Acceptable Use Policy

This Acceptable Use Policy (“AUP”) applies to use of CyfroSec services and is incorporated into the applicable Platform Terms, Order Form or customer agreement.

1. Authorised scope

You may use the services only for systems, networks, endpoints, repositories, accounts and data that you own, control or are expressly authorised to assess. You must define and maintain evidence of the authorised scope and provide reasonable confirmation of authority if CyfroSec requests it in response to a material risk.

2. Prohibited use

You and your authorised users must not:

• access, scan, test, monitor, intercept or interfere with a system without authorisation;
• create, deploy or facilitate malware, ransomware, spyware, destructive code or credential theft;
• conduct denial-of-service, load or stress testing against CyfroSec infrastructure without prior written approval;
• evade security, licensing, usage or rate controls;
• misuse personal data, credentials, secrets, source code or confidential information;
• conduct unlawful surveillance, unlawful profiling or prohibited automated decision-making;
• infringe intellectual-property, privacy or other third-party rights;
• breach sanctions, export-control, privacy, cybersecurity or other applicable law;
• misrepresent your identity, authority or authorised scope;
• publish vulnerability information in breach of a duty or in a manner that creates unreasonable risk;
• use AI features for unlawful access, malware or harmful automation;
• build, benchmark or train a competing product contrary to an applicable agreement;
• attempt to cross tenant or account-group boundaries or obtain another customer’s information;
• interfere with the integrity, availability, confidentiality or performance of the services; or
• use the services in a high-risk or safety-critical context that has not been expressly approved in writing.

3. Credentials, secrets and sensitive data

You must not submit unnecessary passwords, private keys, API keys, authentication tokens or other secrets. If security material may incidentally contain a secret, you must apply available filtering and access controls and promptly rotate or revoke an exposed credential.

Special-category personal data and information subject to heightened legal protection must not be intentionally submitted unless expressly agreed and supported by additional safeguards.

4. Customer security responsibilities

You must protect credentials, endpoints, integrations and repository tokens; assign permissions according to least privilege; promptly revoke unnecessary access; approve actions affecting your systems; maintain appropriate backups; report suspected compromise; and comply with Documentation and reasonable security instructions.

5. Automation and testing of CyfroSec

Automated access must use documented interfaces and comply with applicable limits. You must not conduct penetration testing or vulnerability scanning against CyfroSec infrastructure except as expressly permitted by the Vulnerability Disclosure Policy or written authorisation.

Suspected vulnerabilities should be reported to safety@cyfrosec.com.

6. Enforcement

Where CyfroSec reasonably believes that use violates this AUP, is unlawful or creates a material security threat, it may request information and corrective action. Except where immediate action is reasonably necessary to prevent ongoing unlawful activity or a material security threat, CyfroSec will provide written notice and 14 days to remedy or adequately mitigate the breach.

CyfroSec may immediately suspend only the affected use to the extent reasonably necessary to prevent ongoing harm, preserve evidence or comply with law. If the breach is not remedied within the applicable period, CyfroSec may terminate or continue suspension of the affected service or Order Form. CyfroSec may terminate the entire customer relationship only where the circumstances affect the relationship as a whole or cannot reasonably be limited to the affected service.

7. Reporting abuse

Report suspected abuse to privacy@cyfrosec.com and suspected security vulnerabilities or incidents to safety@cyfrosec.com.