Acceptable Use Policy generator

Org Settings → Acceptable Use (/org/aup) fills a starting Acceptable Use Policy draft — a plain-language document describing what employees and contractors can and can’t do on company systems — the moment you open it, from your org name, today’s date, and a set of sensible defaults. Adjust the few fields on the Basics card, or open Customize answers for the full questionnaire. Copy the Markdown and adapt it with counsel. There’s no freeform AI generation involved: every sentence in the draft maps back to one of your answers.

Only org admins and owners can open the page — members don’t see it in Org Settings.

Basics

A first visit already has a filled-in draft next to the form — nothing is stored until you save. The Basics card covers:

Field	What it controls
Company name on the policy	Required. The name used throughout the document. MSPs generating a policy for a customer: put the client’s company name here, not your own.
Industry or business type	One line naming the business context in the intro. Choosing IT / MSP also adds line-of-business apps and customer systems to the recommended systems list (see below). Choosing Other reveals a field to describe the business.
Workforce size	Approximate headcount — employees, contractors, and temps who use company systems.
Work locations	On-site, hybrid, mostly remote, or fully remote. Hybrid and remote answers add a Remote and hybrid expectations section (VPN, public Wi-Fi, screen-locking).
Effective date	Defaults to today. Update it whenever you republish a revised version.
Monitoring and visibility	One of three levels — full monitoring, limited (security alerts and major incidents only), or none beyond investigating reported issues. Whichever you pick becomes the actual monitoring paragraph in the document, so answer honestly.

The preview updates as you edit the Basics card. Use Update preview if it doesn’t, and Save draft to store the policy on the organization.

Customize answers

Open Customize answers for the rest of the questionnaire — most people won’t need to touch it, since sensible defaults already cover it:

Field	What it controls
Systems and tools covered	Multi-select, pre-checked with an everyday baseline (company email, messaging, computers, phones, cloud storage, AI assistants, VPN). Choosing IT / MSP as the industry adds line-of-business apps and customer systems automatically, as long as this list is still untouched — pick or unpick anything and your selection sticks, including across an industry change.
Prohibited uses	Multi-select with sensible defaults pre-checked (illegal activity, harassment, credential sharing, unapproved software, competing business use, unnecessary data access, circumventing monitoring, crypto mining). A nested Optional prohibited uses disclosure holds three off-by-default choices — adult content, personal streaming, and political campaigning — turn them on if you want them. Add your own via Add your own.
Data handling expectations	Multi-select, also pre-checked with common defaults (need-to-know access, no pasting sensitive data into public AI tools, approved storage only, no forwarding to personal email, reporting leaks, following customer-specific rules).
Policy owner / contact	Who employees ask or report to — a name or a role (e.g. “IT Manager”). Email is optional.
Extra rules or notes	Optional short bullets appended under Additional rules.

Every draft also includes a fixed AI tools section (treat prompts and uploads like email, don’t paste secrets or regulated data into unapproved tools) regardless of how you answer — it isn’t a field on either card.

Preview, save, and reload

Update preview renders the current answers as Markdown without saving anything. Save draft stores the answers on the organization — who generated it and when — and reloading the page restores that saved draft, including any systems, prohibited uses, or data-handling choices you’d changed. A brand-new form starts from the defaults described above; those only apply before the first save, not to a reload of a saved draft.

Use Copy Markdown on the rendered preview to pull the draft into whatever you’re editing it in. There’s no PDF export yet — copy the Markdown and format it in your own document tool.

Generating for a customer (MSPs)

If you’re already acting as a customer’s organization (Manage from /org/customers), Org Settings → Acceptable Use generates and saves a draft for that customer, not for your own org — the company name defaults to the customer’s org name. No separate tenancy setup is needed.

Managing access — the vendor-access model this policy generator does not replace or configure.
Onboarding a customer — acting-as mode for generating a policy on behalf of a customer.
Permissions — the admin/owner role required to open this page.