Legal document

Acceptable Use Policy

Version 2.11Last updated: 24 October 2026Vexaro, LLC

This policy sets the rules for using the Service: what you may access, what is prohibited, and who is responsible for the people who use your account. In short: you may only access devices, systems, and networks you own or are explicitly authorised to access; you must not use the Service to attack, intrude on, harm, or abuse anyone; and the Customer is responsible for the conduct of its Authorized Users and End Users. Legitimate security testing is allowed only under a written engagement.

1. Purpose & Scope

This Acceptable Use Policy (the “AUP”) governs the use of the Service and is incorporated into the Terms of Service. Capitalised terms have the meanings given in the Definitions.

The AUP applies to all use of the Service by the Customer and by every Authorized User, Operator, and End User. The Customer is responsible for ensuring that everyone who uses the Service through the Customer’s account, deployment, or arrangement complies with this AUP. A breach of this AUP is a breach of the Terms of Service.

If this document conflicts with an Order Form, the Order Form controls; otherwise the order of precedence in the Terms of Service applies.

2. Authorisation Requirement

The Service provides remote access, control, and monitoring, mesh networking once Vexaro Mesh is available, and security-testing capabilities for engagement-scoped Vexaro Security work. These capabilities may be used only against devices, systems, networks, accounts, and data that you own or that you are explicitly authorised to access, manage, monitor, record, control, or test.

Accordingly, you agree that:

a. before you connect to, control, monitor, record, route traffic through, or test any device, system, or network, you have a clear and current authorisation to do so;
b. you can produce evidence of that authorisation on reasonable request (for example, ownership, an employment or contractor relationship, an Order Form, or written rules of engagement); and
c. the existence of a technical capability in the Service is not itself authorisation to use it against any particular target.

If you are unsure whether you are authorised, you must not proceed.

3. Prohibited Activities

You must not use the Service, or permit any Authorized User or End User to use it, to do any of the following:

a. Unauthorised access, monitoring, or control. Access, monitor, intercept, record, or control any device, system, network, account, session, or data without the explicit authorisation of the owner or other authorised party.
b. Malicious code. Create, store, transmit, deploy, or distribute malware, ransomware, spyware, viruses, worms, trojans, keyloggers, or any other harmful or malicious code through the Service.
c. Network attacks. Conduct or facilitate denial-of-service or distributed-denial-of-service attacks, traffic flooding, port scanning, vulnerability scanning, network probing, packet injection, or similar activity against any system, except as expressly authorised under §4.
d. Unlawful or harmful content. Transmit, store, or make available content or material that is unlawful, fraudulent, deceptive, defamatory, harassing, threatening, obscene, or that infringes or misappropriates intellectual-property, privacy, publicity, or other rights of any party.
e. Circumventing controls. Circumvent, disable, defeat, or interfere with any security, authentication, authorisation, licensing, rate-limiting, or access-control mechanism of the Service, or attempt to gain access to any part of the Service, account, or data that you are not authorised to access.
f. Unauthorised resale or sublicensing. Resell, rent, lease, sublicense, time-share, or provide access to the Service to any third party except as expressly permitted by your Order Form.
g. Abusive compute. Use the Service for cryptocurrency mining or other compute-, bandwidth-, or storage-intensive activity that is unrelated to the Service’s intended use or that imposes an unreasonable or disproportionate load on the Service or its infrastructure.
h. Bypassing third-party restrictions. Use Vexaro Mesh, relays, gateways, or any other connectivity feature to evade, bypass, or conceal a violation of a third party’s access restrictions, network policies, geographic restrictions, or terms of use.
i. Spam and unsolicited messaging. Send spam or bulk unsolicited messages, or use the Service to support phishing, social-engineering, or other deceptive campaigns.
j. Interference and reverse engineering. Interfere with or disrupt the integrity or performance of the Service, probe or test the vulnerability of any Vexaro system except through the channel in §4 and the Vulnerability Disclosure Policy, or reverse engineer the Service except to the limited extent permitted under the Terms of Service.
k. Sanctions. Use the Service from a country or region under comprehensive sanctions, as a restricted party, or for a restricted end use, as set out in Section 7.7 of the Terms of Service.

This list describes categories of prohibited conduct; it is not exhaustive. Conduct that is comparable in nature or effect is also prohibited.

4. Security-Testing Carve-out

Vexaro Security provides legitimate security-testing and assessment services, and the Service includes capabilities that, in other contexts, this AUP restricts (for example, scanning, probing, or controlled exploitation). To avoid doubt:

a. Such activity is permitted only as part of a genuine Vexaro Security engagement that is governed by a written Statement of Work and rules of engagement, and only against targets for which the relevant owner has given documented authorisation, within the agreed scope, time window, and method.
b. Nothing in this AUP, this carve-out, or the Service authorises any out-of-scope testing, any testing of systems or data you do not own or are not explicitly authorised to test, or any activity outside the agreed rules of engagement.
c. Testing of Vexaro’s own systems is permitted only through the Vulnerability Disclosure Policy and within its scope and rules.

If your engagement is not covered by written authorisation and rules of engagement, the prohibitions in §3 apply in full.

5. Customer Responsibility

The Customer is responsible for the acts and omissions of its Authorized Users, Operators, and End Users in connection with the Service as if they were the Customer’s own. The Customer must:

a. make this AUP known to, and enforce it against, everyone who uses the Service through the Customer;
b. maintain appropriate access controls, roles, and offboarding so that only currently authorised people can use the Service; and
c. ensure it has the authorisations, lawful basis, and End-User notices required for its use, as further described in the Terms of Service and the Recording & Monitoring Notice.

6. Reporting Abuse

If you become aware of a violation of this AUP by another user, by content on the Service, or by activity reaching your systems through the Service, please report it to [email protected] with enough detail for us to investigate (for example, the affected accounts or systems, timestamps, and a description of the activity). To report a security vulnerability in Vexaro’s own systems, use [email protected] and the Vulnerability Disclosure Policy.

7. Enforcement & Consequences

We may investigate suspected violations of this AUP and may take action that is appropriate and proportionate to the circumstances, including:

a. removing, disabling, or restricting access to offending content, configuration, or capability;
b. suspending or terminating the affected account, Authorized User, session, or deployment, as described in the Terms of Service (suspension) and Terms of Service §17 (termination); and
c. cooperating with a lawful request from a competent authority where we are required to do so.

Where practicable and lawful, we will give notice appropriate to the circumstances and will limit the scope and duration of any action. A suspension or termination for a violation of this AUP is not eligible for a refund, as set out in the Refund & Cancellation Policy. Enforcement of this AUP does not limit any other right or remedy available to us under the Terms of Service or applicable rules.