Acceptable Use and Security Addendum

Security and Acceptable Use Terms

Draft version KM-AUP-2026-09-10-DRAFT-1 • Not effective until approved and accepted

1 Accounts and sensitive records

Use an individual account for each person. Do not share passwords, authentication codes, session links or administrator credentials. Use strong unique passwords and available multifactor authentication for privileged access. Grant only necessary roles, review team access and promptly revoke access for departed staff. Do not put bank passwords, full card details or authentication secrets in notes, attachments, support requests or AI prompts.

Customer must have authority to handle the records it uploads. Collect only what is needed, restrict sensitive tenant, financial and property information, and secure downloaded copies. Use approved provider interfaces for payment and bank connections. Confirm company, recipient, bank details and amount before sending a message, exporting records or initiating a transaction.

2 Prohibited activity

Do not attempt to access another company’s information, bypass permissions or usage controls, exploit vulnerabilities, distribute malware, impersonate another person, falsify financial or consent records, or interfere with service. Do not use the platform for unlawful discrimination, harassment, deceptive debt collection, unauthorized screening, fraud or infringement. Security research against the live service requires written scope and authorization; report a suspected vulnerability privately to support without accessing additional records.

AI output requires meaningful human review before use in a financial, legal, housing or other consequential decision. Do not use AI as the sole basis for eligibility, adverse action or tenant screening. Customer remains responsible for lawful notices, explanations and review procedures. Do not submit information to an AI service unless Customer is authorized to disclose it and that service is approved for the information involved.

3 Messaging recording and consent

Customer must have the legally required basis and consent for each message type and recipient, identify the sender appropriately, respect opt-outs and do-not-contact restrictions, and retain necessary consent evidence. Permission to store a telephone number does not by itself authorize marketing, automated calls or an AI voice. Transactional communications must not be used to disguise marketing. Stop prohibited contact promptly when a recipient revokes consent.

Recording, transcription and AI voice features require separate activation. Before use, Customer must determine the requirements for all relevant locations and provide the necessary notices and obtain the necessary consent from participants. A general acceptance of these software terms does not supply a resident’s recording consent. If required consent is absent or uncertain, do not record or use the restricted feature. Carrier registration and throughput limits still apply even where Key Managing imposes no paid texting count cap.

4 Incidents and enforcement

Report suspected compromise, cross-company access, a lost administrative device or an incorrect disclosure promptly to info@keymanaging.com. Include a brief description, time and a safe contact method; avoid unnecessary sensitive data in the report. Preserve relevant evidence and cooperate with containment. Customer and Key Managing each secure the systems under their control.

Key Managing may restrict an affected account or activity proportionately under the service agreement to stop a material breach, fraud, unlawful activity or serious security threat. It will provide notice and an opportunity to correct the problem when safe and lawful. Restrictions do not authorize unrelated deletion of records, undisclosed charges or access to another organization. This policy does not waive Key Managing’s own security responsibilities or either party’s mandatory legal duties.