Acceptable Use Policy
Clear operational rules, prohibited merchant categories, anti-fraud guidelines, and technical boundaries governing Veyro payment orchestration.
1. Introduction
This Acceptable Use Policy governs access to and use of Veyro's platform, software, APIs, dashboards, SDKs, integrations, documentation, and related services (collectively, the “Services”).
Veyro is a developer-first payment orchestration and payment operations platform designed to help businesses connect and manage their own payment service provider accounts through a unified software layer.
Veyro expects all customers, account owners, developers, administrators, employees, contractors, and other authorized users to use the Services lawfully, responsibly, and securely.
By accessing or using the Services, you agree to comply with this Policy, the Veyro Terms of Service, applicable laws, and the terms imposed by any connected third-party payment service provider.
2. Scope
This Policy applies across all operational touchpoints:
- All registered Veyro customers and account holders.
- Developers, administrators, and team members accessing Veyro workspaces.
- Businesses utilizing Veyro to orchestrate payment gateway operations.
- Applications, checkout pages, and webhooks integrated with Veyro.
- API requests, payment routing configurations, and credential vaults.
- Any individual or organization accessing the Services with a customer's authorization.
Account holders are strictly responsible for ensuring that all individuals operating under their corporate credentials comply with this Policy.
3. General Requirements
- Comply with all applicable local, national, and international laws, regulations, and consumer statutes.
- Maintain accurate, authenticated corporate registration and beneficial ownership details.
- Use the Services exclusively for legitimate, validated commercial business operations.
- Maintain strict cryptographic security over API keys, webhook signing secrets, and admin access tokens.
- Obtain all statutory permits, banking authorizations, and licenses mandated for your business sector.
- Comply with the operating regulations of connected payment processors (e.g. Visa, Mastercard, NPCI).
- Safeguard end-customer personal and financial data in alignment with applicable privacy statutes.
- Cooperate fully with reasonable compliance audits, risk verifications, and fraud inquiries.
4. Prohibited Activities
- Illegal drugs, narcotics, or non-prescribed controlled substances.
- Unlicensed firearms, weapons, ammunition, or explosives.
- Human trafficking, forced labour, or personal exploitation.
- Child sexual abuse material (CSAM) or exploitation of minors.
- Stolen goods, counterfeit products, or contraband.
- Unlicensed sales of regulated pharmaceutical products.
- Identity theft, synthetic identity creation, or impersonation.
- Phishing, social engineering, or credential harvesting.
- Fictitious merchant storefronts or deceptive service claims.
- Unauthorized recurring billing or negative option billing schemes.
- Deliberately misleading chargeback representations or fake evidence.
- Card testing or unauthorized payment instrument validation.
- Money laundering or routing proceeds of illegal enterprises.
- Terrorist financing or funding extremist organizations.
- Circumvention of AML reporting or currency transaction limits.
- Transaction laundering or undisclosed factoring arrangements.
- Concealment of ultimate beneficial ownership.
- Sale of knockoff, replica, or counterfeit merchandise.
- Unauthorized distribution of copyrighted software or media.
- Trademark infringement or brand passing-off.
- Services facilitating illicit digital stream extraction or cracking.
- Non-consensual sexual content or sexual extortion.
- Violent harassment, stalking, or unlawful debt intimidation.
- Facilitation of physical harm or contract crimes.
- Organized cyber extortion or ransomware settlement facilitation.
- Transactions involving sanctioned individuals or entities on OFAC, UN, EU, or UK lists.
- Routing transactions to or from embargoed jurisdictions.
- Circumventing export controls on restricted cryptographic equipment.
5. Restricted Activities Requiring Prior Approval
Certain commercial industries may be legal within specified jurisdictions but carry heightened regulatory oversight, mandatory specialized licensing, or elevated chargeback profiles. Such activities may only be orchestrated through Veyro with explicit written approval:
Important Notice: Inclusion on this list does not guarantee Veyro approval. Veyro approval does not substitute for regulatory licensing or underwriting authorization mandated by your respective payment gateway.
6. Payment-Specific Prohibited Conduct
Initiating payments without unambiguous customer consent, dispatching charges using compromised payment tokens, or spoofing customer IP addresses.
Splitting individual commercial charges (“smurfing”) to evade anti-money laundering limits, cycling payments through dummy accounts, or misrepresenting line-item descriptions.
Executing micro-transactions, automated authorization loops, or brute-force card validation across gateways. Any card-testing traffic results in immediate API revocation.
Deliberately impeding consumer refund windows, fabricating shipping documentation, or manipulating refund event webhooks.
7. API and Platform Abuse
When interacting with Veyro APIs, SDKs, webhooks, or dashboards, you agree never to:
8. Credentials and Account Security
You must safeguard your Veyro API credentials (`veyro_sec_...`). Production keys must never be committed to public Git repositories, bundled in client-side JavaScript, or stored unencrypted. Compromised keys must be immediately rotated within the dashboard.
9. Payment Information and Sensitive Credentials
Unless an integration is explicitly documented and certified for PCI Level 1 direct card handling, customers must never transmit sensitive authentication data through Veyro metadata fields, error logs, or API payloads. This includes:
- Full 16-digit Primary Account Numbers (PANs)
- Card verification values (CVV, CVC, CID)
- Cardholder PINs or online banking passwords
- SMS/Email One-Time Passwords (OTPs)
10. Security Testing and Vulnerability Disclosure
Penetration testing, automated stress testing, and vulnerability fuzzing against Veyro production infrastructure are strictly prohibited without prior written authorization. To coordinate a penetration test or responsibly report a vulnerability, contact our security team:
11–12. Customer Responsibilities & Third-Party Requirements
Customers remain exclusively liable for their customer relations, merchant tax reporting, product fulfillment quality, and dispute responses. Veyro provides routing infrastructure only.
Where a connected payment provider enforces stricter acceptable use constraints than Veyro, the customer must strictly satisfy the more restrictive standard.
13–14. Monitoring, Investigation & Enforcement
Veyro maintains automated telemetry to detect suspicious fraud anomalies. Where a violation of this Policy is identified, Veyro reserves the right to:
15. Reporting Violations
If you identify transaction fraud, platform misuse, or violations of this Acceptable Use Policy originating from Veyro infrastructure, submit an urgent report:
Please include relevant transaction IDs, merchant URLs, and diagnostic headers. Do not transmit full card numbers or passwords.
16–18. General Policy Governance
Acceptance of a merchant onto the Veyro platform does not guarantee gateway approval or underwriting clearance from any connected third-party payment service provider.
This Policy forms an integral part of the Veyro Terms of Service. In the event of a conflict with governing mandatory statute, the statutory requirement shall prevail.
We may revise this Policy periodically. Continued use of Veyro following notification reflects ongoing acceptance of modified operational standards.
19. Contact Information
20. Final Statement
Veyro is dedicated to providing a reliable, secure, and transparent payment orchestration platform. All merchants and developers must operate lawfully and responsibly.