Salesforce Acceptable Use and External-Facing Services Policy

1. Scope

A. This Acceptable Use and External Facing Services Policy (“Policy”) applies to customers’ use of all
services offered by Salesforce, Inc. or its affiliates (“Salesforce”). The terms of the Artificial Intelligence
Acceptable Use Policy at https://www.salesforce.com/company/legal/agreements/ posted as of its
effective date are hereby incorporated by reference. Capitalized terms used below but not defined in
this policy have the meaning set forth in the Main Services Agreement (“MSA”).

B. With respect to Slack Services, if we believe a customer or its users are engaging in or encouraging
illegal activity, or deliberately or repeatedly presents a credible risk of harm, or encourages harm, to
other users, the Services or any third parties, we may suspend or terminate your Slack access. Slack is
not available for consumer purposes, as Slack is intended for use by businesses and organizations.

2. Last Updated

A. July 08, 2025

3. Changes to Policy

A. Salesforce may change this Policy by posting an updated version of the Policy at www.salesforce.com
and such updates will be effective upon posting.

4. Violations

A. A customer’s violation of this Policy will be considered a material breach of the MSA and/or other
agreement governing the customer’s use of the services.

5. Prohibited Material

A. Customers may not, and may not allow any third party, including its users, to use services to create,
send, upload, display, store, process, or transmit, or permit use of services to create, send, upload,
display, store, process, or transmit:

I. Material that infringes or misappropriates a third party’s intellectual property or proprietary
rights;

II. Hate-related material, and/or material advocating discrimination against individuals or
groups;

III. Material advocating or advancing violent causes, including terrorism or violent extremism;

IV. Obscene, excessively profane material or otherwise objectionable material;

V. Material advocating or advancing criminal hacking, cracking, or phishing;

VI. Material related to illegal drugs or paraphernalia;

VII. Malicious material;

VIII. Unlawful software;

IX. Malicious code, such as viruses, worms, time bombs, Trojan horses, and other harmful or
malicious files, scripts, agents, or programs; or
Salesforce Acceptable Use and External-Facing Services Policy 2

X. Material that violates, encourages, or furthers conduct that would violate any applicable laws,
including any criminal laws, or any third-party rights, including publicity or privacy rights.

6. Prohibited Actions

A. Customers may not use a service to, nor allow its users or any third party to use a service to:

I. Generate or facilitate unsolicited commercial email (spam). Such prohibited activity includes,
but is not limited to:

a. Sending communications or email in violation of the CAN-SPAM Act or any other
applicable anti- spam law or regulation;

b. Imitating or impersonating Salesforce, another person or his, her, or its email address,
or creating false accounts for the purpose of sending spam;

c. Mining data or harvesting any web property (including any External-Facing Service) to
find email addresses or other user account information;

d. Sending unauthorized mail via open, third-party servers;

e. Sending email to users who have requested to be removed from a mailing list;

f. Selling to, exchanging with, sharing with, or distributing to a third party personal
information, including the email addresses of any person without such person’s
knowing and continued consent to such disclosure; or

g. Sending unsolicited emails to significant numbers of email addresses belonging to
individuals and/or entities with whom you have no preexisting relationship;

II. Create, send, upload, display, store, process, or transmit unlawful, defamatory, harassing,
abusive, fraudulent, infringing, obscene, excessively profane, hateful, violent, or otherwise
objectionable material nor use the services to send, display, or transmit sexually explicit
material;

III. Create, send, upload, display, store, process, or transmit highly deceptive manipulated or
synthetic digital media that is fabricated or false but presented as authentic or fact based and
intended to deliberately sway audiences towards a specific interest or agenda, including, but
not limited to, deepfakes;

IV. Promote, support, or facilitate unlawful, hateful, discriminatory, or violent causes, including
terrorism or violent extremism;

V. Intentionally distribute viruses, worms, defects, Trojan horses, corrupted files, hoaxes, or any
other items of a destructive or deceptive nature;

VI. Conduct or forward multi-level marketing, such as pyramid schemes and the like;

VII. Generate or facilitate calls, SMS, MMS, other text messages push notifications, or other
uninvited communications in violation of the Telephone Consumer Protection Act, the Do-
Not-Call Implementation Act, or any other applicable law including anti- spam, telemarketing,
robocalling, caller ID spoofing, or telephone consumer protection laws or regulations;

VIII. Use the services in any manner that violates any applicable industry standards, third-party
policies, or requirements that Salesforce may communicate to its users, including all of the
applicable guidelines published by the CTIA, the Mobile Marketing Association, the Self-
Regulatory Principles as directed by the Digital Advertising Alliance and the Network
Advertising Initiative, or any other generally accepted industry associations, carrier
guidelines, or other industry standards;
Salesforce Acceptable Use and External-Facing Services Policy 3

IX. Create, send, upload, display, store, process, or transmit material or otherwise use the
Services in a way that may be harmful to minors including, but not limited to, for any purposes
related to child exploitation or abuse, such as real or artificial Child Sexual Abuse Material
(CSAM);

X. Illegally send, upload, display, store, process, or transmit another’s intellectual property or
other proprietary information without such owner’s or licensor’s permission;

XI. Impersonate another person, entity, or Salesforce (via the use of an email address or
otherwise) or otherwise misrepresent themselves or the source of any communication;

XII. Facilitate or engage in coordinated inauthentic behavior for the purposes of manipulating
public debate;

XIII. Violate the rights (such as rights of privacy or publicity) of others;

XIV. Promote, facilitate, or encourage illegal activity;

XV. Intentionally or unintentionally interfere with the availability of the service for other users,
including, but not limited to, engaging in usage practices prohibited by the Documentation;

XVI. Mislead people about voting processes or census processes;

XVII. Engage in activity in connection with illegal peer-to-peer file sharing;

XVIII. Engage in or promote gambling, or run a gambling operation;

XIX. “Mine” bitcoins and other cryptocurrencies;

XX. Sell, distribute, or export illegal or prescription drugs or other controlled substances or
paraphernalia;

XXI. Operate an “open proxy” or any other form of Internet proxy service that is capable of
forwarding requests to any end user or third-party-supplied Internet host;

XXII. Perform significant load or security testing without first obtaining Salesforce’s written
consent;

XXIII. Remove any copyright, trademark, or other proprietary rights notices contained in or on the
service or reformat or frame any portion of the web pages that are part of the service’s
administration display;

XXIV. Access a third-party web property for the purposes of web scraping, web crawling, web
monitoring, or other similar activity through a web client that does not take commercially
reasonable efforts to identify itself via a unique User Agent string describing the purpose of
the web client and obey the robots exclusion standard (also known as the robots.txt
standard), including the crawl-delay directive;

XXV. Use a service in any manner that would disparage Salesforce;

XXVI. Directly manage, as the primary operator, private, for-profit prison facilities or detention
centers in the United States. For-profit prisons and detention centers refer to privately owned
facilities in which persons are incarcerated or otherwise involuntarily confined for purposes
of execution of a punitive sentence imposed by a court or detention pending a trial, hearing,
or other judicial or administrative proceeding;

XXVII. Engage in activity where the use or failure of a service may result in the death or serious bodily
harm of a person, or in significant damage to property.

B. Worldwide, customers may not use a service to commercially advertise or sell any of the following
firearms and/or related accessories to private citizens. Firearms: automatic firearms; semi-automatic
firearms that have the capacity to accept a detachable magazine and any of the following: thumbhole
Salesforce Acceptable Use and External-Facing Services Policy
stock, folding or telescoping stock, grenade launcher or flare launcher, flash or sound suppressor,
forward pistol grip, pistol grip (in the case of a rifle) or second pistol grip (in the case of a pistol), barrel
shroud; semi-automatic firearms with a fixed magazine that can accept more than 10 rounds; ghost
guns; 3D printed guns; firearms without serial numbers; .50 BMG rifles; firearms that use .50 BMG
ammunition. Firearm Parts: magazines capable of accepting more than 10 rounds; flash or sound
suppressors; multi-burst trigger devices; grenade or rocket launchers; 80% or unfinished lower
receivers; blueprints for ghost guns; blueprints for 3D printed guns; barrel shrouds; thumbhole stocks;
threaded barrels capable of accepting a flash suppressor or sound suppressor.

7. U.S. Digital Millennium Copyright Act or Similar Statutory Obligations

A. To the extent a customer uses the services for hosting, advertising, sending electronic messages, or
for the creation and hosting of, or for posting material on, websites, each customer must:

I. Comply with any notices received under Title II of the Digital Millennium Copyright Act of 1998
(Section 512 of the U.S. Copyright Act) or similar statute in other countries (the “DMCA”);

II. Set up a process to expeditiously respond to notices of alleged infringement that comply with
the DMCA and to implement a DMCA-compliant repeat infringers policy;

III. Publicly display a description of its notice and takedown process under the DMCA on its
instance of the services; and

IV. Comply with such processes, policy(ies), and description.

B. It is Salesforce’s policy to respond expeditiously to valid notices of claimed copyright infringement
compliant with the DMCA. In appropriate circumstances, Salesforce will terminate the accounts of
customers who Salesforce suspects to be repeatedly or blatantly infringing copyrights.

C. If Salesforce receives a notice alleging that material on a customer’s instance of a service infringes
another party’s intellectual property, Salesforce may disable that customer’s instance of the service
or remove the allegedly infringing material. If Salesforce receives more than one such notice for the
same customer, Salesforce reserves the right to immediately terminate such customer’s subscriptions
to the services as deemed necessary by Salesforce to ensure continued protection under the safe
harbor provisions under the DMCA or to prevent violations of other applicable laws or third parties’
rights.