# POL-203 — The terms should cover accounts and credentials

> The terms of service must include a clause covering accounts, registration and credential security.

- **Rule ID:** POL-203
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `terms of service body`
- **Severity:** LOW — Best practice. Worth fixing, rarely fatal on its own.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** TCR
- **Applies:** Applies when the use case is NOT M2M.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-203/

## Why this rule exists

Where the service has logins, the account clause is what puts the duty to keep a password safe on the person who holds it — without it the business carries the whole risk of a compromised account. For a messaging programme it also matters that account settings are often where a subscriber manages their preferences.

## How to fix it

Add the accounts clause where the service has user accounts. Done when the document says who is responsible for a login and what happens when it is misused.

## Example of a compliant value

```text
You are responsible for keeping your Acme Coffee account password secure and for anything done using your account. Tell us at once if you think someone else has used it.
```

## Notes

Conditional on the service having user accounts, which no applicability dimension expresses; the excludeUseCases tag only keeps it away from machine-to-machine programmes, and the criteria carry the real condition.