Acceptable Use Policy

1. Why this policy exists

Arubis holds the financial records of many businesses on shared infrastructure. Every customer depends on every other customer using it responsibly: one account used to send fraudulent invoices damages the reputation of every legitimate invoice sent through the platform; one user probing for weaknesses puts every set of books at risk; and one business keeping false records through Arubis undermines the trust that tax authorities, auditors and lenders place in records kept on it.

This Acceptable Use Policy ("Policy") sets out the rules that protect that shared trust. It forms part of the Terms of Service and the End User Licence Agreement between Olympus Pay Proprietary Limited ("Olympus Pay", "we") and each customer and user. It applies to everyone who uses Arubis, including Athena, the customer-facing invoice and quote links, application programming interfaces and email sent through the platform.

We have tried to explain the reason for each rule, because rules that make sense are more likely to be followed and are easier to apply fairly to situations this Policy does not anticipate. Where a situation is not covered, we will apply the principle behind the closest rule.

2. Lawful use

You must use Arubis only for lawful purposes and in compliance with all laws that apply to you, your business and your use of the platform. You must not use Arubis to:

Accounting systems are attractive to fraudsters precisely because records kept in them look credible. Arubis protects that credibility through immutable posted entries, a complete audit trail and segregation of duties. Using those features to lend false records an appearance of legitimacy is among the most serious breaches of this Policy.

3. Honest documents and communications

Invoices, quotes, credit notes, statements and reminders sent through Arubis carry your business's name and are delivered from Olympus Pay email infrastructure. Recipients, and the email providers that decide whether our messages reach inboxes, judge every Arubis customer by what any one of them sends. You must therefore:

Debt collection through reminders and late fees must comply with the law and with the terms agreed with your customer. You must not charge fees that your customer has not agreed to or that the law does not permit.

4. Personal data

Your books will contain personal data about your customers, suppliers, employees and others. As the controller of that data under the Data Protection Act, 2024, you must:

You must not use Arubis, including Athena, to compile profiles of individuals for purposes unrelated to your accounting, such as to track the private lives of customers or employees.

5. Security and integrity of the platform

You must not do anything that threatens the security, integrity or availability of Arubis or of any customer's data. In particular, you must not:

Conduct of this kind may also be an offence under the Cybercrime and Computer Related Crimes Act, 2018, and we will report it to the authorities where appropriate.

6. Responsible disclosure

We want to hear about security weaknesses so that we can fix them. If you believe you have found a vulnerability in Arubis, please report it to support@olympuspay.co with "Security" in the subject line, including enough detail for us to reproduce it.

When investigating a suspected vulnerability, you must: use only your own accounts and Organisations, or test Organisations you create for the purpose; stop as soon as you have established that a vulnerability exists, and not access, modify or delete data that is not yours; not degrade the service for others; and keep the details confidential until we have fixed the issue or ninety days have passed, whichever is sooner, unless we agree otherwise.

If you follow these rules in good faith, we will not pursue legal action against you or ask the authorities to do so in respect of your research, we will work with you to understand and resolve the issue, and we will acknowledge your contribution if you wish.

7. Fair use of resources

Arubis is designed for the bookkeeping of real businesses. To keep it fast and affordable for everyone, plans include reasonable limits on activity, such as the number of documents read by Athena per hour, the number of emails sent per hour, and the size of files uploaded. Those limits are set well above the needs of normal use and are designed to stop abuse, not to restrict legitimate businesses.

You must not attempt to circumvent limits, for example by creating multiple accounts or Organisations to multiply them. If your legitimate use requires more, contact us and we will work with you to accommodate it.

Storage is for records related to your accounting, such as receipts, contracts and statements. It is not a general file storage service.

8. Professional users

Accountants, bookkeepers, tax practitioners and auditors who use Arubis on behalf of clients must, in addition to the rest of this Policy:

Arubis records which professional performed each action. That audit trail protects professionals as much as their clients, because it shows clearly what they did and did not do.

9. How we enforce this policy

We do not monitor the content of customers' books as a matter of routine. We may, however, review use of the platform where we receive a complaint, where our automated systems detect activity that suggests abuse, such as a sudden surge in outbound email, repeated attempts to access other Organisations, or uploads that resemble malware, or where an authority makes a lawful request.

If we reasonably believe that this Policy has been breached, we may take action proportionate to the seriousness of the breach, the harm caused or threatened, and the history of the account. Our response may include: contacting you to understand what happened and asking you to stop; removing or disabling access to particular content; restricting particular features, such as sending email or using Athena; suspending users or Organisations; terminating accounts; and reporting the matter to the police, the Financial Intelligence Agency, the Information and Data Protection Commission or another competent authority.

Where the breach is not serious and not continuing, we will normally contact you first and give you an opportunity to remedy it. Where there is an immediate risk to the platform, to other customers or to third parties, or where the law requires it, we may act first and explain afterwards.

Suspension or restriction under this Policy does not delete your books. Unless a court or competent authority directs otherwise, you will remain able to export the records you need to meet your own legal obligations.

10. Reporting abuse

If you receive an invoice, quote or other message sent through Arubis that you believe is fraudulent, unsolicited or abusive, or you believe someone is misusing the platform, please tell us at support@olympuspay.co with "Abuse" in the subject line, including a copy of the message with its full headers if you can.

We investigate every report. We may not be able to tell you the outcome, because doing so might disclose information about another customer, but we will act on reports that show a breach of this Policy.

If you believe you are the victim of a crime, you should also report it to the Botswana Police Service.

11. Your responsibility for others

A customer is responsible for the conduct of every user it invites into its Organisations, and for ensuring that they are aware of and follow this Policy. Breaches by a customer's users are treated as breaches by the customer.

Where you use Arubis to provide services to your own clients, you are responsible for ensuring that your use on their behalf complies with this Policy.

12. Restricted and prohibited businesses

Some businesses may not use Arubis at all, and others may use it only with additional care, because of the risk they present of fraud, money laundering, consumer harm or breach of law. These categories follow the restricted business lists that apply across Olympus services.

Arubis may not be used to keep books for, or to issue documents on behalf of: businesses that are unlawful in Botswana or where they operate; unlicensed providers of financial services, gambling, or the sale of controlled substances, weapons or ammunition; businesses that sell counterfeit goods or infringe intellectual property; pyramid schemes, Ponzi schemes and other investment frauds; or businesses engaged in the exploitation of people, including human trafficking and forced labour.

Businesses that require a licence or registration to operate, such as those dealing in precious metals and stones, money services, alcohol, medicines or security services, may use Arubis provided they hold and comply with the licences their activities require. We may ask for evidence of a licence where we have reason to believe one is required and not held.

If your business changes so that it falls within one of these categories, you must tell us. Using Arubis for a prohibited business is a serious breach of this Policy.

13. Content of attachments and documents

Attachments you upload, such as receipts, contracts and statements, should be records that relate to your accounting. You must not upload: material that contains malicious code; material that you do not have the right to store; images or documents that are unlawful, obscene or that depict the abuse of any person; or large volumes of material unrelated to your books.

Attachments are stored privately in your Organisation and are not shared with anyone outside it unless you choose to share them, for example by attaching a document to an invoice you send. We may scan uploads automatically for malware and reject files that appear harmful.

14. Email sent through Arubis

Invoices, quotes, reminders and invitations sent through Arubis are delivered from Olympus Pay email infrastructure, using a sending domain whose reputation is shared by every customer. To protect deliverability for everyone:

We monitor bounce and complaint rates. If an Organisation's emails generate unusually high bounces or complaints, we may pause its email sending while we work with you to resolve the cause. You will still be able to share documents by link while sending is paused.

15. Use of Athena

Athena is designed to help you with your own books. You must not use it to: generate content unrelated to your accounting at volume, such as marketing copy or general research, in a way that consumes shared capacity; attempt to extract the instructions, prompts or tools that make it work; attempt to make it act outside your permissions or reveal data about other Organisations; or submit documents crafted to manipulate it into taking actions. The Athena and Automated Processing Terms contain further rules.

16. Examples

The following examples illustrate how we apply this Policy. They are not exhaustive.

A business records cash sales accurately but forgets to record some for a month, and corrects the omission when it notices. That is ordinary bookkeeping and does not breach this Policy.

A business issues invoices from Arubis to customers for services it never provided, in order to support a loan application. That is a serious breach, and we may suspend the Organisation and report the matter.

An accountant tries a client's invoice link with the last characters changed, to see whether another client's invoice appears. That is an attempt to access data without authority, whatever the motive, and breaches this Policy. The right course is to report the concern under the responsible disclosure rules.

A bookkeeper uploads two hundred receipts in an afternoon at the end of the year. That is exactly what receipt import is for. If the volume reaches a reading limit, the remaining receipts will be read once the limit resets, and nothing is lost.

A business sends a monthly statement and a polite reminder to a customer whose invoice is overdue. That is legitimate. Sending daily reminders that threaten consequences not provided for in the contract is not.

17. Integrations and automated access

Where we provide a way to connect other software to Arubis, such as an import, an integration or an application programming interface, you must use it only as documented, within the published rate limits and only for the Organisations you are authorised to act for. Credentials issued for an integration must be stored securely, given only to the systems that need them, and revoked when no longer needed.

You must not build or use tools that sign in to Arubis as a person in order to automate the user interface, because doing so bypasses the protections that interfaces designed for automation provide, such as scoped permissions, revocable credentials and clear attribution in the audit trail. If you need an automation that our interfaces do not yet support, tell us what you need and we will consider building it.

Data you obtain through an integration is subject to the same confidentiality, data protection and retention obligations as data in Arubis itself.

18. Cooperation with investigations

If we investigate a possible breach of this Policy, you agree to cooperate reasonably, including by answering questions about the use of your account and providing information we reasonably request. We will keep the information you provide confidential, use it only for the investigation and any action that follows, and tell you the outcome where we are able to.

Where an authority investigates conduct involving Arubis, we will cooperate with it as the law requires, in accordance with the Privacy Policy and the Data Processing Addendum.

19. Shared responsibility for a trustworthy platform

Most businesses never come close to breaching this Policy, and we do not expect them to. It exists because a platform that keeps the books of many businesses is only as trustworthy as the least careful of them, and because the people who rely on records kept in Arubis, including tax authorities, auditors, banks and customers, need to know that the platform does not tolerate their misuse.

By following this Policy, you help keep the documents sent from Arubis welcome in inboxes, keep records kept on it credible, and keep the platform fast and secure for everyone. If you have a question about whether something is allowed, ask us before doing it.

20. Changes to this policy

We may update this Policy as the platform, the law and the threats we face change. We will publish the updated Policy on our legal pages with its effective date and, where a change materially affects how you may use Arubis, give you notice before it takes effect. The version in force when conduct occurs is the version that applies to it.

Questions about this Policy may be sent to support@olympuspay.co.