Can an AUP be signed electronically?

Yes. Under the ESIGN Act (15 U.S.C. §7001) and UETA in most states, electronic signatures and acknowledgements are valid provided intent, consent, attribution, and retention requirements are met.

Do consumer-facing notices need special disclosure?

Yes. Consumer-facing electronic records may require an ESIGN-compliant disclosure that informs users of their rights to paper, demonstrated access, and an option to withdraw consent.

Is notarization required for AUP acknowledgement?

Not typically. Notarization is uncommon for AUPs unless state law or a particular contractual arrangement specifically requires it; RON could be used where notarization is mandated.

How long should signed AUPs be retained?

Follow retention rules relevant to your industry—general guidance includes retaining signed records for at least the policy term plus several years; HIPAA mandates six years (45 CFR §164.530(j)).

What if a user refuses to acknowledge the AUP?

Establish and follow a documented escalation and remediation process such as restricted access, role changes, or termination of service for noncompliance.

Who should review the AUP for legal risks?

Have legal counsel review the AUP for regulatory compliance and civil liability issues, particularly where the organization handles regulated data or operates in multiple jurisdictions.

Acceptable Use Policy

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

ACCEPTABLE USE POLICY

This Acceptable Use Policy ("Policy") is entered into by and between Company Name: and Client Name: .

WHEREAS

WHEREAS, the Company provides network, hosting, software and related services (collectively, "Services") and requires standards for acceptable use of those Services to protect security, operations, reputation, and legal compliance; and

WHEREAS, the Client will use the Services and agrees to abide by this Policy as a condition of receiving and continuing to receive the Services; and

WHEREAS, this Policy is intended to define permitted uses, prohibited activities, enforcement measures, and remedies available to the Company in the event of violation.

SCOPE OF WORK

Scope of Services to Which This Policy Applies

ACCEPTABLE USE

Users of the Services may use resources only for lawful, authorized business purposes consistent with this Policy. Acceptable uses include: operation of business applications; transmission of lawful business communications; and activities expressly permitted in writing by the Company.

PROHIBITED USES

The following activities are strictly prohibited when using the Services. Prohibited activities include, but are not limited to:

1. Unauthorized access, scanning, or monitoring of networks, systems, or data that are not owned or explicitly permitted for use by the Client.

2. Distribution, storage, or facilitation of malware, ransomware, worms, Trojan horses, or other harmful code; propagation of denial-of-service attacks; or intentionally degrading service availability.

3. Hosting, transmitting, or linking to content that violates applicable law, infringes intellectual property rights, constitutes child sexual abuse material, or otherwise is unlawful.

4. Using Services to send unsolicited bulk communications (spam), phishing, or conduct fraudulent, deceptive or abusive schemes.

USER RESPONSIBILITIES

The Client shall implement and maintain reasonable administrative, technical and physical safeguards to protect credentials, prevent unauthorized access, and ensure that end users comply with this Policy. The Client is responsible for all activity originating from accounts, devices, or services provisioned to the Client.

Reporting Contact (name & title) Reporting Contact (email or phone)

ENFORCEMENT; REMEDIES

The Company may monitor, investigate, and take reasonable action in response to suspected violations, including temporary suspension or immediate termination of Services where necessary to protect systems, customers, or to comply with law. The Company shall provide written notice of enforcement actions except where exigent circumstances require immediate action.

PAYMENT TERMS

Fees for Policy Administration (if applicable) — Amount Payment Schedule Late Fee or Interest

TERM AND TERMINATION

This Policy is effective as of Effective Date: and shall remain in effect until End Date: unless earlier terminated in accordance with this Section.

Notice Period for Termination

Either party may terminate this Policy for material breach by the other party if the breaching party fails to cure the breach within the notice period set forth above. The Company may suspend Services immediately for suspected unlawful conduct or threats to infrastructure.

CONFIDENTIALITY

Each party shall maintain the confidentiality of non-public information disclosed under or in connection with this Policy, and shall not use such information except to exercise rights or perform obligations under this Policy. Confidential information does not include information that is publicly known, already lawfully known to the receiving party, or required to be disclosed by law provided prompt notice is given to the disclosing party when permitted by law.

Confidentiality Exceptions or Additional Terms

GOVERNING LAW

This Policy shall be governed by and construed in accordance with the laws of State: without regard to conflict-of-law principles.

ENTIRE AGREEMENT; AMENDMENT

This Policy, together with any referenced agreements, constitutes the entire agreement between the parties with respect to acceptable use of the Services and supersedes prior understandings on that subject. Any amendment or waiver of any provision must be in writing and signed by authorized representatives of both parties.

Additional Provisions

ACKNOWLEDGMENT

By checking the box below, the authorized representative of the Client acknowledges receipt of this Policy, represents that they have authority to bind the Client, and agrees that non-compliance may result in enforcement actions described herein.

I acknowledge and agree to the terms of this Acceptable Use Policy.

Company:

By:

Date:

Client:

By:

Date:

What an Acceptable Use Policy Is and When It Applies

An Acceptable Use Policy (AUP) is a formal document that defines permitted and prohibited activities for users of an online platform, network, or service. It sets behavioral standards, describes security and privacy obligations, and explains enforcement measures such as account suspension or termination. AUPs typically cover content restrictions, prohibited technical activities (for example, abuse of system resources), reporting channels for suspected violations, and obligations to comply with applicable laws. For organizations that collect regulated data, the AUP should reference relevant legal frameworks and any special handling required by those laws.

Why a Clear AUP Matters for Organizations

A concise AUP reduces legal risk, supports consistent enforcement, and helps protect systems from misuse. It also creates clear expectations for users and provides a documented basis for remedial action.

Who Typically Issues or Enforces an AUP

Tailor the AUP to the organization’s industry and risk profile and coordinate issuance with HR and legal functions.

IT and security teams who manage infrastructure and respond to incidents.
Legal and compliance groups that ensure policies meet regulatory and contractual obligations.
Service providers and SaaS vendors that host customer data and enforce acceptable behavior.

Core Sections to Include in a Professional AUP

A practical AUP is organized, actionable, and easy to reference. Include definitions up front and group rules by type of activity to aid interpretation and enforcement.

Definitions

Clear definitions for terms such as "user", "service", "account", and "malicious activity" to avoid ambiguity during enforcement and audits.

Permitted Use

Describe acceptable access and normal business uses, including examples of routine, approved activities relevant to your services.

Prohibited Conduct

List forbidden behaviors (e.g., malware distribution, DDoS attacks, unauthorized access, copyright infringement) and technical abuses.

Enforcement

Explain progressive remedies (warnings, suspension, termination) and the authority responsible for enforcement decisions.

Reporting

Provide a reporting mechanism, evidence requirements, and timelines for incident escalation and remediation.

Legal & Compliance

Reference governing law, privacy obligations, and any industry-specific controls (for example, HIPAA-related safeguards in healthcare contexts).

Essential Policy Metadata and Contact Points

Policy Owner: Security or legal owner

Effective Date: MM/DD/YYYY

Scope: Systems and user categories

Definitions Section: Key terms listed

Reporting Channel: Email or ticketing link

Revision History: Version and update notes

How to Create or Update an AUP: Step-by-Step

Follow these steps to draft, review, and publish an AUP that aligns with operational and legal requirements.

01

Assess Scope: Identify systems, user types, and regulated data in scope.
02

Draft Rules: Write clear permitted and prohibited actions with examples.
03

Legal Review: Confirm alignment with ESIGN/UETA where electronic disclosures or consents apply.
04

Publish & Train: Distribute policy and provide user training and acknowledgement.

Configuring an Electronic Acknowledgement Workflow

Design a clear online workflow for distributing the AUP and collecting acknowledgements from users.

Step	Configuration
Upload Document	Use PDF or DOCX and verify final formatting.
Assign Signers	Add user emails or groups for batch distribution.
Authentication	Select email, SMS code, or stronger ID verification.
Retention	Enable audit trail and export signed copies

Technical Considerations for eAcknowledgement and Distribution

Ensure the chosen platform preserves timestamps, signer attribution, and an immutable audit trail to support legal validity and internal audits.

File Formats: PDF, DOCX supported
Authentication: Email, SMS, or MFA
Integrations: SSO and directory sync

Where to Send, File, or Archive AUP Records

Determine official destinations for signed AUPs, internal logs, and archival copies to ensure retrievability and compliance.

Primary Repository: HR or policy management system with role-based access.
Signed Copies: Store final signed PDFs in secure document storage.
Audit Logs: Retain audit trail export in a separate tamper-evident location.
Incident Records: Link policy violations to ticketing and disciplinary records.

Key Timelines and Review Cadence for an AUP

Establish predictable review and response deadlines to keep the policy current and ensure timely handling of incidents.

Policy Effective Date:

Date when the policy takes effect and applies to users.

Annual Review:

Review policy at least once per year for changes.

Incident Response:

Acknowledge reports within 48 hours and investigate per SLA.

Acknowledgement Deadline:

Require user acknowledgement within 30 days of issuance.

Retention Trigger:

Retention periods begin from signature or termination date.

Common Errors to Avoid When Issuing an AUP

Using vague or overly broad prohibitions that create enforcement ambiguity and expose the organization to dispute.
Failing to align the AUP with privacy or data-handling policies, which can create conflicts during investigations.
Not documenting version history or distribution lists, leaving gaps when demonstrating who received and acknowledged the policy.
Requiring manual signatures without providing an audit trail or reliable electronic evidence of consent.

Risks and Consequences of Weak or Misapplied AUPs

Security Breach: Increased exposure

Regulatory Fines: Fines and enforcement actions

Contract Breach: Loss of vendor rights

Service Disruption: Operational downtime

Reputational Harm: Customer trust loss

Legal Liability: Civil suits or penalties

eSignature Pricing and Capability Snapshot

Compare entry pricing and common enterprise features to select an eSignature provider that meets your AUP distribution, authentication, and compliance needs.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About Acceptable Use Policies

Answers to common questions about drafting, distributing, and enforcing an Acceptable Use Policy in U.S. organizations.

Need help? Contact support

Can an AUP be signed electronically?
Yes. Under the ESIGN Act (15 U.S.C. §7001) and UETA in most states, electronic signatures and acknowledgements are valid provided intent, consent, attribution, and retention requirements are met.
Do consumer-facing notices need special disclosure?
Yes. Consumer-facing electronic records may require an ESIGN-compliant disclosure that informs users of their rights to paper, demonstrated access, and an option to withdraw consent.
Is notarization required for AUP acknowledgement?
Not typically. Notarization is uncommon for AUPs unless state law or a particular contractual arrangement specifically requires it; RON could be used where notarization is mandated.
How long should signed AUPs be retained?
Follow retention rules relevant to your industry—general guidance includes retaining signed records for at least the policy term plus several years; HIPAA mandates six years (45 CFR §164.530(j)).
What if a user refuses to acknowledge the AUP?
Establish and follow a documented escalation and remediation process such as restricted access, role changes, or termination of service for noncompliance.
Who should review the AUP for legal risks?
Have legal counsel review the AUP for regulatory compliance and civil liability issues, particularly where the organization handles regulated data or operates in multiple jurisdictions.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now