By business type

Acceptable Use Policy Generator for SaaS

Written for the controller/processor split, sub-processor lists, DPAs and enterprise security review.

Generate your acceptable use policy Read the acceptable use policy guide

A SaaS AUP is an operational document. It is what lets support suspend an account without breaching the contract, and it is what you point at when a customer complains that a suspension was arbitrary.

A SaaS company wears two hats simultaneously, and the single biggest failure in SaaS privacy documentation is not separating them. For your own marketing site, billing and support you are a controller. For the customer data your users push into the product you are a processor, acting on their instructions - and the disclosures, the rights, and the deletion obligations are completely different in each role.

That distinction is not academic. It determines who answers a data subject access request, who notifies a regulator after a breach, who signs which contract, and what your policy is allowed to promise. A privacy policy that describes customer-uploaded data as "your data that we use to improve our services" is describing processor data in controller language, and enterprise security reviewers will catch it.

The commercial layer matters as much as the legal one. Every enterprise deal now runs through a security questionnaire that asks for a data processing agreement, a published sub-processor list with change notification, a defined breach notification window, and a sub-processor change-objection right. Having those documents ready shortens sales cycles; not having them stalls deals at procurement.

What a acceptable use policy for a SaaS product has to cover

Prohibited content and conduct, specific enough to enforce consistently
Technical limits: rate limiting, scraping, resource abuse, quota circumvention
Security testing rules and a responsible disclosure route
The enforcement ladder from warning to suspension, with an emergency path
An appeals route, because customers will ask for one and regulators increasingly expect it

How a SaaS product actually moves personal data

Customer-uploaded content (processor role)

Whatever your users put into the product, including personal data about their own customers and staff. You process it on instruction, you do not decide its purposes, and you cannot use it for your own ends without a separate basis.

Account, billing and usage data (controller role)

Names, work emails, plan, invoices, feature usage and login history. This is yours to decide about, and your privacy policy is the notice for it.

Product analytics and session recording

Tools like Amplitude, PostHog or a session recorder capture in-app behaviour - which frequently means capturing customer data as a side effect, turning an analytics decision into a processor problem.

Support tickets and screenshots

The fastest route by which processor data ends up in a controller system. A screenshot attached to a ticket lands in a helpdesk with a different retention policy.

AI features processing customer content

If your product sends customer data to a model provider, that provider is a sub-processor, and whether the data is used for training is the first question every enterprise reviewer asks.

Sales and marketing enrichment

Buying contact data and enriching leads is controller processing with a legitimate interests analysis and a notification duty under Article 14 to people whose data you did not collect from them.

Third parties the draft will ask you about

AWS or Google Cloud · Stripe · Twilio and SendGrid · Intercom or Zendesk · Amplitude or PostHog · Datadog or Sentry · HubSpot or Salesforce · OpenAI or Anthropic · Snowflake

The rules that apply

GDPR Article 28

Processor obligations: process only on documented instructions, confidentiality, security, sub-processor authorisation, assistance with rights and breaches, deletion or return at the end, and audit rights.

Sub-processor transparency

Not a statutory list requirement in itself, but the practical standard: a published list, and advance notice with an objection window before adding to it.

Transfer mechanisms in the contract chain

SCCs and the UK Addendum have to flow down to sub-processors, not just sit in the top-level agreement.

Breach notification, contractual and statutory

As a processor you notify your customer without undue delay; as a controller you notify the regulator within 72 hours in the UK and EU.

US state law service-provider terms

CCPA requires specific contract language for a recipient to count as a service provider rather than a sale.

What the generated acceptable use policy contains

Prohibited content and conduct
The categories you will not host, written specifically enough to enforce and narrowly enough to defend.
Technical restrictions
Rate limits, scraping, load testing, resource abuse and circumvention of quotas.
Security research boundaries
What testing is permitted, how to report a finding, and what will not be treated as an attack.
Reporting and moderation
How abuse is reported, what happens next, and the timescales you work to.
Enforcement ladder
Warning, throttle, suspension, termination - with the emergency route for genuinely urgent harm.
Appeals
How someone contests a decision, which several online-safety regimes now require rather than merely encourage.

The SaaS compliance document set

Separate the privacy policy from the DPA
The policy covers you as controller. The DPA covers you as processor. Different audiences, different content, different signatures.
Publish a sub-processor list with a subscribe option
Name, purpose, location. Offer email notification of changes and an objection window.
Write the security page procurement actually asks for
Encryption, access control, testing cadence, incident response, and whatever certification you hold - or an honest statement that you hold none yet.
Define the breach notification window in the DPA
A stated number of hours, and an internal process that can meet it.
Decide and document your AI data position
Whether customer content reaches a model provider, whether it is used for training, and how long the provider retains it.
Build deletion and export that actually work
Article 28 requires deletion or return at the end of the relationship, and enterprise contracts require proof.

Where this usually goes wrong

One document covering both roles

The privacy policy describes controller processing. Processor obligations belong in the DPA. Merging them produces a document that over-promises about customer data and under-explains your own.

Training on customer data without saying so

The single fastest way to lose an enterprise deal, and depending on your terms, a breach of the instruction limitation in Article 28.

A sub-processor list that is out of date

If the contract promises notice before adding a sub-processor, adding one silently is a breach of contract as well as a transparency failure.

Support tooling that copies processor data into controller systems

Screenshots, exported CSVs and debug logs move data out of the environment your DPA describes.

No defined breach notification window

"Without undue delay" is the statutory phrase, but enterprise contracts want a number. Not having one is a negotiation cost on every deal.

Free-tier and trial data treated casually

Trial accounts contain real customer data far more often than teams assume, and the same obligations apply.

Frequently asked questions

Is my SaaS company a controller or a processor?

Both, in different respects. You are a controller for your own account, billing, marketing and support data, and a processor for the data your customers put into the product. The documents you publish should make the boundary obvious.

Do I need a data processing agreement?

If you process personal data on behalf of business customers subject to GDPR or UK GDPR, yes - Article 28 requires it in writing. In practice enterprise customers will require one regardless of jurisdiction.

Do I have to publish a sub-processor list?

There is no free-standing statutory duty to publish one, but almost every enterprise DPA requires notice before you add a sub-processor, and a public list is the standard way to meet that.

Can I use customer data to train AI models?

Only with a lawful basis and, where you are a processor, only if your customer has instructed or permitted it. Doing it silently breaches the instruction limitation and, for most enterprise contracts, the agreement itself.

What breach notification window should I commit to?

Common commitments run from 24 to 72 hours from confirmation. Pick one your incident process can actually meet, because a missed contractual deadline is a breach of contract on top of the incident.

Do I need an acceptable use policy separate from my terms?

A separate AUP is easier to enforce and easier to update. It also gives moderation staff and automated systems a single reference to cite, which matters when a suspension is challenged.

Does an AUP help with platform liability?

It is part of the picture. Intermediary liability protections generally depend on acting on notice, and both the EU Digital Services Act and the UK Online Safety Act expect published rules, a reporting route and an appeals process.

How specific should prohibited-use lists be?

Specific enough that a moderator can apply it consistently, with a residual catch-all. Lists that are only catch-alls get challenged; lists that are only specific leave gaps.