ACCEPTABLE USE POLICY

Version 1.0 – Effective Date: Oct 15, 2025

1. Purpose

Defines acceptable use of Seacrets’ technological and digital assets, ensuring confidentiality, integrity, and availability (CIA) of systems. Aligned with:

• ISO/IEC 27001:2022
• ISO/IEC 27002:2022
• NIST Cybersecurity Framework (CSF)

2. Scope

Applies to:

• External users (Creators, Fans, Affiliates, Advertisers)
• Internal staff (employees, contractors, moderators, customer support)
• Third parties (identity verification providers, hosting, payment processors)

Covers all technological assets:

• Platform, apps, APIs
• Cloud infrastructure
• Corporate networks
• Dashboards and back-office tools
• Authorized BYOD devices

3. Guiding Principles

4. Prohibited Content & Activities

Illegal or Non-Consensual Material

• CSAM
• Non-consensual recordings or deepfakes
• Extreme violence or prohibited fetishes

Hate Speech & Violence

• Based on race, religion, sexuality, disability, etc.

Financial Crime

• Money laundering
• Terrorism financing
• Misuse of crypto
• Transactions from sanctioned jurisdictions

Fraud & Identity Abuse

• Phishing
• Stolen cards
• SIM swap
• Misrepresentation to bypass KYC

Spam & Misleading Behavior

• Unsolicited messaging
• UDAAP violations
• Fake reviews or manipulated performance metrics

IP Violations

• Unauthorized uploading/distribution of copyrighted material.

System Interference

• Unauthorized access attempts
• Malware insertion
• Bots, spoofing, scanning, DDoS

5. Acceptable Use Rules for Users

All actions carry technical traceability (logs, IP, timestamps, hash-matching).

6. Acceptable Use Rules for Employees & Contractors

Mandatory:

• Unique credentials
• No password/token sharing
• Encrypted devices
• Approved software only
• Compliance with confidentiality rules

Prohibited:

• Unauthorized data exports
• Sharing screenshots, metrics, or customer data externally
• Posting internal information on social networks

All staff activity subject to monitoring and audit.

7. Data Protection & Privacy

All sensitive data = classified as CONF or HCONF. Usage must:

• Be authorized
• Be logged
• Occur only in secure environments
• Avoid external transfers

Forbidden:

• Access without role-based justification
• Sharing outside Seacrets' secure infrastructure

8. Multilayer Monitoring & Moderation

9. Reporting & Response Procedure

Channels:

• Report button in platform
• [email protected]

Process:

• Receipt + Case ID
• Risk Classification (🔴 Critical / 🟠 Medium / 🟢 Low)
• Temporary Action (<2h for Critical)
• Investigation by appropriate team
• Resolution notification within 72h

Records retained 12 months, encrypted.

10. Governance & RACI

Key functions: Board, CISO/CTO, Trust & Safety, MLRO, Compliance Ops, Internal Audit. Ensures separation of duties, accountability, and audit readiness.

11. Training & Awareness

• AUP onboarding training
• CSAM response simulation for T&S
• KPIs: ≥95% approval, MTTR <1h

12. Compliance & Sanctions

Users:

• Warning → Demonetization → Suspension → Termination
• Mandatory reporting to LEA for CSAM, trafficking, financial crime

Staff:

• Written warnings
• Suspension of access
• Contract termination

Third parties:

• Penalties
• Contract termination
• Legal action

13. Review & Versioning

Annual review or earlier if:

• Regulatory changes (DSA, 6AMLD, COPPA, PCI DSS)
• Platform modifications
• Security incidents or audit findings

14. Version History