DRAFT — NOT LEGAL ADVICE. Template only; have a lawyer review before publishing. Notes for the reviewing lawyer are kept in the source file, not on this page.
Acceptable Use Policy (DRAFT)
Last updated: [DATE]
This Acceptable Use Policy ("AUP") applies to anyone using Solacess. It is incorporated into our Terms of Service. Violating this AUP may result in suspension or termination of your account, without refund.
1. You may only scan what you're authorized to scan
This is Solacess's single most important rule. You may run a Solacess scan against a target application only if:
- you own the application and its infrastructure (the domain, the hosting, the database), or
- you are an employee/contractor of the owner acting within the scope of your work, or
- you have documented, affirmative, written authorization from the owner specifically to
perform security testing (for example, as part of an authorized due-diligence review before acquiring the application).
You may not use Solacess against:
- a competitor's product or any application you don't control, "just to see what happens";
- an application you're evaluating as a customer, vendor, or vendor's vendor, without that
vendor's written permission;
- a target discovered only *through* an authorized scan — for example, if a scan of your app
reveals an API key or endpoint belonging to a different company's system, you may not use that discovery to test the other company's system. Report it to them instead (see Responsible Disclosure) or to us.
Solacess enforces domain-ownership verification (DNS TXT record or file token) before running any active check. This technical gate does not itself authorize you to test — you are legally responsible for having the right to test the target, regardless of whether our verification step passes.
2. No real user data, no live payment data
- Test accounts and credentials you provide must be dedicated test accounts, not accounts
belonging to real customers or containing real personal data.
- Stripe/payment checks must use test-mode keys only. Providing a live-mode key for
active testing is a violation of this policy — Solacess's engine is designed to refuse live-mode keys, but you must not attempt to route around that restriction.
- You may not use Solacess to extract, exfiltrate, or retain real end-user data uncovered
during a scan (for example, if a scan finds an actual data leak, the finding is reported to you with redacted proof — you should not use the underlying access to browse further).
3. No use of Solacess to build an attack, or to harm a target
- You may not use findings from a Solacess scan to exploit a system beyond what's necessary to
confirm the finding, or to cause damage, denial of service, or data loss on any system, including your own.
- You may not attempt to disable, bypass, or exceed the rate limits Solacess applies to scan
traffic.
- You may not use Solacess to develop, train, or validate a tool intended to attack systems
other than your own authorized targets.
4. Platform abuse
Standard SaaS restrictions also apply: no reselling access to the service without an Agency plan or written agreement; no attempting to reverse-engineer, scrape, or overload the Solacess platform itself; no using the service to violate any applicable law.
5. Reporting a violation
If you believe someone is using Solacess against a system they don't own or aren't authorized to test, or otherwise abusing the service, contact [ABUSE CONTACT EMAIL — placeholder]. See also security.txt for how to report a security issue in Solacess itself.
6. Enforcement
We may suspend a scan, an account, or access to the service at any time if we reasonably believe this AUP is being violated, including mid-scan if a target's ownership cannot be verified or a report of misuse is received. Enforcement decisions under this AUP do not waive any right under the Terms of Service.