Acceptable Use Supplement

The Acceptable Use Supplement, effective June 19, 2026, governs users of Proof's identity verification and fraud-prevention services by clarifying that users are solely responsible for interpreting risk scores and fraud indicators, prohibits use of the services for Fair Credit Reporting Act (FCRA) purposes or as consumer reports since Proof is not a Consumer Reporting Agency, and replaces the prior Defend Supplement within the Proof agreement framework.

Acceptable Use Supplement

Last Modified Date: June 19, 2026

This Acceptable Use Supplement is attached to and incorporated into the Proof General Terms, the Order Form, or both. Capitalized terms not otherwise defined have the meanings given in the General Terms, the Proof Glossary, or the Order Form. This Acceptable Use Supplement replaces the Defend Supplement. Any reference to the Defend Supplement in the Order Form or elsewhere in the Agreement shall be read to refer to this Acceptable Use Supplement.

1. Applicability

This Acceptable Use Supplement applies to any User who receives Proof Content.

2. User Responsibilities

Any risk score and any fraud indicators provided do not definitively indicate that fraud has occurred. User is solely responsible for:

Reviewing the risk score and fraud indicators provided by Proof;
Deciding whether action should be taken; and
If User decides action is appropriate, taking that action.

Proof shall have no liability for a failure to detect fraud.

3. Acceptable Use

3.1 Acceptable and Prohibited Uses

Purpose: The Services and Proof Content are provided solely for identity verification, authentication, and fraud-prevention purposes.
No FCRA Use: User shall not use the Services or Proof Content for any “permissible purpose” under the Fair Credit Reporting Act (FCRA), including employment, credit, insurance underwriting, housing/tenant screening, or any other eligibility determination, and shall not use any output to take an “adverse action” as defined by the FCRA.
No CRA Status / No Consumer Reports: Proof is not a Consumer Reporting Agency (CRA) and does not furnish consumer reports. User will not:
- Represent any output as a Consumer Report,
- Combine or use outputs to create or furnish a Consumer Report, or
- Request, procure, or use outputs for any FCRA-regulated purpose.
Other Legal Considerations: Where Proof Content includes data governed by the Gramm–Leach–Bliley Act (GLBA), the Driver’s Privacy Protection Act (DPPA), or a state biometric-information law such as the Illinois Biometric Information Privacy Act (BIPA), such Proof Content is provided solely for identity verification, authentication, and fraud-prevention in connection with User’s legitimate business needs.
Prohibited Uses (GLBA/DPPA/BIPA): User shall not use GLBA, DPPA, or BIPA-governed data for marketing, profiling, or any other purpose restricted by those statutes, implementing regulations, or other restrictions communicated by Proof.
Evolving Legal Requirements: User will comply with any new or amended law or regulation that Proof reasonably determines limits or conditions use of Proof Content, and will promptly implement any restrictions, safeguards, or process changes communicated in writing by Proof.
Geographic Access Controls: User will not access Proof Content from an IP address outside the United States or its territories.
Records Retention: User will maintain for five (5) years complete and accurate records of its access to and use of Proof Content sufficient to demonstrate compliance with this Agreement and applicable law.
Misuse Notification: User will immediately notify Proof in writing if it suspects, has reason to believe, or confirms that any Account ID, Proof Content, or data derived from Proof Content has been lost, stolen, compromised, misused, or accessed by an unauthorized person or for any purpose other than legitimate business reasons.
Notices, Consents, and Lawful Basis: User shall provide all required notices and obtain all necessary consents and authorizations under applicable law for:
- The transfer of User Data to Proof and its vendors/subprocessors;
- The processing of such User Data by Proof and its vendors under the Agreement; and
- Access by Proof or its vendors to Customer Proprietary Network Information, where applicable.
Sanctions Compliance Representation: User represents that neither it nor any of its shareholders, directors, officers, or principals is organized in, located in, or a citizen of a country and region subject to comprehensive U.S. embargo or similar sanctions, or listed on the U.S. Department of the Treasury’s Specially Designated Nationals (SDN) or Blocked Persons lists (or any similar restricted-party list).
Monitoring, Verification, and Audit Cooperation: Proof may monitor usage and review records as reasonably necessary to safeguard data and verify compliance. User will cooperate with reasonable compliance inquiries and provide information demonstrating adherence.
Remedies: Proof, in its sole and reasonable discretion, may terminate the Agreement with User immediately to prevent additional non-compliance.

3.2 Gramm-Leach-Bliley Act

Proof Content may contain consumer identification information governed by GLBA. User certifies that such information will only be used for the following purposes:

Fraud detection and prevention, including use to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;
Completion of a transaction authorized by User, including collection of delinquent accounts;
Application Verification, including employment application verification (not for making employment decisions as outlined in the FCRA), property leasing application information verification (not for making leasing decisions as outlined in the FCRA), and insurance application information verification (not for making insurance decisions as outlined in the FCRA). User represents and warrants that Proof Content will not be used for purposes governed by the FCRA;
Law firm and attorney functions, including use by persons or their representatives holding a legal or beneficial interest relating to User;
Insurance purposes, including account administration, reporting, fraud prevention, premium payment processing, claim processing and investigation, benefit administration, or research projects;
Required institutional risk control programs, including complying with federal, state, or local laws, rules, and other applicable legal requirements; and
Dispute resolution for resolving customer disputes or inquiries.

3.3 Driver's Privacy Protection Act

Proof Content may contain driver's license and motor vehicle registration information subject to the protections of the DPPA. User certifies that such information will only be used for the following purposes:

Use in the normal course of business, to verify the accuracy of personal information submitted by User and, if incorrect, to obtain correct information, but only for the purpose of preventing fraud, pursuing legal remedies, or recovering on a debt or security interest against User;
Use by court or other government agency or entity, acting directly on behalf of a government agency;
Use for any matter regarding motor vehicle or driver safety or theft; to inform an owner of a towed or impounded vehicle;
Use in connection with a civil, criminal, administrative, or arbitral proceeding;
Use by an employer or its agents or insurer to obtain or verify information relating to a holder of a commercial driver's license as required under the Commercial Motor Vehicle Safety Act of 1986;
Use by an insurer or insurance support organization, in connection with claims investigation activities, antifraud activities, rating, or underwriting;
Use by a licensed private investigative agency, or licensed security service, for a purpose permitted above; and
Use in connection with the operation of private toll transportation facilities.

4. Indemnification

User will indemnify, defend, and hold Proof, its affiliates and their officers, directors, employees, agents, and representatives harmless from and against any and all costs, damages, liabilities, or expenses (including reasonable attorneys’ fees) arising from any third-party claims resulting from:

Use of Proof Content received by User (or any third party receiving such information from or through User) furnished by or through Proof; and
Any unauthorized third-party access to or processing of any Proof Content received by User (or any third party receiving such information from or through User) furnished by or through Proof.

Incident Priority and Resolution

Priority Levels

Level 1 (Critical Business Impact): The Incident seriously affects the functionality of the Services and cannot be circumvented such that most of the significant functionality is available.
Level 2 (Significant Business Impact): The Incident partially affects the functionality of the Services, but can be circumvented so that most significant functionality is available.
Level 3 (Minimal Business Impact): The Incident can be circumvented such that the Services can be used with only slight inconvenience. The problem is insignificant and has no significant effect on usability.

Conditions for Closure of Help-Desk Ticket

Level 1: Resolved and closed when an Incident Resolution has been fully implemented.
Level 2: Resolved and closed when an Incident Resolution has been fully implemented.
Level 3: Resolved and closed when either an Incident Resolution has been fully implemented, or 10 business days have elapsed since Proof’s communication of the information that Proof reasonably believes will resolve the Incident (communicated by email to Subscriber’s designated contact), and Subscriber has not responded. The Incident can be reopened later if not resolved.

On-Demand Notary Downtime Credit

Up to 240 minutes: No credit
241-360 minutes: 1%
361-480 minutes: 3%
481-600 minutes: 5%
601 minutes or greater: 7%

Platform Availability Percentage and Downtime Credit

99.9% or higher: No credit
97% - 99.9%: 1%
95% - 97%: 3%
93% - 95%: 5%
Below 93%: 7%

Incident Priority Response Times

Incident Priority	Acknowledgement Time (Business Hours)	Provision of Incident Resolution or Interim Process	If Interim Process Provided, Max Timeframe for Resolution
Level 1	1 hour	8 hours	36 hours
Level 2	4 hours	24 hours	5 days

Personal Information Categories (California)

Personal Identifiers

Sources: Directly from you; indirectly from you as you use Services; notaries; data analytics providers; social networks; advertising networks; internet/mobile service providers; counterparties; credential analysis companies; identity verification services.
For job applicants: Directly from you; background check providers; recruiters; recruiting software providers.
Purpose: Provide Services; communicate; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market.
For job applicants: Assess application; satisfy legal obligations.
Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; notaries; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties; single sign-on providers; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; background screening companies; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

California Customer Records Personal Information

Sources: Directly from you; counterparties; credential analysis companies; identity verification services.
For job applicants: Directly from you; background check providers; recruiters; recruiting software providers.
Purpose: Provide Services; communicate; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market.
For job applicants: Process application; satisfy legal obligations.
Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; background screening companies; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

Characteristics of Protected Classifications

Sources: Directly from you; indirectly from you as you use Services; notaries; data analytics providers; social networks; advertising networks; internet/mobile service providers; counterparties; credential analysis companies; identity verification services.
For job applicants: Directly from you; background check providers; recruiters; recruiting software providers.
Purpose: Provide Services; communicate; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market; meet legal obligations.
Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; notaries; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; background screening companies; mortgage process digitization providers; electronic signature and digital transaction management providers.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

Commercial Information

Sources: Directly from you; indirectly from you as you use Services; notaries; data analytics providers; social networks; advertising networks; internet/mobile service providers; counterparties.
Purpose: Provide Services; communicate; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market; meet legal obligations; maintain transaction records.
Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; notaries; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

Biometric Information

Sources: Directly from you; indirectly from you as you use Services; internet/mobile service providers; credential analysis companies; identity verification services.
Purpose: Provide Services; communicate; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; meet legal obligations; maintain transaction records.
Recipients: Affiliates; technology service providers.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

Internet and Other Electronic Network Activity Information

Sources: Indirectly from you as you use Services; data analytics providers; social networks; advertising networks; internet/mobile service providers.
Purpose: Provide Services; detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; verify, maintain, improve, upgrade, or enhance a service or device; identify and repair errors; advertise or market; perform analytics.
Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; single sign-on providers; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

Geolocation Data

Sources: Indirectly from you; devices you use to access Services; data analytics providers; social networks; advertising networks; internet/mobile service providers.
Purpose: Provide Services; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market.
Recipients: Advertising networks; social networks; technology service providers; customer relationship management providers; mobile application platforms; tag management platforms; video sharing platforms; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; web mapping platforms.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

Sensory Data

Sources: Directly from you; indirectly from you as you use Services; internet/mobile service providers; credential analysis companies; identity verification services.
Purpose: Provide Services; communicate; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; meet legal obligations; maintain transaction records.
Recipients: Affiliates; technology service providers; counterparties.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.

Professional or Employment-Related Information

Sources: Directly from you; notaries; data analytics providers; social networks; advertising networks; counterparties; credential analysis companies; identity verification services.
For job applicants: Directly from you; background check providers; recruiters; recruiting software providers.
Purpose: Provide Services; communicate; protect and secure environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market.
For job applicants: Process application.
Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; notaries; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; background screening companies; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.
For job applicants: Up to 7 years for non-hired applicants, barring any legally required additional retention period.

Non-public Education Information

For job applicants: Directly from you; recruiting software providers; background check providers; recruiters.
Purpose: Process application.
Recipients: Affiliates; background screening companies; technology service providers.
Retention: Up to 7 years for non-hired applicants, barring any legally required additional retention period.

Inferences Drawn from Information

Sources: Indirectly from you; devices you use to access Services; data analytics providers; social networks; advertising networks; internet/mobile service providers.
Purpose: Provide Services; advertise or market; perform analytics; maintain, improve, upgrade, or enhance a product or service.
Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; mobile application platforms; tag management platforms; video sharing platforms; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; collaboration software providers; customer engagement and communication platforms; web mapping platforms.
Retention: Length of business relationship plus any legally required additional retention period or as long as business needs require, whichever is longer.