Capital Rail Systems Acceptable Use Policy

Effective Date: August 14, 2026

Version: 1.1

1. Purpose

This Acceptable Use Policy governs permitted and prohibited use of the Capital Track Assets platform and related Services.

2. Authorized Business Use

Users may use the Services only for legitimate, authorized business purposes consistent with their role, organization, subscription, and applicable agreements.

3. Prohibited Access

Users may not:

• Access another customer's information without authorization.
• Attempt to obtain privileges beyond those assigned to their account.
• Bypass authentication, authorization, or security controls.
• Use another person's credentials without authorization.
• Attempt to identify or exploit system vulnerabilities.

4. Prohibited Technical Activity

Users may not:

• Introduce malware, viruses, ransomware, or malicious code.
• Interfere with system availability or performance.
• Conduct denial-of-service activity.
• Use automated scraping or extraction tools without written authorization.
• Reverse engineer, decompile, or disassemble the Services except where permitted by law.
• Attempt to obtain source code or proprietary system information without authorization.

5. Unlawful or Harmful Use

The Services may not be used to violate applicable law, infringe the rights of others, facilitate fraud, or knowingly submit unlawful or malicious content.

6. Customer Information

Users may submit only information they are authorized to collect, use, store, or disclose through the Services.

7. Account Security

Users must take reasonable steps to protect account credentials and promptly report suspected unauthorized access.

8. Enforcement

Capital Rail Systems may investigate suspected violations and may restrict, suspend, or terminate access where reasonably necessary to protect customers, users, systems, legal rights, or the Services.

9. Changes

This policy may be revised from time to time as the Services, security practices, or legal requirements evolve.