Acceptable Use Policy

1. The core rule

Test only what you own or have written permission to test, and stay inside the scope you were given. Everything else in this policy follows from that rule.

2. Prohibited targets and conduct

• Scanning, probing, or exploiting a system, application, API, host, or account you are not authorized to assess.
• Assessing a shared, hosted, or third-party platform in a way that affects other tenants beyond your approved scope.
• Carrying out denial-of-service, resource-exhaustion, or availability-testing activity that disrupts a live service, unless the target owner has authorized it in writing and the scope names it.
• Accessing, copying, altering, or exfiltrating data that is not needed to demonstrate a finding, or that exceeds the authorization you hold.
• Deploying malware, ransomware, backdoors, miners, or persistence mechanisms through the service.
• Moving laterally outside the authorized scope, or using a finding to escalate beyond the systems in scope.
• Using the platform for extortion, to threaten disclosure, or to pressure a target into payment.
• Publicly disclosing vulnerability details obtained through the service without the target owner’s authorization and without following their disclosure process.
• Social engineering, phishing, credential harvesting, or pretexting of any person.
• Credential stuffing, password spraying, or authentication attacks against accounts you are not authorized to test.

3. Prohibited use of the platform itself

• Circumventing tenant isolation, entitlement gates, quotas, rate limits, or other product safeguards.
• Sharing credentials, API keys, or workspaces between individuals or outside your organization, or reselling access except under an MSSP order.
• Reverse engineering, decompiling, or attempting to extract detection logic, module internals, or model configuration, except where a restriction cannot lawfully be imposed.
• Using the service to build or train a competing product, or to benchmark publicly without our written agreement.
• Scraping the site, overloading an endpoint, or automating access-request or contact submissions.
• Uploading unlawful content, other people’s personal data without a lawful basis, or material you have no right to possess.
• Using the platform for cryptomining, spam distribution, or command-and-control traffic.
• Attempting to access another customer’s workspace, evidence, or findings.
• Misrepresenting test results to a customer, regulator, or third party, including presenting unverified output as a completed penetration test.

4. Authorized research on our own service

• You may test the Eresus Guard website and hosted service only for your own account and only for weaknesses in our systems, never in another customer’s data or workspace.
• Do not disrupt availability, do not run automated scanners against our endpoints without prior agreement, and do not use social engineering against our staff.
• Report findings privately to security@eresussec.com before any disclosure, and give us a reasonable window to fix.
• We will not pursue legal action for good-faith research that follows this section and stays in scope. If a third party brings a claim against you for such research, we will make our position clear if asked.

5. Enforcement

• We may throttle, disable a module, suspend an assessment, or suspend a workspace where conduct risks harm to a target, to the service, or to another customer, or where we cannot verify authorization.
• We notify the customer administrator and describe what triggered the action, unless notice would create further risk or breach a legal duty.
• We restore access once the cause is resolved. Repeated breaches, or a single serious breach, can end the contract.
• A customer remains responsible for its users’ conduct and for any damage caused by activity that breached this policy.

6. Reporting abuse

If you believe Eresus Guard is being used abusively, or a scan is hitting your systems without authorization, contact contact@eresussec.com with the details. We investigate and act on credible reports.