Why Your SaaS Needs an Acceptable Use Policy (And What to Put In It)

What is an Acceptable Use Policy?

An Acceptable Use Policy (AUP) defines the rules and restrictions for using your platform. It sits alongside your Terms of Service and specifies what users can and cannot do with your service. While your ToS covers the commercial relationship, your AUP covers behaviour.

Why you need one

Without a clear AUP, you have limited grounds to terminate accounts for misuse. If a user claims their account termination was unjustified, your AUP is what allows you to point to the specific behaviour that violated your terms. It also sets expectations upfront, reducing support tickets and disputes.

What to include

Permitted uses: State explicitly what the service is for. This is not just defensive — it helps users understand the intended purpose and sets the tone.

Prohibited conduct: Be specific. Generic "don't do anything illegal" is insufficient. Anticipate the misuse you are most likely to face. For a SaaS with user-generated content: spam, scraping, impersonation, illegal content, harassment. For a tool with API access: automated abuse, rate limit circumvention, reselling access.

Account sharing: Define whether accounts are personal or can be shared. This matters for pricing enforcement as much as security.

Content responsibility: State that users are responsible for the content they create or upload, and that you may remove content that violates the AUP without notice.

Enforcement: List the consequences of violations. Include a range: warning, temporary suspension, permanent termination, legal action. This gives you flexibility to respond proportionately.

Tone matters

Your AUP does not need to sound like it was written by a litigation team. A clear, direct, plain-English AUP is more effective than a dense legal document — because users will actually read it, and you can hold them to it more credibly.

How often to update it

Review your AUP whenever you add major features, enter new markets, or encounter types of misuse you had not anticipated. At minimum, an annual review is sensible. Update the "last revised" date and notify users of material changes.