Acceptable Use Policy

Last updated: April 5, 2026

This Acceptable Use Policy (“AUP”) governs what you may and may not do with the EuroValidate API and related services. It forms part of the Terms of Service. By using the Service, you agree to this AUP.

What the API is for

EuroValidate is designed to validate European business identifiers (VAT numbers, IBANs, EORI numbers, LEI codes, and associated company metadata) for legitimate commercial purposes such as invoicing, KYB/compliance checks, customer onboarding, and e-commerce checkout flows.

Prohibited uses

You must not use the Service to:

Violate law or third-party rights — no activity that is unlawful in Portugal, the EU, or the jurisdiction where you or the data subject is located.
Harm, stalk, or profile individuals — the API is for business identifiers, not for enriching personal profiles. Combining our responses with personal data for targeting, surveillance, social scoring, or discrimination is prohibited.
Circumvent rate limits, caching, or pricing — do not rotate keys, shard traffic across multiple accounts, or reverse-proxy the API to avoid billing.
Overwhelm upstream government APIs — do not use EuroValidate as a tool to amplify load on VIES, HMRC, or GLEIF.
Resell the raw API without a written reseller agreement. Embedding the API in your own product is fine; republishing our endpoints as a competing service is not.
Scrape or mirror our cache, docs, or marketing site for training ML models or building a derivative database.
Transmit malware, spam, or fraudulent traffic through our webhooks or API.
Probe for vulnerabilities without authorization — security research is welcome, but only within the responsible disclosure policy.
Misrepresent your identity during sign-up or provide false business details for billing.

Data you submit to us

You must have a lawful basis to submit each identifier you validate. If the identifier relates to an identifiable person (a sole trader VAT number, for example), you are the GDPR controller and you are responsible for that basis. Do not submit identifiers you obtained through illegitimate means.

Rate limits and fair use

Each pricing tier has a monthly included request quota and a per-minute technical burst limit; see the pricing page for details. On the Free tier, the monthly quota is a hard cap — exceeding it returns HTTP 429 until the next UTC month. On paid tiers (Starter, Growth, Scale), requests above the included quota are automatically billed at the per-request overage rate and the API keeps serving you; only the per-minute burst limit returns HTTP 429. Chronic abuse of limits — including running identical requests in tight loops to defeat caching — is a breach of this AUP even if you stay below the limit on paper.

Geographic and sanctions restrictions

See our Terms of Service for the list of restricted jurisdictions and sanctions rules.

Consequences of violation

We may, at our sole discretion and without prior notice where urgent:

Issue a written warning.
Temporarily throttle or suspend your API key.
Terminate your account and refuse future service.
Report illegal activity to law enforcement or data protection authorities.
Recover damages, legal fees, and any fines imposed on us as a result of your breach.

When appropriate and safe to do so, we will give you 48 hours to remediate before suspension. Account terminations under this AUP are not entitled to refunds.

Reporting abuse

If you believe another user is violating this AUP, email [email protected] with details.

Changes

We may update this AUP from time to time. Material changes are announced by email to active customers at least 14 days before they take effect.