Guidance

Acceptable Use Policy for the GOV.UK Wallet Sandbox

Published 15 October 2026

Relationship with the Terms

This Policy is incorporated into the GOV.UK Wallet Sandbox Terms of Use. It governs the Sandbox and is separate from the DVS Support Hub Acceptable Use Policy.

1. Purpose

1.1 This Policy protects the security, integrity, stability and intended technical-conformance purpose of the GOV.UK Wallet Sandbox (“Sandbox”).

1.2 The DVS is responsible for ensuring that all persons, subcontractors, systems, scripts and automated tools using its access comply with this Policy.

2. General requirements

The DVS must:

• Use the Sandbox only to test technical connectivity, documented interface implementation, including credential presentation and verification interoperability.
• Use only approved access routes, documented interfaces and current Sandbox credentials.
• Keep access credentials, certificates, keys and tokens secure and restrict them to authorised persons and systems.
• Comply with published technical limits, instructions and reasonable protective directions from GDS.
• Use only Synthetic Data supplied or expressly permitted by GDS.
• Act lawfully, in accordance with best industry practice and in a way that does not compromise the Sandbox, GDS, another participant or a third party.

3. Permitted use

3.1 Subject to this Policy and the Technical Documentation, the DVS may carry out:

• normal integration debugging;
• negative-path testing designed by the DVS;
• tests using malformed requests;
• automated regression testing;
• documented credential presentation, verification and status checking flows;
• other activity expressly authorised by GDS in writing.

3.2 Anything not listed within paragraph 3.1 is not permitted in connection with use of Sandbox unless GDS provides express written permission.

3.3 Without limitation to paragraph 3.2, wider investigation, exploitation or testing of GDS or third-party systems, beyond that reasonably required for the purposes set out Clause 2 of the Terms of Use or beyond the matters set out in paragraph 3.1 above, is not permitted. 

4. Rate and resource limits

4.1 The Sandbox will be used by a number of DVSs. Each DVS is expected to use the Sandbox in a co-operative, fair and reasonable way with the intention that others are not disadvantaged in their use of the Sandbox.  Without limitation to that requirement:

4.1.1 The DVS must not exceed

• Credentials Issued - 
  • 2 credentials issued or revoked within 10 seconds, 
  • 5 credentials issued or revoked within a minute, or
  • 50 credentials issued or revoked within an hour .
• Credential Sharing (with the verifying device online) - 
  • 5 credentials shared within 10 seconds, 
  • 10 credentials shared within a minute, 
  • 50 credentials shared within an hour
• Credential Sharing (verifying device offline) - 
  • Unlimited

4.1.2 The DVS must not generate traffic or consume resources in a way that could reasonably degrade the shared environment, even where a specified limit, threshold or measure has not been exceeded.

4.1.3 The DVS must comply promptly with any instruction to reduce or stop use of the Sandbox

4.2 GDS may take any or all of the actions referred to in paragraph 10 where use of the service by any DVS materially exceeds normal use patterns, places an unreasonable burden on GDS infrastructure, or negatively impacts the experience of other DVSs, 

4.3 Published limits on metrics may differ by interface or test capability and may be changed at any time.

5. Prohibited activity

5.1 Any use which is not expressly permitted under paragraph 3 (and which also complies with other restrictions on use in this Policy) is prohibited unless separately specifically approved by GDS in writing following a request from the DVS. 

5.2 Without limitation to paragraph 5.1, the following activities are and will remain prohibited:

• carry out penetration testing, vulnerability scanning, fuzzing, load testing, stress testing or performance benchmarking;
• attempt to bypass authentication, authorisation, rate limits, isolation or other controls;
• access or attempt to access another participant’s account, test data, systems or communications;
• use private, internal, undocumented or unintended interfaces;
• decompile, disassemble or reverse engineer the Test App or Sandbox components, except where applicable law prevents this restriction;
• introduce malicious, destructive or disruptive code;
• intercept, alter, replay or exploit traffic beyond what is reasonably necessary for permitted integration debugging;
• publish performance comparisons or portray Sandbox results as representative of production;
• use the Sandbox for a live service, real transaction, commercial decision or service to a real user;
• use the Sandbox unlawfully, fraudulently, deceptively or in a way that infringes third-party rights.

6. Data handling

6.1 The DVS must not introduce Personal Data, production data, live credentials or information relating to a real individual into the Sandbox.

6.2 Where GDS enables DVS-created test data, the DVS must ensure it is wholly synthetic and complies with the Technical Documentation. GDS may disable that capability or delete data at any time.

6.3 Synthetic Data may be retained for legitimate testing. It must not be presented as real, used to make live decisions, or combined with information in a way that could identify or be attributed to a real person.

6.4 Code and configurations used in production may be reused only where the DVS has the right to use them and they contain no Personal Data, credentials, secrets or third-party information that the DVS is not authorised to disclose.

6.5 Rules for screenshots, logs, attachments and other material submitted through the DVS Support Hub are governed by the separate DVS Support Hub Acceptable Use Policy.

7. Security reporting and responsible disclosure

7.1 The DVS must promptly report confirmed incidents or risks of:

• suspected or confirmed vulnerabilities;
• credential or certificate compromise;
• actual or attempted unauthorised access;
• unexpected exposure of non-public information;
• security-control failure;
• introduction of prohibited data.

7.2 After discovering a potential vulnerability, the DVS must:

• stop activity that could worsen the issue;
• not exploit, persist, move laterally or access further information;
• retain only the minimum evidence reasonably needed to report it;
• keep the finding confidential;
• follow reasonable containment and evidence-handling instructions from GDS.

7.3 Good-faith discovery during permitted testing will not itself be treated as prohibited security testing if the DVS reports promptly and does not continue beyond what is reasonably necessary to understand and report the issue.  This does not protect deliberate, reckless, malicious or continued activity outside the permitted testing.

8. Defects, documentation and feedback

8.1 The DVS must report a material discrepancy between the Sandbox behaviour and the Technical Documentation where it prevents or materially impairs integration.

8.2 The DVS must report minor bugs, documentation inaccuracies and useful learning where reasonably practicable. General product suggestions are encouraged but are not mandatory.

8.3 Reports are required to contain sufficient detail to reproduce and understand the issue, without including prohibited data, credentials or unnecessary DVS proprietary information.

9. Communications and representation

9.1 The DVS must not:

• Publicly disclose participation before GDS has publicly launched the Sandbox or otherwise permitted disclosure.
• Imply government endorsement, certification, production approval or confirmed production readiness.
• Represent Synthetic Data, test credentials or simulated results as real or live.
• Use GOV.UK, GOV.UK One Login or GOV.UK Wallet names, logos or brand assets beyond factual textual reference without permission.
• Disclose confidential, security-sensitive or other participants’ information.

9.2 The DVS must:

• Only make accurate factual statements about the DVS’s own participation.
• Comply with the GOV.UK and GOV.UK One Login Brand Guidelines as outlined here
• Correct or remove materially inaccurate or misleading material when reasonably required by GDS.

10. Monitoring and consequences

10.1 GDS may monitor Sandbox activity and logs to protect the service, investigate incidents, enforce this Policy and improve the product. This will include without limitation, Logging and Monitoring of the Sandbox will be undertaken as part of our security arrangements.

10.2 .GDS may at any time apply throttling, temporary restrictions or suspension to protect the service, address perceived non-compliances with the terms and conditions for the use of the service (including this Acceptable Use Policy) and/or maintain fair usage amongst DVSs. Without limitation, where use of the service by any DVS is considered to be likely to conflict with expected standards of conduct, GDS reserves the right to require that the DVS moderates its usage or to restrict, suspend, or terminate the usage by that DVS. 

10.3 Material or repeated non-compliance may also be taken into account in a later production onboarding decision. Responsible reporting, ordinary test failure or good-faith integration error will not of itself be treated as adverse conduct.

11. Changes to this Policy

11.1 GDS may update this Policy in accordance with the Sandbox Terms of Use. Formal notice will be issued by email and/or the DVS Support Hub; discussion at a monthly service review is supplementary and is not the formal notice mechanism.

11.2 Urgent security, legal or misuse-related changes may take effect immediately. Material non-urgent changes may include a reasonable transition period of up to three months.