Abuse Policy

This Abuse Policy ("Policy") sets out the full framework through which Crederoom Inc. ("Crederoom", "we", "us", "our") identifies, investigates and acts against abuse of the crederoom.com Platform, the Crederoom mobile applications, the AI trading engine and any related products, services, APIs, communication channels and digital properties operated by Crederoom (collectively, the "Platform"). It applies to every registered investor, visitor, affiliate, API consumer, media contact and third party interacting with any part of our ecosystem.

Autonomous AI investing lives or dies by trust. A single bad actor — a scammer impersonating our brand, a fraudster laundering stolen funds, a hacker probing our infrastructure, or a troll weaponising our community channels — can inflict real damage on real investors. That is why Crederoom treats abuse not as a nuisance but as a direct attack on the integrity of our 30,000+ global member base. This Policy explains, in plain English, exactly what counts as abuse on Crederoom, how we investigate it, how we punish it, and how you can report it fast when something looks wrong.

This Policy should be read alongside our Terms of Use, Privacy Policy, Cookie Policy and AML/KYC Policy. Together, these documents form the complete behavioural and legal contract between you and Crederoom.

1. Our Zero-Tolerance Philosophy

Crederoom operates a zero-tolerance stance toward abuse. We do not warn repeat offenders, we do not grant "second chances" to fraudsters, and we do not hesitate to escalate matters to law-enforcement agencies when the facts justify it. Every single abuse report is reviewed by a human member of our Trust & Safety team — not by an unsupervised algorithm — and documented in an immutable internal case log for accountability.

At the same time, we commit to due process: no account is suspended without clear evidence; no funds are frozen without a documented reason; no accusation is treated as fact until our investigation says so. Our enforcement actions are proportionate, auditable and overturnable where new evidence emerges.

2. What Counts as Abuse on Crederoom

"Abuse" under this Policy covers any activity that violates applicable law, breaches our Terms of Use, endangers other investors, undermines the technical integrity of the Platform, or damages the reputation of the Crederoom brand. The categories below are illustrative, not exhaustive — our Trust & Safety team ultimately decides whether a given behaviour constitutes abuse based on the full facts of the case.

2.1 Account & Identity Abuse

• Creating multiple accounts under a single identity (one person = one account);
• Registering with a false, stolen or synthetic identity;
• Submitting forged or digitally manipulated KYC documents;
• Sharing your account credentials with a third party;
• Reselling, renting or transferring your Crederoom account to someone else;
• Circumventing a prior ban by signing up under a different name or VPN.

2.2 Financial Abuse

• Using funds derived from criminal activity (money laundering, drug trafficking, sanctions evasion, terrorism financing);
• Using stolen cards, hijacked bank accounts or compromised crypto wallets to fund a Crederoom account;
• Chargeback fraud — depositing funds and then disputing the transaction to withdraw twice;
• Exploiting bugs, pricing errors or race conditions in the AI engine for unjust enrichment;
• Collusion between multiple accounts to inflate referral rewards, bonuses or promo payouts;
• Operating as an unregistered money-services business through a Crederoom account.

2.3 Platform & Security Abuse

• Unauthorised scanning, probing or penetration-testing of crederoom.com without a signed engagement;
• Launching DDoS, DoS, brute-force or credential-stuffing attacks against our infrastructure;
• Reverse-engineering, decompiling or tampering with the AI trading engine, smart contracts or mobile apps;
• Deploying bots, scrapers or crawlers against the Platform without written permission;
• Exploiting any smart-contract vulnerability for personal gain rather than responsibly disclosing it;
• Abusing our API with request volumes exceeding published rate limits.

2.4 Social Engineering & Impersonation

• Impersonating Crederoom employees, moderators, support agents or executives;
• Creating fake Crederoom websites, Telegram channels, Discord servers, X/Twitter accounts or email domains;
• Phishing other investors through fake login pages, "support" DMs or fraudulent 2FA prompts;
• Advertising unauthorised "signal groups", "profit-sharing pools" or "VIP mentors" in our name;
• Running fake airdrops or token sales falsely associated with Crederoom.

2.5 Community & Communication Abuse

• Harassment, threats, hate speech, racism, sexism, homophobia or discrimination of any kind;
• Doxxing — publishing another investor's personal information without consent;
• Spamming official channels with repetitive promotional, affiliate or off-topic content;
• Coordinated disinformation campaigns targeting Crederoom, its team or its community;
• Trolling, flooding support channels or deliberately wasting Trust & Safety team resources.

2.6 Intellectual Property Abuse

• Unauthorised use of the Crederoom name, logo, trademarks or marketing assets;
• Copying our website design, dashboard UI, legal documents or whitepaper verbatim;
• Hosting pirated copies of our smart-contract code or AI-engine binaries;
• Filing fraudulent DMCA takedown notices against legitimate Crederoom content.

2.7 Legal & Regulatory Abuse

• Accessing the Platform from a Restricted Jurisdiction (see our Terms of Use, Section 3);
• Using Crederoom to evade sanctions, taxes or capital controls;
• Any activity designed to interfere with ongoing law-enforcement investigations.

3. How to Report Abuse

If you witness, suspect or are directly affected by abuse of the Crederoom Platform, we need to hear from you — the sooner, the better. Early reports save funds, protect other investors and let us act before an incident spreads.

3.1 Primary Reporting Channel

The fastest, most trackable way to report abuse is through our dedicated inbox:

• Abuse reports: [email protected]
• Security vulnerabilities: [email protected]
• Fraud & scam reports: [email protected]
• Impersonation & brand abuse: [email protected]
• Legal / law enforcement: [email protected]

3.2 Alternative Channels

• 24/7 abuse hotline: +1 (780) 542-1618
• Live chat on crederoom.com — click the chat bubble in the bottom-right corner;
• Report-A-Problem form — available inside your investor dashboard under Settings → Trust & Safety;
• Postal mail: Crederoom Inc., Trust & Safety Office, First Canadian Place, 100 King St W, Toronto, ON M5H 1H1, Canada.

3.3 What to Include in Your Report

To let us investigate quickly and accurately, please include as much of the following as you can:

• Your name and preferred contact email (optional but strongly recommended);
• Date, time and timezone of the incident;
• Username, wallet address, URL or channel of the suspected bad actor;
• Screenshots, chat exports, transaction hashes or any supporting evidence;
• A short description of what happened in your own words;
• Any financial loss you believe you have suffered;
• Whether you have already reported the matter to law enforcement.

3.4 Anonymous Reporting

You can submit abuse reports anonymously. We cannot reply to anonymous reports, but we investigate them with the same seriousness as named reports. If you want anonymity but also need updates, use a secure throwaway email address.

4. Our Investigation Process

Every incoming abuse report flows through a structured, documented workflow:

1. Intake (within 1 hour): the report is logged in our case-management system and assigned a unique reference ID (format KD-TS-YYYYMMDD-NNNNN).
2. Triage (within 4 hours): a Trust & Safety analyst classifies severity (Low / Medium / High / Critical) and routes the case to the appropriate specialist team.
3. Evidence gathering (1–7 days): we pull server logs, transaction history, device fingerprints and any on-chain data relevant to the case. We never fabricate or guess at evidence.
4. Enforcement decision: a reviewer applies the Enforcement Ladder (Section 5) and documents the rationale for the chosen action.
5. Execution: the enforcement action is applied (account suspension, fund hold, legal referral, etc.).
6. Notification: affected parties are informed via email and dashboard notice (except where law enforcement explicitly requires non-disclosure).
7. Appeal window (14 days): the sanctioned user may appeal (see Section 7).
8. Case closure: the case is sealed, archived and included in our quarterly Transparency Report in aggregated, anonymised form.

5. Our Enforcement Ladder

Crederoom applies enforcement proportionally. Mild, first-time infractions do not receive the same response as repeated financial fraud. Our standard Enforcement Ladder — from lightest to heaviest — looks like this:

1. Warning: a formal written notice placed on your account record; no restrictions imposed.
2. Feature restriction: temporary disabling of specific features such as referral rewards, API access or chat privileges.
3. Deposit freeze: suspension of new deposits pending resolution; existing balances remain untouched.
4. Trading pause: AI engine is paused; no new trades are opened on your account.
5. Withdrawal hold: withdrawals are held pending enhanced verification; balance remains visible.
6. Temporary account suspension: account access blocked for a defined period (typically 7–90 days).
7. Permanent account termination: account closed permanently; verified principal returned minus any lawful offsets.
8. Fund forfeiture: in cases of proven fraud or money laundering, accrued profits (never principal, unless court-ordered) may be forfeited.
9. Civil action: Crederoom may pursue damages, injunctions and recovery through civil courts.
10. Criminal referral: the case is handed to the appropriate law-enforcement authority (RCMP, FINTRAC, FBI, Europol, Interpol, local police).

The ladder is a guide, not a mandatory sequence. Severe or clearly criminal behaviour may jump directly to Steps 7–10 without passing through earlier steps.

6. Protection for Reporters & Whistleblowers

Crederoom offers robust protections for anyone who reports abuse in good faith:

• Confidentiality: your identity is accessible only to the Trust & Safety team and never shared with the subject of the report;
• No retaliation: we strictly prohibit retaliation against reporters by any Crederoom staff, affiliates or community members;
• Whistleblower rewards: for reports that lead to the recovery of stolen funds, the shutdown of major scams or the disruption of a criminal operation, Crederoom may issue a discretionary reward of up to $25,000 USD;
• Legal protection: we will cover reasonable legal costs for good-faith reporters who face frivolous retaliatory litigation.

Deliberately false reports made in bad faith are themselves considered abuse under this Policy and will be sanctioned accordingly.

7. Right of Appeal

Every sanctioned user has the right to challenge an enforcement decision. The appeal process is structured as follows:

1. Submit an appeal to [email protected] within 14 calendar days of the enforcement notice, quoting the case reference ID;
2. Include new evidence or a clear explanation of why the original decision was wrong;
3. Independent review: an Appeals Officer who was not involved in the original decision will review the file;
4. Response within 10 business days: the Appeals Officer issues a written decision — uphold, reduce or reverse the original sanction;
5. Escalation: if you remain dissatisfied, you may escalate to arbitration under the dispute-resolution clause of our Terms of Use.

8. Responsible Disclosure & Bug Bounty

Security researchers who identify vulnerabilities in the Crederoom Platform are our allies, not adversaries. We maintain a formal Bug Bounty Program with rewards ranging from $250 to $100,000 USD depending on severity. Full rules, scope and reward tiers are published at crederoom.com/security/bug-bounty.

Responsible disclosure requires:

• Reporting findings privately to [email protected] before any public disclosure;
• Allowing Crederoom a reasonable remediation window (typically 90 days);
• Not exploiting the vulnerability for personal gain or to access other users' data;
• Not performing destructive testing on live user data.

Compliant researchers enjoy safe-harbour protection: Crederoom will not pursue legal action against good-faith security research conducted within our published scope.

9. Cooperation With Law Enforcement

Crederoom cooperates fully with legitimate law-enforcement requests from recognised authorities, including:

• Royal Canadian Mounted Police (RCMP) and provincial police forces;
• FINTRAC (Canadian financial-intelligence unit);
• US FBI, SEC, CFTC, FinCEN;
• UK National Crime Agency and FCA;
• Europol, Interpol and EU member-state authorities;
• Court-ordered subpoenas from any jurisdiction where the Platform operates.

We require properly served legal process (subpoena, court order, mutual-legal-assistance request) before disclosing user data. Emergency disclosure requests involving imminent threat to life or safety may be processed on an expedited basis without formal process, consistent with applicable law.

10. How Crederoom Fights Scams in the Wild

Beyond on-Platform enforcement, Crederoom actively hunts bad actors who abuse our brand across the open internet:

• Daily automated scans for look-alike domains (kibokodao.co, kibokoedao.org, etc.);
• Takedown requests to hosting providers, registrars and CDNs;
• Reporting of fraudulent Telegram, Discord, X/Twitter, TikTok, YouTube and Instagram accounts;
• Coordination with Chainalysis, TRM Labs and Elliptic for on-chain fraud tracking;
• Partnerships with crypto exchanges to freeze stolen funds routed through CEX accounts;
• Public warnings posted on crederoom.com/alerts whenever a significant scam is identified.

11. Transparency & Public Reporting

Every quarter Crederoom publishes a Trust & Safety Transparency Report at crederoom.com/transparency. The report includes:

• Total number of abuse reports received, by category;
• Enforcement actions taken, by type;
• Number of accounts suspended, terminated or referred to law enforcement;
• Phishing domains taken down;
• Stolen funds recovered;
• Bug bounty rewards paid out.

All data in the Transparency Report is anonymised and aggregated — no individual user is identifiable.

12. User Responsibilities & Self-Protection

No abuse program succeeds without educated users. Crederoom expects every investor to:

• Enable 2FA on every account and use a hardware security key where possible;
• Verify every URL — the only official domain is crederoom.com;
• Never share passwords, 2FA codes, seed phrases or private keys with anyone — including people claiming to be our staff;
• Treat unsolicited "VIP support" DMs as scams until proven otherwise;
• Report suspicious activity to [email protected] immediately;
• Keep devices, browsers and anti-malware software fully up-to-date.

13. Governing Law & Jurisdiction

This Abuse Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Any dispute arising from or related to this Policy shall be resolved under the dispute-resolution framework set out in our Terms of Use.

14. Updates & Changes to This Policy

Crederoom may update this Abuse Policy at any time to reflect evolving threat landscapes, new regulatory requirements or improvements to our Trust & Safety operations. Material updates will be communicated via dashboard notification and email at least 14 days before the effective date. Continued use of the Platform after that date constitutes your acceptance of the revised Policy.

15. Contact the Trust & Safety Team

For any question, concern, report or escalation related to this Abuse Policy, our Trust & Safety team is reachable 24/7 through the following official channels:

• Abuse reports: [email protected]
• Security disclosures: [email protected]
• Fraud & scam reports: [email protected]
• Brand & impersonation: [email protected]
• Appeals: [email protected]
• Legal / law enforcement: [email protected]
• 24/7 abuse hotline: +1 (780) 542-1618
• Postal address: Crederoom Inc., Trust & Safety Office, First Canadian Place, 100 King St W, Toronto, ON M5H 1H1, Canada

Effective date: October 23, 2026
Last updated: October 23, 2026
Document version: 1.0
Document reference: KD-ABUSE-2026-V1