Acceptable Use Policy

1. Use the Platform only for its purpose

Use ATO Connect only to integrate your software with ATO digital services for lodgments and requests that you, your clients or their registered agents are entitled to make.

2. You must not

• lodge or request data without the client authorisation, agent appointment or declaration the law requires;
• send data you know or suspect is false, misleading or fraudulent;
• send test, sample or fictitious data to the production (PROD) environment;
• use another organisation's credentials, or share your credentials outside your organisation;
• try to get around authentication, rate limits, module subscriptions or environment separation, or access data that is not yours;
• probe, scan or test the Platform for vulnerabilities, except as described in our responsible disclosure process;
• overload the Platform or the ATO's systems, for example with excessive automated or repeated requests;
• introduce malware, or interfere with the Platform or other customers' use of it;
• resell or provide access to the Platform to third parties unless an order form allows it;
• use the Platform in breach of any law, including privacy and taxation laws.

3. Security obligations

• Keep API credentials secret, store them securely, and rotate them if you suspect they have been exposed.
• Turn on multi-factor authentication for portal users.
• Remove users who no longer need access.
• Tell us promptly at support@myaccountant.com.au if you suspect unauthorised use of your account or a security incident affecting data sent through the Platform.

4. Responsible disclosure

If you find a vulnerability, report it to support@myaccountant.com.au and follow the guidance on our Security & Trust page. Good-faith research carried out under that guidance is not a breach of this policy.

5. What happens if this policy is breached

We may investigate suspected breaches, suspend or limit access, revoke credentials, or end the Terms of Service, as the Terms allow. Where the law or the ATO's requirements for Digital Service Providers require it, we may report a breach to the ATO or other authorities.