Acceptable Use Policy

Use Zof only for lawful business purposes and within the services, environments, and usage limits you are authorized to access. Obtain authorization from the owner of each application, repository, endpoint, dataset, and infrastructure component before connecting it or initiating a test. Your authority over one application does not extend to a shared provider’s infrastructure or another tenant.

For tests that may affect availability or change state, establish the targets, test accounts, execution window, allowed techniques, traffic limits, approval owners, and stopping conditions. Coordinate with affected teams and providers. Testing permission should be documented and available to resolve a report of unauthorized activity.

You must not use the Services to do or facilitate any of the following:

• Break applicable law, violate privacy or intellectual property rights, evade sanctions or export controls, or access data or systems without authorization.
• Steal credentials, impersonate others, conduct phishing or social engineering, distribute malware, or establish unauthorized persistence in a system.
• Disrupt shared infrastructure, perform denial-of-service activity, bypass quotas or billing controls, or distribute a workload across accounts to evade limits.
• Probe Zof’s own infrastructure, accounts, or other customers’ environments outside a separately authorized security-research scope.
• Disable safeguards, evade approval controls, or attempt to extract protected source code, model information, secrets, or another customer’s data, except to the extent a restriction is prohibited by applicable law.
• Resell or redistribute access without authorization, make false claims of affiliation, send abusive or unsolicited communications, or use the Services to harass or harm others.

Use isolated test environments and synthetic data where practical. Review generated tests and proposed changes before authorizing execution. Security and load tests should have explicit boundaries; destructive operations, production writes, and remediation require controls suited to the impact. Keep recoverable backups and a tested rollback path for systems you manage.

Set the minimum permissions needed for an agent or integration, restrict accessible targets, and revoke access when an engagement ends. Monitor execution and stop a run if it reaches an unauthorized target, exposes unexpected sensitive data, or creates unanticipated harm. Prompt instructions are not a substitute for enforceable permissions and network boundaries.

Outputs may be inaccurate or incomplete. Do not represent a generated report or passing result as a certification, proof that no vulnerabilities exist, or a replacement for required professional review. You remain responsible for approving production changes and evaluating their consequences.

Submit only content you are permitted to provide for the agreed processing. Apply data minimization, mask or remove unnecessary personal information, and avoid embedding secrets in prompts, logs, screenshots, attachments, or reports. Respect third-party licenses and restrictions on repository and dataset use.

Do not submit special-category personal data, protected health information, payment authentication data, classified information, or other regulated material unless the parties have expressly agreed to the necessary service scope and safeguards. A HIPAA-related description, encryption feature, or private hosting option does not itself establish permission to process that data.

If you discover an unintended disclosure, stop the affected activity, preserve only the minimum information needed to report it, and contact security@zof.ai. Do not download, publish, or further investigate another party’s data to demonstrate impact.

Protect accounts, keys, and tokens; apply available multifactor authentication and least-privilege access; and keep administrators and incident contacts current. Do not share credentials across unrelated users. Promptly remove former personnel and notify us of suspected compromise.

Respect documented rate limits, concurrency limits, and the usage allowances in your order. Coordinate unusually large workloads or high-impact tests before running them. Do not circumvent a suspension or create replacement accounts to continue prohibited activity. Report service problems with timestamps, affected functions, and a safe reproduction rather than repeatedly triggering a harmful test.

Zof may investigate credible reports of misuse and take measures permitted by the agreement and law, including restricting a feature, removing unlawful content, suspending access, or terminating service. We may act immediately when necessary to protect systems, other customers, individuals, or legal compliance. Where appropriate and lawful, we will provide information about the issue and steps needed to restore compliant use.

We may preserve relevant records and cooperate with competent authorities as legally required. Enforcement does not waive accrued obligations or other available remedies. If you believe a restriction was applied incorrectly, contact support@zof.ai with your organization, the affected account, and relevant context; do not send credentials.

Report suspected abuse or account compromise to security@zof.ai. Include the affected service, time and time zone, activity observed, and a way to contact you. Remove unnecessary personal data and secrets from supporting material. A report is handled for investigation and response but may need to be shared with relevant responders or where law requires.

For vulnerability research, read the coordinated disclosure policy before testing. For interpretation of this policy or a proposed testing scope, contact legal@zof.ai or your account representative. Any exception must be agreed by an authorized Zof representative.

• Vulnerability disclosure
• Contact legal@zof.ai