Computer Misuse Act 1990

The Computer Misuse Act 1990 (as amended) criminalises unauthorised access to computer material (s.1), unauthorised access with intent to commit further offences (s.2), unauthorised acts impairing the operation of a computer (s.3), and the supply of articles for use in such offences (s.3A).

How we comply

• Authorisation boundaries. All access to our production systems is granted on a least-privilege basis, recorded in our access register, and reviewed quarterly. Internal access requires MFA and is logged.
• Acceptable Use Policy. Every employee and contractor signs an AUP that explicitly references the offences in sections 1–3A. Training is delivered annually.
• Customer terms. Our customer Terms of Service prohibit any use of the platform that would constitute an offence under the CMA, including unauthorised access, brute-force attempts and the use of automated tools designed to impair service.
• Detection and response. WAF, rate limiting, anomaly detection and audit logging are used to identify potential s.1 and s.3 activity. Confirmed incidents are referred internally and, where appropriate, to law enforcement and Action Fraud.
• Coordinated vulnerability disclosure. We operate a published responsible-disclosure policy. Good-faith security research conducted within its scope is authorised — we will not pursue legal action under the CMA against researchers who comply with the policy. This safe-harbour does not extend to data exfiltration, service degradation or third-party systems.

Suspected offences are investigated in conjunction with the National Crime Agency's National Cyber Crime Unit where appropriate.