Legal · Platform use

Acceptable Use Policy

Clear rules that protect mortgage applicants, authorised firms, introducers, lenders, and the reliability of the Archway platform.

Effective 10 August 2026Archway Software LimitedCompany no. 17113566

This policy forms part of the Archway Licence Agreement. Defined terms in that agreement have the same meaning here. A Customer is responsible for use by its Authorised Users.

1. Scope and responsibility

This Acceptable Use Policy applies whenever a person accesses Archway's website, applications, APIs, client portal, sourcing, communications, document, e-signature, AI-assisted, or integration features (together, the Services).

The Customer must ensure that every employee, adviser, case manager, introducer, contractor, applicant, and other person it invites to the Services complies with this policy. Access may only be used for the Customer's legitimate UK mortgage, protection, lending, introducer, or related business activities and within the permissions assigned to that user.

2. Accounts and security

You must:

  • provide accurate account information and keep it current;
  • use an individual account and never share credentials or authentication factors;
  • use strong, unique passwords and multi-factor authentication where available or required;
  • keep devices, browsers, integrations, and API credentials appropriately secured;
  • give each user only the access they reasonably need and promptly remove access when it is no longer needed;
  • notify Archway without delay if credentials, devices, data, or an account may have been compromised; and
  • remain responsible for activity carried out through accounts under your control, except to the extent caused by Archway's breach.

You must not impersonate another person, create misleading accounts, attempt to discover another user's credentials, or bypass authentication, role permissions, audit controls, or other safeguards.

3. Mortgage and regulated use

Archway supplies technology and workflow tools. It is not a mortgage broker, lender, credit reference agency, surveyor, conveyancer, insurer, or financial adviser and it does not make a personal recommendation to an applicant. Product sorting by rate, payment, fee, loan-to-value, or another objective input is information, not a recommendation by Archway.

The Customer and its users must:

  • hold and maintain every authorisation, permission, appointment, and consent required for their activities;
  • operate only within the scope of their FCA status, appointed representative agreement, introducer agreement, or other authority;
  • ensure that only a suitably authorised and competent person makes or approves advice and personal recommendations;
  • independently check product, eligibility, affordability, valuation, disclosure, and lender information before relying on it;
  • review and approve every suitability report, application, quotation, disclosure, and submission before it is issued or sent;
  • maintain compliant records, oversight, quality assurance, vulnerable-customer processes, and financial-promotion controls; and
  • comply with applicable FCA rules, consumer duty obligations, anti-money-laundering requirements, sanctions rules, lender terms, and law.

Introducers must not advise, recommend, arrange, or carry out any regulated activity unless they are lawfully permitted to do so. No application or product submission may be made without the responsible broker's express approval.

4. Personal data and documents

You may place personal data in the Services only where:

  • you have a documented lawful basis and, where relevant, an Article 9 or criminal-offence-data condition;
  • the person has received all required privacy information;
  • the information is adequate, relevant, accurate, and limited to what is necessary;
  • you are authorised to obtain it from, and disclose it to, the relevant applicant, introducer, lender, or provider; and
  • your instructions to Archway comply with data protection law.

You must not upload fabricated, unlawfully obtained, malicious, infringing, or materially misleading data or documents. Identity documents, bank statements, health or vulnerability information, fraud indicators, sanctions results, and criminal-offence information require particular care and access must be restricted to people with a genuine need to know.

Customer Data must not be exported to personal email accounts, unmanaged storage, or unauthorised systems. Users must follow the Customer's retention and deletion instructions and must not deliberately defeat Archway's audit trail or records controls.

5. Email, SMS and e-signatures

Communications may be sent only to people the Customer is entitled to contact and for a lawful purpose. Users must honour marketing preferences and objections, use accurate sender details, and comply with the Privacy and Electronic Communications Regulations and applicable direct-marketing rules. The Services must not be used for spam, purchased contact lists, harassment, deceptive communications, or unlawful financial promotions.

Before requesting an electronic signature, the Customer must confirm the signer's identity and authority, provide the complete document, and determine whether that method of signature is appropriate. Users must not alter a document after signature, reuse a signature, sign for another person, or misrepresent an audit record.

6. AI-assisted features

AI-assisted drafting, extraction, summarisation, and workflow suggestions may be incomplete, inaccurate, or unsuitable. They are aids for trained users and do not replace professional judgement, regulatory checks, or the Customer's review process.

Users must:

  • review and, where necessary, correct every AI-assisted output before using or sharing it;
  • never treat an output as mortgage advice, a final suitability assessment, or an automated approval;
  • avoid submitting personal data that is unnecessary for the task;
  • not use AI features to make a solely automated decision producing legal or similarly significant effects; and
  • not use outputs to discriminate unlawfully, deceive an applicant, fabricate evidence, or impersonate a person.

7. Prohibited conduct

You must not use, or help anyone use, the Services to:

  • break any law, regulation, court order, contractual duty, or third-party right;
  • facilitate fraud, money laundering, sanctions evasion, identity theft, unauthorised credit broking, or misleading applications;
  • harass, threaten, exploit, discriminate against, or cause harm to another person;
  • upload malware, destructive code, or content designed to disrupt or compromise a system;
  • access another organisation's tenant, records, communications, or integrations without permission;
  • scrape, harvest, resell, sublicense, or build a competing dataset or service from the Services;
  • reverse engineer, decompile, copy, or attempt to derive source code except where law prevents that restriction;
  • remove proprietary notices or falsely suggest endorsement by Archway, a lender, or a regulator; or
  • use the Services in a way that creates unreasonable risk to applicants, other customers, Archway, or the public.

8. Technical use and integrations

You must comply with documented API limits, integration instructions, lender portal rules, and reasonable technical controls. You must not probe or test vulnerabilities without Archway's prior written permission, defeat rate limits, overload the Services, interfere with another user, automate access through an undocumented method, or conceal the source of requests.

Integration keys and lender credentials must be used only for the organisation and purpose for which they were issued. Data returned by lenders, property-data services, AML providers, and other integrations remains subject to the provider's terms and must not be redistributed except where permitted.

9. Monitoring and enforcement

Archway may use proportionate security, usage, and audit information to protect the Services, investigate a suspected breach, respond to a complaint, and comply with law. Archway does not undertake to monitor all Customer Data or determine whether the Customer's business is compliant.

Where reasonably necessary, Archway may require remedial action, restrict a feature, remove harmful material, reset credentials, suspend access, or terminate under the Licence Agreement. We will normally give notice and an opportunity to remedy unless immediate action is reasonably required to protect a person, data, the Services, a third party, or legal compliance.

10. Reporting concerns

Report suspected misuse or security issues promptly to privacy@archwaysoftware.co.uk. Please include enough detail for us to investigate, but do not email passwords, full identity documents, bank statements, or other unnecessary sensitive information.

11. Changes to this policy

We may update this policy to reflect changes to the Services, law, security risks, or good industry practice. Material changes will be notified through the Services, by email, or another reasonable channel before they take effect where practicable. The effective date above shows when this version applies.