Acceptable Use Policy

1. Purpose

8200.dev is a defensive security platform. This policy defines acceptable use and is part of the Terms of Service. We built the platform to help organizations secure their own data — and we enforce that boundary.

2. Authorized, defensive use only

You may connect and analyze only sources that your organization owns, or that you administer with the documented consent of their owner. "Authorized" means actual authority over the environment — an OAuth consent screen you can click is not by itself authorization to monitor someone else’s data.

3. Prohibited conduct

You must not:

• Scan, enumerate, or analyze third-party systems, tenants, or accounts without explicit authorization.
• Use the platform, or information it produces, to plan or support offensive operations, exploitation, lateral movement, or social engineering against any party.
• Develop, test, or deliver malware or other harmful code via the platform.
• Probe, interfere with, or attempt to access other tenants of the platform, or circumvent rate limits, plan limits, or security controls.
• Resell, sublicense, or operate the platform for third parties without a written agreement with us.
• Present findings to third parties as a certification, audit opinion, or compliance attestation by Enterprise.Systems.
• Use the platform in violation of applicable law, including computer-misuse, privacy, and export-control law.

4. AI usage obligations

AI features are powered by Anthropic models under Anthropic’s commercial terms and usage policy. Those obligations flow down to you: you must not use the platform’s AI features to generate or support harmful, deceptive, or offensive-security applications, and you must not attempt to extract, jailbreak, or repurpose the underlying models. We may suspend AI features where a violation of these downstream obligations is suspected.

5. API and rate limits

Automated access must respect published rate and plan limits. Abusive automation — load testing against production, scraping the platform, or synthetic traffic designed to distort findings — is prohibited.

6. Enforcement

We investigate suspected violations and may suspend or terminate access, remove offending workloads, and — where the law requires or third parties are endangered — notify affected parties or authorities. Where practicable we give notice and an opportunity to cure before suspension.

7. Reporting

Report suspected violations of this policy, or vulnerabilities in the platform, to [email protected]. We aim to acknowledge security reports within 48 hours, follow a 90-day coordinated disclosure window, and do not pursue good-faith researchers.

8. Changes and contact

We may update this policy as the platform and the threat landscape evolve; material changes follow the notice process in the Terms of Service. Questions: [email protected].