Acceptable Use Policy

1. Purpose

8200.dev is a defensive security platform. This policy defines acceptable use and is part of the Terms of Service. We built the platform to help organizations secure their own data — and we enforce that boundary.

2. Authorized, defensive use only

You may connect and analyze only sources that your organization owns, or that you administer with the documented consent of their owner. "Authorized" means actual authority over the environment — an OAuth consent screen you can click is not by itself authorization to monitor someone else’s data.

3. Prohibited conduct

You must not:

• Scan, enumerate, or analyze third-party systems, tenants, or accounts without explicit authorization, except for the AI Exposure Check as described in section 3A.
• Use the platform, or information it produces, to plan or support offensive operations, exploitation, lateral movement, or social engineering against any party.
• Develop, test, or deliver malware or other harmful code via the platform.
• Probe, interfere with, or attempt to access other tenants of the platform, or circumvent rate limits, plan limits, or security controls.
• Resell, sublicense, or operate the platform for third parties without a written agreement with us.
• Present findings to third parties as a certification, audit opinion, or compliance attestation by Enterprise.Systems.
• Use the platform in violation of applicable law, including computer-misuse, privacy, and export-control law.

3A. The AI Exposure Check

The AI Exposure Check may be run on any public domain name, including one you do not own, because it reads only public DNS records and returns only a score, counts and status flags: no service names, subdomains or record values. It is the only analysis of systems you do not own that this policy permits.

Only the domain you enter. The check asks public DNS resolvers about that domain (a subdomain is checked as its main domain) and, to read its mail settings and the services it uses, the names its own records refer to and a fixed list of common names under it (for example www, autodiscover and DKIM selectors). You must not use the check, or ask us, to look at anything else. The check does not run port scans, login attempts, password guessing, brute force, vulnerability scans or exploitation against any domain, and we do not connect to the domain’s servers or website ourselves; the public resolver may query the domain’s name servers, as normal DNS resolution does.

Limits. For each network (for IPv6, each /64 network) the check allows 5 new checks per hour, 20 new checks per day, 60 answers per day (saved answers included) and 30 different domains per day. Each network may also create 20 share links and submit 5 e-mail sign-ups per day. A signed-in account may run 50 new checks per day instead of the 5 per hour and 20 per day. Each domain is checked afresh at most once per UTC day, and we also cap the total number of new checks per day. Days are UTC. When you reach a limit, the check says so.

No circumvention and no list-building. You must not get around the limits or the human check, for example with scripts or other automation, rotating IP addresses or networks, proxies or multiple accounts. You must not use the check to build lists, rankings or databases of other organizations, for sales prospecting, competitive intelligence or targeting, or to harass or shame an organization.

Sharing. You may share your own result card. You must not present a result as a rating, certification or audit of another organization.

Opting out and reporting. There is not yet a way for a domain owner to opt out of the public result. Report abuse of the check to [email protected] (section 7).

4. AI usage obligations

AI features are powered by Anthropic models under Anthropic’s commercial terms and usage policy. Those obligations flow down to you: you must not use the platform’s AI features to generate or support harmful, deceptive, or offensive-security applications, and you must not attempt to extract, jailbreak, or repurpose the underlying models. We may suspend AI features where a violation of these downstream obligations is suspected.

5. API and rate limits

Automated access must respect published rate and plan limits. Abusive automation — load testing against production, scraping the platform, or synthetic traffic designed to distort findings — is prohibited.

6. Enforcement

We investigate suspected violations and may suspend or terminate access, remove offending workloads, and — where the law requires or third parties are endangered — notify affected parties or authorities. Where practicable we give notice and an opportunity to cure before suspension.

7. Reporting

Report suspected violations of this policy, or vulnerabilities in the platform, to [email protected]. We aim to acknowledge security reports within 48 hours, follow a 90-day coordinated disclosure window, and do not pursue good-faith researchers.

8. Changes and contact

We may update this policy as the platform and the threat landscape evolve; material changes follow the notice process in the Terms of Service. Questions: [email protected].