SaaS Acceptable Use Policies In Australia

Running a SaaS platform is exciting, but it can also be a little stressful when users start doing things your product was never built for. Maybe someone is spamming through your system, scraping other users' data, hammering your API, uploading risky content or trying to work around your security controls.

Your terms need to give you a clear, practical way to step in before the behaviour affects your platform, your other customers or your reputation.

A well-drafted SaaS acceptable use policy in Australia does more than sit on your website. It gives your team operational rules for when you can warn, restrict, suspend or terminate an account - and helps users understand the boundaries from day one.

What Is A SaaS Acceptable Use Policy?

A SaaS acceptable use policy is a set of rules that tells users what they can and can't do when they use your software, platform, API, infrastructure or related services.

It's usually part of your broader SaaS terms of use, SaaS terms and conditions or customer agreement. For example, your terms might deal with payment, liability, IP ownership and subscription rules, while your acceptable use policy deals with misuse and platform safety.

For a SaaS business, the policy often covers things like:

• spam and unsolicited messages
• scraping, crawling or harvesting data
• overloading servers, APIs or infrastructure
• attempts to bypass security controls
• misuse of user-generated content features
• uploading malware or harmful code
• infringing copyright, trade marks or other IP rights
• using the platform for unlawful, deceptive or harmful conduct
• sharing login credentials or reselling access without permission

The policy should be written for your actual product. A generic website acceptable use policy or website terms of use may not deal with API abuse, multi-tenant infrastructure, AI outputs, customer data, integrations or automated usage patterns. That's where SaaS platforms often need more detail.

Do You Need An Acceptable Use Policy If You Already Have SaaS Terms?

Yes, you usually need one if your SaaS product can be misused in ways that create security, compliance, reputation or service availability risks.

Your SaaS terms of use in Australia set the main legal relationship between you and your customer. They should cover things like billing, licence rights, support, warranties, liability, renewal and termination.

An acceptable use policy gives you a more operational layer. It helps your support, security and product teams answer questions like:

• Can we block this customer's API calls?
• Can we suspend an account immediately if it's sending spam?
• Can we remove user-generated content without getting consent first?
• Can we restrict usage if it's affecting other customers?
• Do we need to give notice before terminating the account?

This matters because your customers may be consumers, small businesses or larger organisations. If you use standard form contracts, the Australian Consumer Law's unfair contract terms regime can apply to consumer contracts and small business contracts. Since November 2023, unfair contract terms can attract significant penalties, not just be declared void.

That doesn't mean you can't protect your platform. It means your suspension and termination rights should be clear, proportionate and tied to real risks. A term that lets you suspend anyone for any reason at any time may be harder to justify than a term that lets you act where a user creates a security risk, breaches usage limits, causes service disruption, infringes IP rights or uses the platform unlawfully.

Templates often miss these details because they aren't built around your product, your risk profile or your customer base. Your policy works best when it matches how your platform is actually used.

What Should Your Policy Ban?

Your policy should ban the behaviours that could harm your platform, your users, your data, your systems or your legal position.

Most SaaS acceptable use policies should include a prohibited use section. The right list depends on what your software does, but common prohibited uses include:

• Spam: using your platform to send unsolicited commercial electronic messages, bulk messages or deceptive communications.
• Scraping and harvesting: collecting data from your platform, users or systems without permission, including through bots, crawlers or automated scripts.
• Security interference: attempting to bypass access controls, probe vulnerabilities, test systems without approval, access another user's account or reverse engineer protected parts of your software.
• Service disruption: overloading the platform, exceeding rate limits, launching denial of service activity or using the service in a way that affects availability for others.
• Malware and harmful code: uploading, transmitting or distributing viruses, worms, ransomware, spyware or other harmful material.
• IP infringement: uploading or distributing content that infringes copyright, trade marks, moral rights or confidential information.
• Misleading or deceptive conduct: using the platform to impersonate others, misrepresent identity, deceive recipients or run scams.
• Unauthorised resale: sublicensing, reselling, renting or sharing access outside the licence you granted.
• Unapproved regulated use: using the software for high-risk or regulated activities you haven't agreed to support, such as medical, financial or critical infrastructure use, where relevant to your product.

For example, Priya runs a Melbourne-based email automation SaaS. One customer uploads a scraped list and sends thousands of marketing emails through her platform overnight. The emails trigger complaints, Priya's sending domain gets flagged and other customers' campaigns start landing in spam folders.

If Priya's policy clearly bans unsolicited messages, scraped contact lists and activity that harms deliverability, she has a much stronger basis to pause sending, investigate the account and require the customer to fix the issue before access is restored.

Can You Suspend Or Terminate Users Who Misuse Your Platform?

Yes, you can give yourself suspension and termination rights, but they need to be drafted carefully so they're practical and fair.

A good suspension clause should explain when you can act, what action you can take and what happens next. This is where many generic software terms fall short. They say you can terminate for breach, but don't give you the flexible tools you need to manage a live platform.

Suspension Options To Include

Your terms and acceptable use policy can give you a range of enforcement options, such as:

• issuing a warning or takedown request
• rate-limiting API calls or message sending
• blocking particular features or integrations
• quarantining suspicious content
• requiring the user to verify information or provide evidence of compliance
• suspending one user seat rather than the whole account
• suspending the entire account for serious or urgent risks
• terminating the agreement for serious, repeated or unresolved breaches

This gives you room to respond proportionately. A minor first-time breach might need a warning. A compromised account sending malware may need immediate suspension.

When Immediate Suspension Makes Sense

Immediate suspension is usually most appropriate where there's a serious or time-sensitive risk, such as:

• security compromise or suspected unauthorised access
• spam, phishing or malware activity
• conduct that affects other customers or platform availability
• suspected scraping or data harvesting
• urgent legal or regulatory risk
• non-payment, if your terms clearly allow suspension for unpaid fees

Your clause should also say whether fees keep accruing during suspension, whether the customer can access their data, how they can remedy the issue and when you may terminate if the problem isn't fixed.

Where the customer is a consumer or small business on your standard terms, fairness matters. If you want broad discretion, tie it back to specific risk categories and give notice where it's reasonable to do so.

How Should You Handle Spam, Scraping And Platform Abuse?

You should handle spam, scraping and platform abuse with a mix of clear contract rights, technical controls and a repeatable internal process.

Your policy is only useful if your team knows how to apply it. Think of it as both a legal document and an operations playbook.

Spam And Unsolicited Messages

If your platform sends emails, SMS, in-app messages or other commercial electronic messages, the Spam Act 2003 may be relevant. The Australian Communications and Media Authority regulates spam rules in Australia.

Your policy can require users to:

• only send messages to people who have consented
• identify themselves accurately
• include unsubscribe functionality where required
• not use purchased, scraped or harvested lists
• comply with the Spam Act 2003 and other applicable messaging rules

Even if your customer is the one sending the messages, your platform can still be affected. Complaints, blocked domains, blacklisted IP addresses and carrier restrictions can hurt your whole customer base.

Scraping And Bots

Scraping can be a real problem for SaaS platforms that store profiles, listings, pricing data, analytics, prompts, outputs or user-generated content. Your policy should ban unauthorised scraping and automated access, but your product may also need technical support such as rate limits, bot detection and API keys.

If you do allow API access, be clear about:

• permitted API use cases
• rate limits and fair usage rules
• credential security
• whether data can be stored, shared or combined with other datasets
• when API access can be reduced or revoked

Overload And Fair Usage

Many SaaS pricing plans are built around assumed usage. If one customer places unusual load on your infrastructure, it can slow the service for everyone.

Your acceptable use policy can include fair usage rules, such as limits on storage, bandwidth, compute, API calls, file size, users, automations or message volume. If those limits connect to your pricing plans, make sure your customer-facing materials are consistent. The Australian Consumer Law also prohibits misleading or deceptive conduct, so don't market something as unlimited if there are real operational limits that matter.

What About User-Generated Content And Customer Data?

You should deal with user-generated content and customer data directly because they create different risks from ordinary software access.

If users can upload, publish, comment, message, generate, share or store content, your policy should explain what content isn't allowed and what you can do if content breaches the rules.

Common content rules cover:

• copyright or trade mark infringement
• confidential information uploaded without permission
• misleading, deceptive or impersonation content
• harmful, abusive or discriminatory material
• malware, phishing links or suspicious attachments
• content that breaches another person's privacy
• content that your platform isn't designed to host, such as sensitive data categories

You may also need a user content licence. This gives your business permission to host, store, process, display, transmit and back up user content as needed to provide the service. It should be broad enough for your operations, but not so broad that it looks like you're taking ownership of your customers' material.

For customer data, consider your privacy obligations. The Privacy Act 1988 and Australian Privacy Principles can apply if your business is covered by the Act, including where you have annual turnover of more than $3 million or fall into a specific category. If you handle personal information, you should also think about the Notifiable Data Breaches scheme, your privacy policy, security measures and any data processing terms your customers expect.

Even if the Privacy Act doesn't currently apply to your business, many SaaS customers will expect privacy and security commitments as part of procurement. Privacy law reform has also been an active area in Australia, so it's worth keeping your documents under review as your platform grows.

Common Mistakes To Avoid

A strong acceptable use policy is clear, practical and enforceable. The most common mistakes are usually easy to avoid if you think about how incidents will play out in real life.

• Using website terms for a SaaS product: website terms often don't deal with API abuse, customer data, integrations, uptime, infrastructure load or account suspension.
• Being too vague: phrases like misuse of the service can help, but they shouldn't be the only standard. Give concrete examples.
• Forgetting the enforcement process: your policy should say what you can do when there's a breach, not just what users can't do.
• Overpromising unlimited use: if you have practical limits, spell them out clearly in your plans, terms or fair usage rules.
• Ignoring unfair contract terms risk: suspension and termination rights should be transparent and connected to genuine business risks.
• Not matching your technical controls: if your policy says users must follow rate limits, your product and support team should know what those limits are.
• Leaving data access unclear: after suspension or termination, users will want to know whether they can export data and for how long.
• Not updating the policy as the product changes: new AI features, messaging tools, marketplace functions or integrations may need a generative AI use policy and can create new abuse risks.

It's also worth training your customer support and security teams on when to escalate. If a user threatens to churn because you've suspended them, your team should know which clause applies, what evidence to save and who can approve the next step.

Key Takeaways

• A SaaS acceptable use policy helps you manage spam, scraping, overload, harmful content, security risks and other platform abuse.
• Your policy should work alongside your SaaS terms of use, not replace them.
• Suspension rights should be clear, practical and proportionate, especially for standard form consumer or small business contracts under the Australian Consumer Law.
• If your platform sends messages, handles personal information or hosts user content, laws like the Spam Act 2003, Privacy Act 1988 and Copyright Act 1968 may be relevant.
• The best policy matches your product's real risks, your technical controls and your incident response process.
• Review your policy when you add new features, change pricing plans or start serving larger customers.

If you'd like help with your SaaS terms, acceptable use policy, suspension rights or privacy and data protection documents, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.