Acceptable use policy

Introduction

This Acceptable Use Policy defines the responsibilities and acceptable use of ApplySG to ensure the security, integrity, availability, and appropriate use of the platform and the data it manages.

This policy applies to all individuals, agencies, systems, and processes that access or interact with ApplySG, including the Builder, Backoffice Portal, integration endpoints, and all supported environments.

Platform usage

Intended use

Use ApplySG only for government-approved use cases and policy-driven administrative processes.
Do not use ApplySG as a general-purpose platform, such as for file storage or purposes outside its intended use.

Responsible use

Do not execute automated load, stress, or performance tests without prior approval from the platform administrator.
Do not misuse platform resources or attempt to circumvent platform controls in a manner that compromises the security, stability, availability, or performance of the platform or other tenants.

Account and access management

Account management

Users are responsible for all activities performed using their accounts.
Users must not impersonate another user or attempt to access accounts or resources for which they are not authorised.

Access management

Agencies are responsible for assigning user roles and permissions based on the principle of least privilege.
Agencies must ensure appropriate segregation of duties by assigning processing and approval responsibilities to different users. A user assigned a processing role must not be assigned the corresponding approval role for the same transaction or lifecycle (see ApplySG Portal template)
Agencies must periodically review user access to ensure roles and permissions remain appropriate.
Agencies must promptly update or revoke user access when it is no longer required, including when users change roles, leave the organisation, or no longer require access to a lifecycle.
Agencies should establish and maintain standard operating procedures (SOPs) for the timely onboarding, updating, and offboarding of users and their associated roles and permissions.

**Note:**
See Account Policy for responsibilities for managing user accounts and access to agency data throughout the user lifecycle.

Data management

Data collection

Collect only the data necessary for the intended purpose and that the agency is authorised to collect.
Do not collect regulated or highly sensitive data unless the service is explicitly approved to handle such data.

Use and share data only for authorised purposes and in accordance with applicable laws, regulations, and agency policies.
Inform end users, where appropriate, of how their data will be collected, used, retained, and shared.

Data protection and retention

Protect data from unauthorised access, disclosure, modification, or loss.
Retain data only for as long as required and dispose of it securely when no longer needed.
Do not use production or personal data in test environments unless explicitly authorised.

Content ownership

Agencies remain responsible for the accuracy, legality, and appropriateness of all data, content, documents, and workflows configured or uploaded to ApplySG.
Agencies must ensure that uploaded content complies with applicable copyright and licensing requirements.

Lifecycle management

Governance

Restrict lifecycle creation, editing, and publishing permissions to authorised users.
Ensure lifecycle configuration and business logic align with approved business processes.
Configure appropriate review, approval, and authorisation steps within workflows.
Validate workflow business rules and decision logic before deployment to production.
Obtain the necessary business and governance approvals before deploying new lifecycle(s) or changes to existing lifecycle(s) into production.

Testing and deployment

Test all new configurations and configuration changes in the test environment before deploying them to production.
Route changes to the production environment through a formal change management and approval process. Direct modifications to production workflows without appropriate review and approval are not allowed.

Review and audit

Periodically review active lifecycles to ensure they remain accurate, relevant, and compliant.
Agencies must not tamper with audit logs or attempt to conceal platform activity.
Ensure workflow changes are attributable to authorised users and remain traceable for audit and compliance purposes.

Integrations

Protect API credentials and secrets in accordance with the Account Policy.
Handle downstream failures appropriately to maintain service reliability.
Integrations must comply with the platform’s authentication, authorisation, rate limiting, and security requirements.

Enforcement

Agencies are responsible for ensuring that their users comply with the Acceptable Use Policy.
In the event of non-compliance, agencies are responsible for assessing the severity of the issue based on their risk management and governance processes, and for taking corrective action within an appropriate time-frame commensurate with the level of risk.
As a guide:
- Critical issues, such as those involving unauthorised access or data exposure, must be remediated immediately, or no later than 24 hours from the time the issue is identified.
- Low-risk issues, such as minor workflow or configuration changes with limited impact, should be remediated within 7 working days or another mutually agreed remediation timeline.
Where ApplySG assesses that a non-compliance presents an unacceptable risk to the platform, it may require an earlier remediation timeline or temporarily suspend or off-board the affected lifecycle(s) until the issue has been resolved. ApplySG will endeavour to engage the agency prior to taking such action.

Reporting

Agencies and users must promptly, and in any case within 24 hours of discovery, report:

Suspected or actual security incidents, including compromised accounts or unauthorised access.
Suspected data breaches, unauthorised disclosure, or inappropriate handling of data.
Platform vulnerabilities, defects, or issues that may affect security, availability, or other users.
Misconfiguration, workflow errors, or policy breaches that could result in legal, regulatory, or operational non-compliance.
Any misuse of the platform or suspected breaches of this Acceptable Use Policy.

Data policy

Service continuity