takes effect, unless the law or an authority forbids it: what we did, whether it covers all or part of the content, the facts we relied on, whether we acted on a notice or on our own initiative, the law or the rule in this policy that was broken, and how to challenge the decision.

Your data during and after enforcement

An enforcement action is about what you did on the platform. It is not a reason to take your business records away from you, and we do not delete a workspace’s data because we have suspended it.

• Content we remove or disable. Where we can, we disable public access to the item or the link rather than delete it, so the underlying record stays in your workspace. The exceptions are material that is itself unlawful to hold, such as child sexual abuse material or live malware, which we remove and, where the law requires, preserve for the authorities. We keep content we remove or disable, and the records of the removal, for at least 180 days, or longer if a court or an authorised agency asks, as the IT Rules require.
• While your account is suspended. Suspension currently blocks sign-in to the whole workspace, which also blocks the product’s exports. Suspension never removes your right to your data: email [email protected] and our team exports your records for you, as our Terms of Service set out.
• When legal process is involved. Where an authority requires us to preserve data, we preserve it, and a suspension does not shorten that.
• After termination. Termination locks every application, as the end of a subscription does. For at least 30 days after that, our team exports your data for you on request. Nothing is deleted automatically: we delete your data from our live systems within 30 days of your written request, confirm it in writing, and backup copies are overwritten within 7 days after that, as our Privacy Policy and Terms of Service set out.
• Your own retention duties do not stop. Our backups are kept for seven days and are not an archive. They are no substitute for the records you are required to keep, such as eight years for books of account (Companies Act 2013, section 128) and 72 months for GST records (CGST Act 2017, section 36), so keep your own exports.

Your record-keeping duties continue while you are suspended

Indian law sets how long your business must keep its accounting and tax records, and a tax authority may ask to inspect them at any time. Those duties do not pause because we have suspended your account. If you receive a request from an authority while suspended, tell us at [email protected] and we will give getting your records to you priority.

Appealing

If you think we got it wrong, reply to the statement of reasons we sent, or write to [email protected] with the reasons, for six months after we tell you of the decision. The same route is open to anyone who reported content to us and disagrees with what we did about it, including a decision to take no action. Appeals are free.

An appeal is a complaint to our Grievance Officer, so it is acknowledged within 24 hours and decided within 7 days. A senior member of the team who did not take the original decision reviews it. Every decision is taken by a person; we use no automated moderation. If we made a mistake we will reverse it and say so, and we tell you the outcome either way.

If you are not satisfied with our decision, you can appeal to the Grievance Appellate Committee within 30 days of receiving it, at gac.gov.in (rule 3A of the IT Rules). Every decision we send tells you this. Neither route stops you going to court.

Termination for breach of this policy is not refundable. That is set out in our Refund Policy.

Alongside reporting to us, you can go straight to the authorities.

If information we hold gives rise to a suspicion that a criminal offence involving a threat to someone’s life or safety has taken place, is taking place or is likely to take place, we inform the police or the authorities of the country concerned promptly.

If you believe something published on a storefront or through a shared link defames you, send your complaint to [email protected].

Tell us your name, the statement you complain of, where it appears (the full URL), why it is defamatory of you and, as far as you know, why it is untrue or not an opinion honestly held. It is a complaint to our Grievance Officer, on the clocks set out under reporting abuse. Where the author can be identified and contacted, we will pass the complaint to them.

Most of SorviAI is seen only by the members of one business. These are the places where people outside a customer’s team can see content, which is where this policy matters most.

Anyone can report a storefront page or a file shared through a public link by email to [email protected] or through the form on our contact page. Whatever the feature, the reporting and appeal routes in this policy are open to anyone, we do not allow illegal content anywhere on SorviAI, and we remove it when we become aware of it.

We comply with valid legal process. We also check that it is valid, and we do not hand over customer data on an informal request.

• Requests must come through proper legal channels and be addressed to [email protected].
• We disclose only what the request actually compels, not everything we hold.
• Where we are legally permitted to, we notify the affected customer before disclosing, so they have an opportunity to challenge it.
• Where a request looks overbroad or improper, we push back.
• Because we usually process a customer’s business records on its behalf, we will normally direct a request for them to that customer.

Requests from Indian authorities

• Court orders and Government notices about content. Where a court order, or a notice from the appropriate Government or its authorised agency, tells us that content hosted on SorviAI is unlawful (section 79(3)(b) of the Information Technology Act 2000), we remove it or disable access to it within 3 hours, as the IT Rules require.
• Blocking orders. We comply with a blocking order made under section 69A of the Act. Such orders are confidential.
• Interception, monitoring and decryption. The Government can direct these under section 69 of the Act, by executive order rather than a court’s. Such directions are confidential, so we may not be able to tell you about one.
• CERT-In. We give CERT-In the information and help it orders under section 70B(6), and report cyber incidents to it as our CERT-In Incident Reporting and Log Retention Policy sets out.
• Investigations. We give an authorised Government agency the information or help the IT Rules require for a lawful investigation, on a written order that states its purpose.

Requests from elsewhere

We are a UK company and our systems are in London, so authorities in the United Kingdom can also reach us under UK law, and our US-based suppliers are subject to US law. A request from an authority of any other country must reach us through a legal route that binds us, normally through mutual legal assistance arrangements. We treat every request by the same rules: we check the legal basis, disclose only what is compelled, and notify the customer where we are allowed to.

We may update this policy as the platform and the threat landscape change. The version and effective date at the top tell you which one you are reading. This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.

We will announce changes on this page and give workspace owners at least 30 days’ notice of material changes by email, except where an immediate change is needed to address active abuse or to meet a legal requirement. How a change takes effect in your contract with us is governed by the Terms of Service.

If you are not sure whether something is allowed, ask before you do it. That is always easier than unwinding an enforcement action afterwards.

Our full company details are on our Legal Notice and Grievance Officer page.