1Prohibited conduct
- Using TrustNet for unlawful content, fraud, harassment, impersonation or spam.
- Accessing another account, persona or relying party without authorisation.
- Sharing credentials, client secrets or sessions outside the organisation that owns them.
- Scraping, crawling or automating access in a way that degrades the service.
- Circumventing rate limits, consent screens, authentication or revocation.
- Attempting to re-identify a PPID or correlate PPIDs across sectors or RPs.
- Security testing outside the vulnerability disclosure policy.
- Requesting or disclosing special-category data without a lawful Art. 9 basis.
2Additional rules for RP operators
- Declare only the claims you need, with a specific lawful reason.
- Publish your own privacy notice and honour consent and withdrawal.
- Handle the signed purge webhook and stop using a revoked subject identifier.
- Do not use TrustNet claims for hidden tracking, discriminatory decisions or re-identification.
- Keep your endpoints, credentials and webhook receiver secure.
3Enforcement
We may warn, limit, suspend or terminate an account or RP that violates this policy, and may revoke access tokens and connections. Where the law requires it, we report the matter to the competent authority. We aim to act proportionately and to explain the reason, unless doing so would compromise an investigation or the security of others.
4Reporting abuse
Report abuse to privacy@trustnet.app with the subject “Abuse report”. Include the RP or account involved and enough detail to investigate. Do not send other people's personal data.
5Contact
Questions about this policy: privacy@trustnet.app. See also the Terms of Service and Operator Terms.