Acceptable Use Policy

Purpose

This policy protects SecureFlowGroup, its customers, internet users and third parties from misuse of website-scanning, monitoring, firewall, automation and incident-response capabilities. It applies to every user, account, API key, integration, protected asset and service interaction.

Authorised use only

You may only assess, scan, monitor, test or control assets that you own or are expressly authorised to assess. Permission must cover the target, technique, timing and potential impact. Where a customer acts for another organisation, the customer must maintain written evidence of authority.

Public accessibility does not by itself create permission to perform intrusive testing. SecureFlowGroup may request proof of ownership or authorisation at any time.

Prohibited security activity

• Unauthorised vulnerability scanning, penetration testing, exploitation or persistence.
• Credential stuffing, password spraying, phishing, token theft or bypassing authentication.
• Malware, ransomware, destructive payloads, cryptomining or command-and-control activity.
• Denial-of-service activity, traffic flooding or intentional service degradation.
• Exfiltration, alteration or destruction of data without explicit written authority.
• Testing designed to evade attribution, law enforcement, abuse controls or contractual limits.
• Using SecureFlowGroup findings to harm, extort, embarrass or unlawfully pressure another party.
• Attempting to reverse engineer, copy or bypass SecureFlowGroup’s protections, limits or detection systems.

Harmful and unlawful content

You must not use the service to host, transmit, promote or support unlawful material, fraud, scams, exploitation, harassment, threats, extremist activity, intellectual-property infringement or content that facilitates serious harm. You must not use the platform to conceal or protect infrastructure primarily used for unlawful activity.

Privacy and surveillance

You must not use SecureFlowGroup for unlawful tracking, covert surveillance, interception, doxxing, profiling or collection of personal data. Security logs and findings must be accessed only by authorised personnel and used only for legitimate protection, compliance and incident-response purposes.

Special-category information, payment card data, passwords, private keys and government identifiers should not be uploaded unless strictly necessary, lawfully handled and protected by an agreed service configuration.

Platform integrity and fair use

You must not interfere with the platform, introduce malicious code, abuse support channels, create excessive load, circumvent rate limits, resell access without permission, scrape the service, share licences outside the agreed organisation or use multiple accounts to avoid restrictions.

Automated requests must follow published API limits and documentation. SecureFlowGroup may apply technical controls to protect service stability and other customers.

Credentials and access

Users must protect passwords, passkeys, API keys, tokens and recovery codes. Shared accounts should not be used unless expressly supported. Credentials must not be published, embedded in public code or transferred to an unauthorised person.

Suspected compromise must be reported promptly. SecureFlowGroup may rotate or revoke credentials that create security risk.

Automation and AI features

Automated blocking, remediation and AI-assisted security decisions must be configured with appropriate human oversight, testing and rollback. Users remain responsible for actions they approve, rules they deploy and decisions made using SecureFlowGroup output.

You must not use automated features to make unlawful discriminatory decisions, target vulnerable people, generate malicious instructions or perform activity that would be prohibited if carried out manually.

Reporting concerns

Suspected abuse, unlawful activity or compromised accounts should be reported through the contact page with enough information to investigate safely. Do not include exploit code, credentials or personal data unless requested through a secure channel.

Good-faith security research relating to SecureFlowGroup itself should follow the vulnerability-disclosure process published in the trust centre.

Investigation and enforcement

SecureFlowGroup may investigate suspected violations, preserve relevant records, request information, restrict features, isolate traffic, suspend accounts, remove content, notify affected customers or terminate service. We may report activity to hosting providers, regulators or law enforcement where required or reasonably necessary to prevent harm.

Where practical, we will consider seriousness, intent, repetition, impact, cooperation and remediation. Immediate action may be taken where delay could create security, legal or operational risk.

Appeals

A customer may challenge an enforcement decision by contacting [ABUSE OR LEGAL EMAIL] and providing relevant evidence. A person not involved in the original decision will review the appeal where reasonably possible. Restrictions may remain in place while a serious risk is investigated.

Changes and contact

We may update this policy to address new threats, product features or legal duties. Material changes will be notified where appropriate. Questions can be sent through the contact page.