Acceptable Use Policy

1. Purpose and scope#

This policy applies to everyone who uses the Agined Attestor website, API, MCP server or dashboard, including with the free test key. It is part of the Terms of Service. The Service lets you send requests to other systems (agent calls, webhooks and API witness calls), run scheduled checks and captures of web pages, APIs, DNS records, certificates, domain registrations, package registries and other public records, receive mail and webhooks at addresses we host for you, keep records about people and agents, and serve public pages for passkey approvals, anonymous reports and disclosure beacons. The rules below protect both our customers and third parties. You are responsible for use by your seats, your keys and anyone you give access to.

In plain language: use the Service for lawful work on systems you are entitled to contact, do not abuse it, and do not misrepresent what a receipt proves.

2. Prohibited uses#

You may not use the Service to:

2.1 Break the law or attack others#

• break the law, or help others do so;
• send requests to, relay traffic to, schedule checks or watches against, or capture systems you have no right to contact or read in that way;
• call an API through api.witness with a credential you are not entitled to use, or store such a credential with us;
• attack, scan, probe or overload third-party systems, including by using scheduled checks or the relay for port scanning, credential stuffing, denial of service or vulnerability scanning of networks you do not control;
• harvest credentials, or send spam, phishing or malware through webhook deliveries or agent calls.

2.2 Send unlawful or infringing content#

• attest or relay content that is illegal, that sexually exploits children, that promotes violence or terrorism, or that infringes others' intellectual property or privacy rights;
• submit personal data you have no lawful basis to process, or put secrets, health, financial or contact details into readable receipt fields such as labels, purposes or URLs.

2.3 Keep records about people lawfully#

When you use the tools that keep records about people, such as consent.record, terms.accept, decision.attest, exam.integrity, erasure.attest, approval.attest, disclosure.attest and commit.attest, you must:

• have a lawful basis for the record, and give the people it concerns any notice the law requires;
• identify people only by the salted hash the tool computes, or by your own hash, never by a name, email address or other readable identifier in a label or reference field; and
• not use a record to make a decision about a person that the law does not allow you to make that way.

2.4 Misrepresent receipts#

• forge, alter or misrepresent receipts, or imply that a receipt proves more than it does. This includes presenting a test-key receipt as a production attestation, presenting a reported fact as one we observed, or claiming that a receipt is legal advice or an independent audit. Presenting a customer record, such as a consent, a decision, an erasure case, an e-signature binding or a mandate cart, as something Agined verified, presenting residency.attest as a check by someone outside Agined, or presenting a receipt as proof of legal effect, compliance or conformity under any law, is a misrepresentation too. See what a receipt does and does not prove in the Terms of Service, Receipt format and the Security model;
• claim that we endorse you, your product or any content you attest.

2.5 Use specific tools for what they are for#

You must:

• run draw.fair draws only where the draw is lawful; lotteries and prize draws are regulated in many countries, and you are responsible for any licence or rules;
• use report.receipt only for a reporting channel you operate and intend to handle, and do not try to identify reporters through it;
• use inbound.receipt addresses only for mail you are entitled to receive, and not to send or relay spam;
• send an approval.attest enrolment link only to the person who will approve, and do not enrol a passkey on someone else's behalf;
• use control.snapshot only for domains you control, and posture.watch only to read public configuration signals, not as a substitute for a security test you are not authorised to run.

2.6 Abuse the commercial model#

• circumvent allowances, rate limits, seat limits or the one-key-per-network limit on test keys, including by creating accounts or keys to evade them;
• share one seat between several people or share keys beyond your organization;
• resell the Service, or offer receipts issued under your account to others as if they were your own signing service, without our written agreement.

2.7 Interfere with the Service#

• probe, test or interfere with the Service, other customers' accounts, or the signing keys, except as allowed by our Responsible disclosure policy;
• bypass authentication, tenancy isolation or the filters that block requests to private and internal addresses;
• use the Service to reach localhost, internal or private network addresses, or to try to defeat the outbound request filter;
• use automated means to create test keys or accounts at scale.

3. Enforcement#

We monitor for abuse in limited ways: rate limits and quotas, including on the public pages and endpoints the tools serve, and automatic detection on agent.call that raises a flag when a pattern looks like scanning or credential stuffing. A flag only asks a person to look. Suspension of a customer is a human decision taken on evidence.

If you break this policy, we may, depending on severity:

1. warn you and ask you to fix the problem;
2. limit, revoke or suspend keys, or suspend a workspace or account, immediately where there is harm or risk to others, to the Service, or where the law requires;
3. end your access under the Terms of Service; and
4. preserve evidence, and report to law enforcement or other authorities where we believe a serious crime is involved, such as child sexual exploitation, or where the law requires, and cooperate with valid legal process.

We tell you why we acted, unless the law forbids it or telling you would put others at risk. That statement of reasons names what we restricted and for how long, the facts we relied on, whether automated detection was involved, and the clause of this policy or the law concerned. You may appeal a suspension through /support, quoting the appeal id if you have one. A person reads every appeal. We do not give a fixed turnaround time. Fees are not refunded for access suspended or ended because of a breach of this policy.

Rate limits and quotas are described in Errors, limits and 402 and Usage, quotas and limits.

4. Reporting#

4.1 Report abuse#

If you see the Service used in a way that breaks this policy, write to abuse@agined.com with what you saw, the time (UTC), any receipt id, URL or hostname involved, and how to reach you. If a destination you operate is receiving unwanted requests from the Service, include its hostname. We review reports and act under section 3, but we may not be able to tell you the outcome. If you report content that you believe is illegal under EU law, we tell you our decision about that content and how to challenge it, as described on the Digital Services Act page.

4.2 Report a vulnerability#

Found a vulnerability? Follow our Responsible disclosure policy and write to security@agined.com. Good-faith research that follows that policy is not a breach of this one.

5. Changes#

We may update this policy. For material changes we tell account owners by email at least 30 days ahead.

6. Contact#

support@agined.com, abuse@agined.com, security@agined.com.