NexCert

Acceptable Use Policy

Effective 16 October 2026 · Version 1.1

1. Purpose and scope

This Acceptable Use Policy ("AUP") sets out what you may and may not do when using the NexCert service. It is incorporated into the Terms of Service — a breach of this AUP is a breach of the Terms and can result in suspension or termination of your account under Terms section 13.

This AUP applies to every User of a NexCert account, not only the Customer. The Customer is responsible for ensuring that everyone it authorises to access the Service reads and follows this AUP.

2. Definitions

Terms used here (Customer, User, Service, Certificate, Content, Fees) have the meanings given in the Terms of Service.

3. General principles

You will use NexCert:

• lawfully, and in a way consistent with the UK regulatory framework applicable to your trade — including BS 7671, GN3, GSIUR 1998, PRS Regs 2020, and the rules of your scheme body (NICEIC, NAPIT, SELECT, Gas Safe, BAFE, FIA, MCS, or equivalent);
• honestly, without misrepresenting yourself, your qualifications, or your work;
• competently, only signing certificates you are personally qualified and scheme-registered to sign;
• respectfully, protecting the personal data and confidentiality of tenants, clients, engineers and colleagues.

4. Prohibited activities

4.1 Certification integrity

You must not:

• sign any certificate you are not personally competent, qualified, or scheme-registered to sign;
• sign a certificate on behalf of another engineer without their explicit authorisation and only where the scheme body permits it;
• use another person's scheme registration number, ACS ticket, Gas Safe ID or signature;
• falsify, exaggerate, minimise or fabricate any reading, measurement, observation or photograph;
• backdate a certificate to a date on which the work was not actually completed;
• copy readings or photographs from a previous inspection into a new one when a fresh inspection is required by the applicable standard or scheme rule;
• issue a certificate for work you did not physically inspect or test to the extent required by the applicable standard;
• use the Service to produce fake, sham, or "paper" certificates for properties that were not inspected;
• alter, delete or attempt to bypass any audit-trail record.

4.2 Scheme registration honesty

• Only enter scheme registration numbers that you or your firm actually hold and are currently in good standing on.
• Remove scheme numbers immediately if your registration lapses, is suspended or is withdrawn.
• Do not use the Service to display or reproduce scheme logos in a way you are not authorised to under that scheme's rules.

4.3 Data honesty and respect

• Do not enter fake or placeholder personal data for real properties (e.g. fake tenant details to bypass a required field).
• Do not upload, host, or transmit any content that is unlawful, defamatory, obscene, discriminatory, harassing, or infringes intellectual-property or privacy rights.
• Do not use tenant or landlord contact details captured in the Service for any purpose other than the compliance and service delivery for which you obtained them. In particular: no unsolicited marketing outside what you have properly agreed with the individual.
• Do not process Special Category personal data (health, race, religion, biometrics, etc.) through the Service unless you have a lawful basis under Article 9 UK GDPR and the appropriate safeguards. See the DPA.

4.4 Security

You must not:

• attempt to break in, log in as another user, access another tenant's data, or otherwise breach the multi-tenant isolation of the Service;
• probe, scan, penetration-test or attempt to identify security vulnerabilities without our prior written consent (see section 8 for the responsible-disclosure route);
• upload malicious code, viruses, worms, ransomware or any code intended to disrupt or damage the Service or any User's data;
• launch a denial-of-service, distributed denial-of-service, or resource-exhaustion attack;
• share account credentials outside your organisation, or with anyone who has not agreed to the Terms and this AUP;
• circumvent authentication, rate-limits, allowance caps, subscription controls, feature gates, or licence enforcement;
• use automated tools (scrapers, crawlers, headless-browser bots) to access the Service beyond what the published API and rate-limits allow.

4.5 AI features

NexCert includes AI-assisted features (DB Vision, Notes Reader, Compliance Check, Voice Match, Spec Sentinel, Regs Radar, ACS Sentinel, Calibration Sentinel and any future additions). You must not:

• rely on AI output as the sole basis for a statutory or professional decision — every signed cert is the signer's professional declaration, no matter which AI helper drafted it;
• attempt to jailbreak, prompt-inject, or otherwise manipulate the AI to produce content outside its intended scope;
• feed the AI features with content you don't have the right to process (copyrighted material, others' personal data without a lawful basis, etc.);
• use the Service or its AI outputs to train, improve or benchmark a third-party AI model without our written agreement;
• use the AI features to generate synthetic or fabricated certificate data, readings, photographs or observations;
• attempt to extract or copy the underlying prompts, model configurations, or internal validation rules.

4.6 Communications features

When you use NexCert to send emails or letters (e.g. handover packs, tenant notices, CP14 warning notices, Growth Engine campaigns, or any future Correspondence add-on) you must:

• only send to recipients for whom you have a lawful basis and legitimate reason (statutory delivery, an ongoing service relationship, or the recipient's consent);
• keep the content professional and compliant with UK PECR 2003 (electronic communications), including honouring opt-outs promptly;
• not use the correspondence system for bulk unsolicited marketing;
• not spoof sender identities or misrepresent who the message is from.

4.7 Fair use of shared resources

• Stay within your plan's included allowances, or upgrade, or turn on extra AI allowance in Billing, when you exceed them.
• Do not attempt to circumvent AI-token metering, seat counts, property caps, attachment caps, or storage caps.
• Do not use the Service in a way that materially degrades performance for other Customers (e.g. runaway automation, unbounded imports).

4.8 Intellectual property

• Do not copy, reproduce, republish, sell, sublicense, rent or lease the Service.
• Do not reverse-engineer, decompile or disassemble the Service beyond what UK law expressly permits.
• Do not remove or obscure any copyright notice, trademark, or attribution.
• Do not build a competing product using confidential information gained from your access to the Service.

5. Reporting suspected violations

If you become aware of a breach of this AUP — whether by another User in your own account, another Customer, or someone accessing NexCert without permission — report it to [email protected]. Include as much detail as you safely can (URL, timestamp, account name if known, description). We will investigate and, where appropriate, act.

To report a security vulnerability, email [email protected] with subject "Security" and a description that lets us reproduce the issue. Please give us reasonable time to fix an issue before any public disclosure. We commit to acknowledging security reports within 3 business days.

6. Consequences of breach

We take AUP breaches seriously. Depending on severity, we may:

• notify the Customer's account owner and require corrective action;
• suspend the User's or the whole account's access, with or without notice depending on urgency;
• remove offending Content;
• terminate the Subscription under Terms section 13;
• report the matter to law enforcement, the ICO, or the relevant scheme body (NICEIC, NAPIT, SELECT, Gas Safe, etc.) where we reasonably believe the breach may constitute a criminal offence, a regulatory breach, or professional misconduct;
• cooperate with any subsequent investigation as required by law.

Certification fraud — falsifying, backdating, or issuing sham certificates through the Service — is the most serious category of breach and will generally result in immediate suspension and referral to the appropriate scheme body and, where warranted, the police.

7. Investigations and cooperation with authorities

We may access, preserve and disclose Content and account information where we reasonably believe it is necessary to (a) comply with the law, a court order, or a valid regulatory request; (b) investigate a suspected AUP breach; (c) protect the safety of any person; (d) protect NexCert's rights and property. Where we can lawfully do so, we will notify the affected Customer.

8. Third-party services

If you connect NexCert to a third-party service (accounting integration, job-management platform, MCP client, etc.), that third-party service has its own terms of use. You are responsible for complying with them and for the security of any credentials or tokens you share. NexCert is not responsible for the third party's actions or availability.

9. Changes to this AUP

We may update this AUP from time to time. Material changes will be notified to active Customers at least 30 days before they take effect, and continued use of the Service after the effective date constitutes acceptance. Changes required to address illegal activity, security threats, or urgent regulatory requirements may take effect immediately.

10. Relationship to other documents

This AUP sits alongside the Terms of Service, Privacy Policy and Data Processing Agreement. If there is any conflict between this AUP and the Terms of Service on acceptable-use matters, the more specific provision (usually this AUP) prevails.

11. Contact

Questions or reports: [email protected].