Acceptable Use Policy

This document is provided in English, which is the authoritative version; any translation is for convenience only and the English version prevails.

This document applies to all cybersecurity software-as-a-service solutions, websites, applications, platforms, APIs, software, modules, features, documentation, support, and related services made available by Stack4Sec, LLC, a Wyoming limited liability company.

For purposes of this document, "Stack4Sec," "Company," "we," "us," and "our" mean Stack4Sec, LLC. "Customer," "you," and "your" mean the person or entity accessing or using the Services.

This document is incorporated into and forms part of the Stack4Sec Terms of Service. Product-specific terms may supplement this document for particular products, modules, services, or features.

This Acceptable Use Policy governs how the Services may and may not be used. Customer is responsible for all use of the Services by its Authorized Users and by anyone accessing the Services through Customer's Account, credentials, systems, or integrations.

Customer may use the Services only for lawful, authorized, and legitimate business purposes related to cybersecurity, governance, risk, compliance, security operations, reporting, assessment, evidence management, and related workflows.

Customer must not use the Services in a manner that harms, disrupts, compromises, overloads, degrades, misuses, or interferes with Stack4Sec, the Services, other customers, third parties, or the integrity, availability, confidentiality, or security of any system or data.

Customer must not use the Services to engage in, facilitate, support, instruct, or conceal unlawful, harmful, fraudulent, deceptive, abusive, or tortious activity, including unauthorized access, computer misuse, identity fraud, credential theft, data theft, harassment, extortion, blackmail, unlawful surveillance, intellectual property infringement, privacy violations, or violation of contractual duties.

Customer must not:

• attempt to gain unauthorized access to the Services or related systems;
• probe, scan, test, attack, exploit, bypass, or circumvent the Services without Stack4Sec's prior written authorization;
• attempt to defeat authentication, authorization, rate limits, account restrictions, usage limits, security controls, or monitoring controls;
• introduce, upload, transmit, or store malware, ransomware, worms, trojans, logic bombs, exploit code, destructive scripts, or harmful payloads;
• perform denial-of-service, credential stuffing, password spraying, brute force, scraping, automated abuse, or resource exhaustion attacks;
• interfere with logging, monitoring, telemetry, integrity checks, or incident response processes;
• use the Services to coordinate or support unauthorized security testing against third-party systems.

Customer must not:

• reverse engineer, decompile, disassemble, or attempt to derive source code, object code, non-public APIs, schemas, models, prompts, scoring logic, algorithms, architecture, workflows, or internal methods;
• copy, frame, mirror, scrape, harvest, or reproduce the Services or any substantial portion of them;
• use the Services to develop, benchmark, train, validate, improve, or commercialize a competing product or service;
• monitor the Services for competitive analysis, availability benchmarking, feature comparison, performance testing, or market intelligence;
• remove, obscure, or alter proprietary notices.

Customer must not submit, upload, store, or process content that Customer does not have the right to use, or that violates law, regulation, contract, privacy rights, confidentiality obligations, intellectual property rights, or third-party rights.

Customer must not submit regulated or highly sensitive data unless the applicable agreement expressly permits it. Prohibited data may include payment card data, protected health information, classified information, government secrets, export-controlled technical data, children's data, private keys, production passwords, seed phrases, access tokens, secrets, and other data not required for the intended business purpose.

Customer must minimize, redact, or pseudonymize sensitive data where feasible.

Customer must not misrepresent, alter, or distribute Service outputs in a deceptive or misleading manner. Customer must not state or imply that Stack4Sec has certified, audited, endorsed, approved, insured, guaranteed, or independently verified Customer's security posture, compliance status, maturity level, evidence, third-party risk status, or business decisions unless Stack4Sec expressly agrees in writing.

Customer must not use AI Features to generate, facilitate, or conceal unlawful, deceptive, infringing, abusive, discriminatory, harmful, or unsafe activity. Customer must not use AI Features to make legally or similarly significant decisions about individuals without appropriate human review and lawful basis. Customer must not use AI outputs as a substitute for legal, regulatory, audit, cybersecurity, or professional judgment.

Customer must not use the Services to send spam, unsolicited messages, phishing, deceptive communications, malicious links, or content that violates anti-spam, anti-phishing, consumer protection, telecommunications, or marketing laws.

Customer is responsible for obtaining required consents and honoring unsubscribe, opt-out, and suppression requirements for communications Customer initiates through or in connection with the Services.

Customer must not use the Services to infringe or misappropriate copyrights, trademarks, trade secrets, patents, publicity rights, privacy rights, confidentiality rights, database rights, or other proprietary rights.

Customer must not upload third-party materials unless Customer has all necessary rights and permissions.

Customer must not upload, import, store, process, prompt, embed, vectorize, train on, display, export, redistribute, or otherwise use official third-party frameworks, standards, control texts, certification materials, or licensed publications through the Services unless Customer has all necessary rights and permissions for that specific use, including any use in software, SaaS, automation, AI Features, reports, or exports.

Customer must not use the Services in life-critical, safety-critical, nuclear, aviation, emergency response, military targeting, critical infrastructure control, medical device operation, or other high-risk environments where failure could result in death, bodily injury, severe property damage, environmental harm, or critical infrastructure disruption.

Customer must not use the Services in a way that violates export controls, sanctions, anti-corruption, anti-money laundering, procurement integrity, or public sector contracting rules.

Customer must not use the Services in a manner that exceeds reasonable or published usage limits, creates abnormal load, degrades performance, interferes with other users, or imposes disproportionate infrastructure, storage, support, or security burdens.

Stack4Sec may impose throttling, rate limits, storage limits, API limits, file-size limits, AI usage limits, or other restrictions to protect the Services.

If Customer discovers a suspected vulnerability in the Services, Customer must promptly report it to contact@stack4sec.com and must not exploit, disclose, publish, transfer, or use the vulnerability except as authorized by Stack4Sec in writing.

Customer must not access, modify, delete, exfiltrate, or disclose data that does not belong to Customer.

Stack4Sec may investigate suspected violations and may suspend, restrict, throttle, or terminate access; remove or disable content; preserve evidence; notify affected parties; cooperate with law enforcement or regulators; and take any other action Stack4Sec reasonably considers necessary to protect the Services, Stack4Sec, customers, users, or third parties.

Stack4Sec is not liable for actions taken in good faith to enforce this Policy.

Reports of abuse, security concerns, or policy violations may be sent to:

Stack4Sec, LLC 30 N Gould St, STE R Sheridan, WY 82801 United States Email: legal@stack4sec.com