Acceptable use policy

GarnerDocs is for collecting the documents a firm needs from its own clients. A firm creates a request with a checklist of documents, sends the client a private upload link, reviews what comes in, and lets reminders chase whatever is still missing.

Use it for that. GarnerDocs isn't a file-sharing service, a public download site, a bulk email tool or a permanent archive for your firm's records.

Don't use GarnerDocs, or let anyone in your workspace use it, to:

• Break the law. Don't request, upload, store or send anything that's illegal, or that infringes someone else's rights, such as their copyright or privacy.
• Spread malware. Don't upload, or ask clients to upload, viruses, ransomware or any other file meant to cause harm.
• Collect documents without a lawful basis. Only ask people for documents you have a lawful reason to collect, and only ask the people you're working for or with. Don't send requests or reminders to people who aren't your clients, or use them as unsolicited marketing.
• Phish or impersonate. Your firm's name, logo, brand colour and default message appear on the upload page and in emails to clients. Use only your own firm's name and branding. Don't use them to pretend to be another firm, a bank, a government body or anyone else, or to trick people into handing over documents, passwords or payment details.
• Distribute files. A client link is for one client to send documents to the firm that asked for them. Don't use client links, or files uploaded through them, to share or host files for anyone other than that firm.
• Get into other workspaces. Don't try to access another firm's workspace, requests or files, or guess or collect client links that weren't sent to you. Don't probe, scan or try to get around GarnerDocs's security or the limits on your plan. If you find a security problem, report it to us instead.
• Scrape. Don't use bots, scripts or other automated tools to copy or harvest pages, data or files from GarnerDocs.
• Load test. Don't run load, stress or performance tests against GarnerDocs, or send traffic meant to slow it down or take it offline.
• Resell. Don't sell, rent, sublicense or give access to GarnerDocs to other businesses, or offer it as part of your own service, without our written agreement. Each firm needs its own workspace.
• Collect payment card details. Don't ask for, upload or keep full payment card numbers, card security codes (CVV or CVC), card PINs or photos of payment cards. Documents that show only the last four digits of a card, as most statements do, are fine. If a client sends card details anyway, ask them for a copy with the details covered, and don't download or pass on the original.
• Collect passwords or security codes. Don't use GarnerDocs to ask for passwords, one-time codes, recovery codes or other login details for any account or system.
• Handle HIPAA protected health information. If your business is a HIPAA covered entity, or a business associate of one, don't use GarnerDocs to collect or store protected health information for that work. We aren't a business associate and don't sign Business Associate Agreements.
• Store US criminal justice information. Don't use GarnerDocs to store or share criminal justice information covered by the FBI's CJIS Security Policy, for example as a criminal justice agency or its contractor.

The firm decides what it requests and from whom, so the firm is the controller of its clients' documents and GarnerDocs is its processor. Our Data Processing Agreement sets out those roles.

That means it's up to the firm to:

• have a lawful basis for every document it asks for, and tell its clients how their information will be used
• ask only for what it needs. Some documents carry more risk than others: identity documents, bank statements, health information and anything about criminal records need extra care under data protection law
• check that GarnerDocs is right for any data it plans to collect that has special rules of its own

GarnerDocs collects documents. It doesn't check that they're genuine, verify anyone's identity or carry out KYC, AML or credit checks. GarnerDocs isn't a HIPAA business associate and isn't assessed against PCI DSS.

Documents that need extra safeguards

Some documents need extra safeguards before you ask for them on purpose:

• criminal record certificates and background check reports
• medical records and genetic test results, such as immigration medical exams or the records for an injury claim

Before you request them:

• restrict the request to the people who need to see it, from the request's ⋯ menu, under Who can see this
• require two-factor authentication for your workspace (restricting a request needs it)
• make sure the law gives you a basis for collecting this kind of data
• delete the files as soon as you no longer need them

A passing mention of health in an ordinary document, such as sick pay on a payslip, doesn't need these steps.

Files are deleted when the firm's retention period ends, so keep anything you need in your own systems. Our Terms of Service explain how retention works, and our Security page explains how files are protected.

If we reasonably believe this policy or the Terms are being broken, we may:

• close a client link, so nothing more can be uploaded through it
• remove content that breaks this policy
• suspend a team member, or the firm's whole workspace
• report illegal activity to the police or other authorities when we have to or think it's right to

We'll act in proportion to the problem. Where we can, we'll tell the firm's owner first and give them a chance to fix it. We may act straight away if there's a risk of harm to clients, other firms or GarnerDocs.

Suspending a workspace doesn't delete anything in it.

If you've received a request or reminder you think is fake or unwanted, or you've seen GarnerDocs being used in a way this policy doesn't allow, tell us. Include the link or email you received, if you have it, but don't send us any documents.

If you're a client and aren't sure a request is genuine, contact the firm using details you already have for it, not the ones in the email.

Contact us at [email protected]. We'll acknowledge your report within 2 business days.

To report a security vulnerability, see our Security page.

If we change this policy, we'll update this page and the date above. If a change is material, we'll tell firm owners by email before it takes effect, as the Terms describe.