Acceptable Use Policy

This policy states what Zerovyn's website, services and delivered systems may not be used for. It forms part of the terms of service; breaching it is a breach of those terms.

Prohibited use

• Anything unlawful under the law of the place you are in, or the place the service is delivered to.
• Fraud and deception — misrepresenting identity, authority or an outcome to obtain money, data or access.
• Unauthorised access — entering or attempting to enter any system, account, data store or network that you have not been given access to.
• Credential theft and trading — harvesting, buying, selling or publishing authentication material.
• Malware and malicious payloads — distributing, hosting or building code intended to harm, spy on or control systems without consent.
• Attacks on availability — denial-of-service, resource exhaustion, or any deliberate attempt to take a service offline.
• Spam and unsolicited bulk mail — sending large volumes of unrequested contact, or using a delivered system to do so.
• Phishing and social engineering — impersonating Zerovyn, a client or any third party to extract information or payment.
• Data theft and unauthorised export — copying, scraping or exporting personal or proprietary data beyond what the service is for.
• Privacy violation — collecting, exposing or processing personal data without a lawful basis.
• Circumventing security controls — disabling, bypassing or degrading any safeguard, rate limit, validation or audit mechanism.
• Abuse of third-party systems — using Zerovyn's infrastructure to attack or burden services Zerovyn does not operate.
• Infringement — distributing material you do not have the rights to.

Authorised security work

Security research and security testing are legitimate work. They must be conducted against systems you own or have explicit written authorisation to test, and within the scope that authorisation defines. A scope document exists so that the work stays inside it.

For Zerovyn's own site, the authorisation channel is described on the security page under responsible disclosure. Testing beyond that channel — attempting to reach other users' data or the hosting layer — is unauthorised regardless of intent.

Consequences

A breach of this policy can lead to suspension of a service, termination of an engagement, and where the conduct is unlawful, referral to the relevant authority. Zerovyn will act on credible evidence, and will tell you what that evidence is.

False reporting

Deliberately reporting another person or organisation for a breach that did not happen is itself a breach of this policy.