Acceptable Use Policy

1. Permitted Uses

HelmXP is licensed for use by US credit union executive teams for the purpose of authoring board briefing materials, managing governance cycles, and enabling structured board Captain access to institution-specific content. You may use the Service only for lawful purposes in connection with the operation of your credit union.

2. Prohibited Activities

You may not use the Service to:

• —Access, store, or transmit another Customer's data without authorization.
• —Attempt to circumvent authentication, row-level security, or any access controls.
• —Upload or transmit malware, ransomware, or other malicious code.
• —Conduct denial-of-service attacks or probe for security vulnerabilities without written permission from HelmXP.
• —Violate any applicable federal or state financial regulation, including NCUA rules.
• —Represent AI-generated drafts as reviewed and approved content without executive sign-off.
• —Export, share, or redistribute platform content in ways that violate your institution's data governance policies.
• —Impersonate another user, executive, or HelmXP staff member.
• —Use the platform to process data for institutions other than your own credit union.

3. AI-Generated Content

HelmXP uses Anthropic Claude to draft board briefing sections. AI drafts are marked with “AI draft · review before signing off” throughout the platform. You are responsible for reviewing, editing, and approving all content before it is presented to Captains or submitted as part of a regulatory filing. HelmXP's AI drafts are not financial advice and must not be treated as such.

4. Data Confidentiality

You are responsible for ensuring that only authorized personnel are granted Seat, Sub-seat, or Captain access to your institution's Hub. You must revoke access promptly when a user leaves the institution or changes role. HelmXP logs all access and can provide audit records to your institution on request.

5. Reporting Violations

To report a suspected violation of this policy or a potential security issue, contact security@helmxp.com. HelmXP maintains a responsible disclosure program; researchers who report vulnerabilities in good faith will not be prosecuted.

6. Enforcement

HelmXP may suspend or terminate access to the Service for violations of this policy without prior notice if there is an ongoing security incident, data breach risk, or regulatory concern. In other cases HelmXP will provide reasonable notice and an opportunity to remedy the violation before suspension.

7. Contact

Questions about this policy: legal@helmxp.com.