Acceptable Use Policy

1. Authorised Use Only

The Platform is designed for authorised security testing of systems you own or have explicit written permission to test. You must:

• Only test systems, networks, and assets that you own or are expressly authorised to test.
• Ensure all necessary internal approvals, change management processes, and regulatory notifications are in place before testing begins.
• Accurately configure the scope of testing within the Platform so that it reflects only authorised targets.
• Comply with all applicable laws and regulations, including computer misuse, data protection, and export control laws.

2. Prohibited Activities

You must not use the Platform to:

• Test, scan, or attack any system, network, or service that you do not own and are not expressly authorised to test.
• Conduct denial-of-service or resource exhaustion attacks unless explicitly enabled by you via the Platform's configuration controls, in which case you accept the associated risk.
• Exfiltrate, copy, or transmit data from any environment beyond the minimum necessary to confirm and evidence a vulnerability.
• Modify, delete, or corrupt production data or configurations, except as an inherent and unavoidable consequence of an authorised test.
• Access or attempt to access government, law enforcement, or critical national infrastructure systems without proper authorisation.
• Engage in any activity that constitutes a criminal offence under applicable law, including the Computer Misuse Act 1991 (UK), the Computer Fraud and Abuse Act (US), or equivalent legislation.
• Reverse engineer, decompile, or attempt to derive the source code of the Platform.
• Sub-license, resell, or make the Platform available to any third party without CodeWall's prior written consent.
• Publish or publicly disclose benchmarks, test results, or performance data relating to the Platform without CodeWall's prior written consent.
• Circumvent, disable, or interfere with the Platform's security features, scope enforcement, or safety mechanisms.
• Use the Platform in any way that could damage, overburden, or impair it, or interfere with any other party's use.

3. Scope and Targeting

You are solely responsible for correctly configuring the scope of testing within the Platform. The following are always out of scope regardless of your configuration:

• Third-party systems not owned or controlled by you.
• Shared or multi-tenant systems without the consent of all affected tenants.
• Payment processing systems or cardholder data environments, unless you have confirmed PCI DSS compliance requirements and accepted the associated risk.

We strongly recommend conducting initial testing against a staging or pre-production environment before enabling the Platform against production systems. If you choose to test against production, you accept the additional risk of disruption, data loss, or degraded performance.

4. Fair Usage

Your subscription includes reasonable use of the Platform for security testing within your configured scope. Usage that may be considered unreasonable includes:

• Continuous or near-continuous automated testing exceeding 72 hours without interruption.
• Concurrent testing of more than 1,000 in-scope assets.
• Repeated full-depth test cycles against the same environment within 7 days where no material configuration changes have been made.
• Usage patterns that result in disproportionate consumption of Platform resources relative to other users.

If we determine that your usage exceeds fair use, we will notify you and discuss appropriate adjustments. We may throttle or temporarily restrict access until usage returns to reasonable levels.

5. Kill Switch

The Platform includes a kill switch mechanism. You may halt all active testing at any time via the Platform interface or API. Upon receiving a kill switch request, we will use commercially reasonable efforts to halt testing within 60 seconds under normal operating conditions.

6. Reporting and Cooperation

If you become aware of any security vulnerability in the Platform itself, please report it responsibly to security@codewall.ai.

We may investigate suspected violations of this AUP. You agree to cooperate with any such investigation and to provide information reasonably requested by CodeWall.

7. Consequences of Violation

Violation of this AUP may result in, at our sole discretion:

• A warning with a request to cease the prohibited activity.
• Temporary suspension of your access to the Platform.
• Permanent termination of your account without refund.
• Reporting to relevant law enforcement authorities where we reasonably believe criminal activity has occurred.

8. Changes to This Policy

We may update this AUP from time to time. We will notify you of material changes by email or through the Platform. Continued use of the Platform after changes take effect constitutes acceptance.

9. Contact

For questions about this policy, contact us at legal@codewall.ai.