Acceptable Use Policy

This policy lists what you may not do with the Tobie API and MCP server. It is part of the API Terms of Use and applies to every credential and every connected app.

Protect access#

• Keep credentials confidential. Do not share, sell or publish an API key, token or signing secret.
• Do not use someone else's credential, or let anyone use yours.
• Do not get around authentication, scopes, IP allowlists, rate limits or approvals.

Respect the limits#

• Do not scrape, crawl or bulk-download beyond the published rate limits.
• Do not spread requests across keys, accounts or networks to avoid a limit.
• Do not send traffic meant to slow down or break the service.

Stay inside your scope#

• Do not try to access another employer's data, another person's data, or anything your credential is not scoped to.
• If you see data you should not, stop, do not keep it, and email security@tobie.team.

No medical, legal or tax decisions#

• Do not use the API to make medical, legal or tax decisions about a person.
• Do not present answers as professional advice. Answers explain plan documents; for decisions, point people to the plan, their HR team or a qualified professional.

Respect employee privacy#

• Use employee data only for the purposes the employer approved.
• Do not use the API to monitor, profile or single out individual employees.
• Do not copy employee data into tools that keep it or train on it unless the employer approved that use.
• Do not send protected health information (PHI) to the API. Tobie does not process PHI through the API.

Be honest about what happened#

• Do not report a proposed or failed write as done. A 202 means proposed, not executed.
• Do not present your app as Tobie, or suggest Tobie endorses it, without our written permission.

Nothing unlawful or harmful#

• Do not use the API for anything unlawful, deceptive or discriminatory, including treating people differently because of their health, disability, age or other protected traits.
• Do not send malware, or content you have no right to share.

AI apps connected by employees#

When an employee connects an AI app to Tobie, the app provider's own terms govern how the app uses what it receives. The provider is responsible for the app. Employers can limit which apps may connect; those controls are rolling out.

Enforcement#

Tobie may suspend or revoke credentials or apps that break this policy. When people or the service are at risk, we may act first and explain after. Report misuse to security@tobie.team.

Changes and contact#

Changes to this policy are announced in the changelog. Questions: hello@tobie.team.