Acceptable Use Policy.

About this Policy

This Acceptable Use Policy ("AUP") forms part of the Cloud Alter Inc. Terms of Service (the "Terms"), and capitalized terms have the meanings given there. It applies to Customer, its Authorized Users and End Users, its resellers, and anyone else who uses the Services through Customer's Account. Customer must impose this AUP on everyone it lets use the Services and is responsible for their compliance. A violation is a material breach of the Agreement, and Cloud Alter may act under Section 7 without prior notice. Where this AUP and Applicable Law differ, the stricter rule applies.

1. General Prohibitions

No one may use the Services to:

1. violate Applicable Law or anyone's rights;
2. commit or facilitate fraud, phishing, smishing, vishing or identity theft, or impersonate any person, company, bank, delivery service or government body;
3. distribute malware or links to it;
4. send or host content that is unlawful, defamatory, harassing or threatening, or that promotes hatred, violence or terrorism;
5. create, store or transmit child sexual abuse material — Cloud Alter has zero tolerance and reports it to the authorities as the law requires;
6. infringe intellectual-property or privacy rights;
7. evade sanctions or export controls;
8. operate unlicensed telecommunications services or unlawfully bypass interconnection or international-gateway regimes, including SIM-box or gateway termination wherever it is prohibited;
9. evade detection, blocking or investigation by regulators, carriers, law enforcement or Cloud Alter of any activity this AUP prohibits; or
10. help or encourage anyone else to do any of these things.

2. Messaging Rules (SMS, MMS and A2P)

These rules apply to TextEnvoy and to any messaging through the Services.

2.1 Consent

Send commercial or marketing messages only with consent that meets Applicable Law, including express consent (or valid implied consent within its time limits) under Canada's anti-spam legislation (CASL), prior express written consent under the U.S. Telephone Consumer Protection Act (TCPA), and carrier and CTIA requirements. Informational and transactional messages need at least the consent the law requires. Consent may not be bought, rented, shared, or collected through lead-generation or affiliate lists.

2.2 Proof of consent

Keep records showing when, how and from whom each consent was obtained, the wording shown, and any withdrawal, for at least 4 years after the last message to that number, or longer if the law requires. Give them to Cloud Alter within 2 Business Days of a request.

2.3 Identification

Every commercial message must identify the sender and include, or link to, the contact information and unsubscribe mechanism that CASL and other Applicable Law require.

2.4 Opt-out

Honour STOP, END, CANCEL, UNSUBSCRIBE, QUIT, STOPALL, REVOKE, OPT OUT and reasonable equivalents in each language a campaign uses, and any other reasonable means of revoking consent. Stop messaging within the time the law requires, and never later than 10 business days. One confirmation message is permitted. Apply suppression lists across all of Customer's numbers and sender IDs.

2.5 Timing

Send marketing messages only between 8:00 a.m. and 9:00 p.m. in the recipient's local time, or within narrower hours where Applicable Law sets them (some U.S. states, for example, end at 8:00 p.m.).

2.6 Registration and sender IDs

Register brands, campaigns and sender IDs where required (for example 10DLC with The Campaign Registry, toll-free verification, short-code approval, and alphanumeric sender-ID registration in countries that require it). Describe use cases and content accurately, send only traffic that matches the registered use case, and use only numbers and sender IDs Customer is authorized to use.

2.7 Prohibited messaging practices

1. Snowshoeing (spreading traffic across many numbers or sender IDs to avoid filters) and number cycling.
2. Spoofing or misrepresenting a sender ID.
3. Misrepresenting traffic type (such as sending A2P traffic as P2P), or routing A2P traffic through SIM farms, consumer SIM cards or grey routes where that is prohibited.
4. Shared public URL shorteners; use a domain Customer controls.
5. Content built to evade filters, such as character substitution or hidden text.
6. Messages to numbers harvested, or generated randomly or sequentially.
7. Artificially inflated traffic and SMS pumping. Customer must rate-limit and fraud-check its own one-time-password and sign-up flows.

2.8 Prohibited and restricted content

Restricted content may be sent only with Cloud Alter's prior written approval, any carrier approval required, age-gating where required, and full compliance with Applicable Law.

3. Voice Rules (VoIP)

3.1 Robocalls and autodialers

Do not make calls using an automatic dialing system or a prerecorded or artificial voice, including AI-generated or cloned voices, without the prior express consent Applicable Law requires (prior express written consent for telemarketing under the TCPA). Comply with the U.S. Telemarketing Sales Rule, the CRTC Unsolicited Telecommunications Rules (including the automatic dialing-announcing device rules) and similar laws.

3.2 Do-not-call

Scrub telemarketing lists against the U.S. National Do Not Call Registry, Canada's National Do Not Call List, applicable state lists and Customer's internal list; register and pay fees where required; and honour do-not-call requests.

3.3 Calling hours

Make telemarketing calls only within the hours the law permits for the called party's location, applying the stricter rule — for example 8:00 a.m. to 9:00 p.m. under the TCPA, and 9:00 a.m. to 9:30 p.m. on weekdays and 10:00 a.m. to 6:00 p.m. on weekends under the CRTC rules.

3.4 Caller ID

Transmit accurate caller ID that Customer or its End User is authorized to use. Do not spoof caller ID to defraud, cause harm or wrongfully obtain anything of value; do not alter caller ID to disguise a call's origin, country or number type where that is prohibited; do not use invalid, unassigned or unallocated numbers; and meet all STIR/SHAKEN authentication and attestation obligations accurately.

3.5 Robocall mitigation

If Customer is a voice service, gateway or intermediate provider subject to those rules, keep a current Robocall Mitigation Database filing and robocall mitigation program, and provide its details on request. Cloud Alter may block traffic from providers that lack required filings.

3.6 Traffic fraud

Do not engage in traffic pumping, access stimulation, international revenue share fraud, Wangiri, call-back fraud, artificially inflated traffic, sequential or random dialing to scan number ranges, or calls designed to generate termination revenue without a genuine caller.

3.7 Emergency numbers

Do not place test, autodialed or recorded calls to 9-1-1, 911, 112 or any other emergency number.

3.8 Recording

Comply with all call-recording and monitoring laws, including all-party consent requirements where they apply.

3.9 Call-pattern thresholds

Cloud Alter may set thresholds for short-duration calls, answer-seizure ratio, average call duration, call attempts per second and concurrent calls, and may block, throttle or surcharge traffic that exceeds them.

4. Network and Security Abuse

No one may:

1. access any system, account or network without authorization, including Cloud Alter's systems and other customers' accounts;
2. probe, scan or test the vulnerability of the Services without Cloud Alter's written permission;
3. launch denial-of-service attacks, flooding or SIP or SMPP brute-force attempts;
4. circumvent authentication, tenant isolation, licence keys, or port or throughput limits;
5. share credentials outside Customer's organization;
6. use Cloud Alter infrastructure to host or relay attacks, botnets or open proxies, or to mine cryptocurrency; or
7. interfere with any other customer's use of the Services.

Report security vulnerabilities to security@cloudalter.com. Cloud Alter will not pursue claims against good-faith researchers who report promptly, do not access or alter others' data, and do not disrupt the Services.

5. Protecting Shared Infrastructure (Blocklisting)

5.1 Reputation

Customer must not cause — and must act promptly to stop — the blocking, blocklisting, spam-labelling or reputation downgrading of any IP address, domain, server, number, sender ID, short code or other resource that Cloud Alter or its providers use, whether by carriers, call-analytics providers, anti-spam lists, app stores or payment processors.

5.2 Thresholds

Cloud Alter may set and change thresholds for opt-out rates, complaint rates, carrier filtering rates, traceback requests and similar indicators, and may act under Section 7 when they are exceeded.

5.3 Remediation costs

Customer will pay all costs of delisting, re-registering or replacing affected resources (including new IP addresses, numbers or instances), any resulting carrier fines, and the fees in Section 7.4.

5.4 Dedicated resources

Cloud Alter may require Customer to move to dedicated IP addresses, servers or instances, at Customer's cost, to isolate its traffic from shared infrastructure.

6. Resellers and Know-Your-Customer

If Customer resells the Services or uses them to serve other businesses, Customer must:

1. verify each downstream customer's identity before activation (legal name, address, business registration, beneficial owners and use case) and keep those records for at least 5 years after the relationship ends;
2. bind each downstream customer to terms at least as strict as this AUP, and suspend or terminate those who violate them;
3. monitor traffic for abuse and act on complaints within 24 hours;
4. on request, identify to Cloud Alter — and, where lawful, to carriers, traceback groups and authorities — the downstream customer responsible for any traffic, within 24 hours; and
5. not knowingly accept traffic from a provider that Cloud Alter or another provider has blocked or suspended for abuse.

7. Monitoring, Investigation and Enforcement

7.1 Monitoring

Cloud Alter has no obligation to monitor Customer Traffic. To the extent Applicable Law and the DPA permit, Cloud Alter may monitor traffic metadata (such as volumes, destinations, call durations, error codes and opt-out keywords), apply automated filters to message content to detect spam, phishing and fraud, and carry out limited human review of content where needed to investigate a suspected violation or protect the Services, but only as the law permits communications service providers to do so (including under section 184(2) of the Criminal Code (Canada)). Personnel access to content is limited to what the investigation needs.

7.2 Investigation

Customer must cooperate with any investigation and provide consent records, KYC Information, End User details, traffic samples and explanations within 2 Business Days of a request, or within 24 hours for traceback requests and carrier escalations.

7.3 Enforcement actions

Cloud Alter may, with or without notice and in proportion to the seriousness of the violation:

1. issue a warning or require a remediation plan;
2. throttle traffic;
3. block numbers, sender IDs, destinations, routes, IP addresses or content;
4. suspend credentials, sub-accounts or Services;
5. terminate the Agreement or any Service;
6. report the matter to carriers, traceback groups, regulators or law enforcement; and
7. preserve relevant records.

7.4 Fees

Customer will pay: (a) carrier, registry and regulator fines and pass-through charges arising from the violation; (b) a remediation fee of USD $250 for each incident that requires Cloud Alter to intervene, covering the first 2 hours of investigation; (c) further investigation time at USD $150 per hour; and (d) the costs in Section 5.3. These fees reflect Cloud Alter's reasonable estimate of its internal costs.

7.5 No refunds

Subject to Section 7.6 of this AUP and Section 14.5 of the Terms, no refund or service credit is given for Services suspended or terminated under this AUP.

7.6 Good-faith action

Cloud Alter is not liable for action it takes in good faith under this AUP. If a suspected violation proves unfounded, Cloud Alter will restore the affected Services promptly.

8. Reporting Abuse

Report suspected abuse to abuse@cloudalter.com, including the numbers or sender IDs involved, timestamps, message content or screenshots, and any other evidence. Send security vulnerabilities to security@cloudalter.com and law-enforcement requests to legal@cloudalter.com. Cloud Alter will not disclose who made a report unless the law requires it.

9. Changes

Cloud Alter may update this AUP under Section 2.5 of the Terms. Changes needed to comply with Applicable Law or with regulator or carrier requirements may take effect on the shorter notice that Section 2.5 of the Terms allows.

A question about this document? Contact us.