Acceptable Use Policy

Effective date: [[EFFECTIVE_DATE]]

This Acceptable Use Policy (the "AUP") applies to everyone who uses the Seros service, including customers, their Authorised Users, and anyone using the API. It is part of the Terms of Service. If you break it, we may suspend or terminate access under Section 14 of those Terms.

The rule underneath all of the rules: do not use the Service to harm people, to break the law, to damage the Service, or to make a machine decide something about a person that a person should decide.

1. Illegal and harmful use

Do not use the Service to:

Break any applicable law or regulation, or to help someone else do so.
Infringe intellectual property rights, misappropriate trade secrets, or breach a duty of confidence.
Defame, harass, threaten, stalk, or intimidate a person, or to organise those acts.
Produce or distribute child sexual abuse material, non-consensual intimate imagery, or content that sexualises minors. We report such material to the authorities where the law requires it.
Promote or facilitate violence, terrorism, or the manufacture of weapons, explosives, or controlled substances.
Run fraud schemes, phishing, impersonation, fake reviews, or deceptive marketing.
Engage in unlawful discrimination against a person or group.

2. Content restrictions

Do not upload malware, ransomware, exploit code, or anything designed to disrupt software or hardware.
Do not upload content you do not have the rights to upload.
Do not use the Service to send unsolicited bulk email or messages.

3. Regulated and sensitive data

Unless we have agreed otherwise in writing and signed the necessary additional terms:

No protected health information. Do not submit PHI as defined by HIPAA. We do not currently offer a Business Associate Agreement. If you need one, ask before you send anything: legal@seros.dev.
No payment card data. Do not submit full primary account numbers, magnetic stripe data, card verification values, or anything else within PCI DSS scope. Payments to us are handled by our payment processor, not by the Service.
No government classified or export-controlled technical data, including ITAR or EAR controlled material.
Be careful with special categories. Data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation, and criminal offence data, is high risk. Do not put it in the Service unless you have a lawful basis, have told us in the DPA's Annex I, and have agreed any additional safeguards with us.
No national identifiers at scale — social security numbers, passport numbers, driver's licence numbers, financial account numbers — unless agreed in writing.

4. AI-specific rules

These exist because the Service generates text with probabilistic models, and because our model providers impose their own restrictions on us.

4.1 Human review of consequential decisions. Do not use the Service, alone or as the determining factor, to make or automate a decision that produces legal effects or similarly significant effects for a person. That includes decisions about employment, hiring, promotion, discipline or termination; credit, lending or insurance; housing; education admission; access to healthcare or essential services; immigration; and criminal justice outcomes. A qualified person must review and be able to override any output that feeds such a decision, and must be accountable for the result.

4.2 No prohibited high-risk uses. Do not use the Service for biometric identification or categorisation of individuals, emotion inference in workplace or education settings, social scoring, predictive policing, or covert manipulation of behaviour. These are prohibited or heavily restricted under laws including the EU AI Act, and they are outside what the Service is built for.

4.3 Disclose AI where it matters. If output is used in communication with a person who would reasonably expect a human author, and law or common decency requires disclosure, make the disclosure. Do not present output as the work of a named person who did not review it.

4.4 No competing model development. Do not use the Service or its output to train, fine-tune, evaluate, benchmark or otherwise develop a machine learning model or service that competes with the Service, and do not systematically extract output for that purpose. This mirrors Section 7.6 of the Terms.

4.5 No prompt attacks. Do not attempt to bypass safety systems, extract system prompts or model weights, inject instructions to make the Service act outside its intended function, or use the Service to attack another system's AI.

4.6 No professional advice output. Do not present output as legal, medical, tax, financial, or other professional advice, or use it to give such advice to a third party without a qualified professional reviewing it.

4.7 Provider policies. Our AI model providers publish their own usage policies. Your use must not put us in breach of them. The providers we use are listed in SUBPROCESSORS.md and we will pass through restrictions they require.

5. Scraping, automation and integrations

Do not scrape, crawl, or harvest data from the Service or from third-party systems through the Service, except through the documented API and within its terms.
Do not use the Service to access a third-party system you are not authorised to access, or in a way that breaches that system's terms.
Do not use automation to create accounts, evade seat limits, or evade a suspension.
Connectors must be authorised by someone with authority to grant that access in your organisation.

6. Service integrity and rate limits

Respect published rate limits. Current limits are documented at https://seros.dev/docs/api and may change; where a change reduces limits materially for paid plans we will give notice.
Do not attempt to circumvent quotas, throttling, seat counts, or billing.
Do not run load tests, stress tests, or denial-of-service tests against the Service without our prior written consent.
Do not use the Service in a way that degrades performance for other customers. We may throttle or suspend abusive traffic without prior notice if it threatens availability.
Do not resell or provide the Service to third parties unless your Order Form permits it.

7. Security research and testing

We welcome good-faith security research within these limits:

Get written permission before any penetration test or automated scanning of our infrastructure. Request it at security@seros.dev with the scope and dates.
Test only against accounts and data you own. Never access, modify or delete another customer's data.
Do not perform denial-of-service testing, social engineering of our staff or vendors, or physical testing.
Stop as soon as you confirm a vulnerability, and report it under the disclosure process in SECURITY.md.

Research within those limits gets the safe harbour described in SECURITY.md. Research outside them is a breach of this AUP.

8. Reporting and enforcement

Report abuse or suspected violations to legal@seros.dev with enough detail to investigate.

We may investigate suspected violations and may remove content or suspend access. Where practical we will notify you first and give you a chance to fix the problem. Where the violation threatens security, availability, or a person's safety, or where law requires it, we may act immediately. Repeated or severe violations can lead to termination without refund. We may report unlawful activity to the authorities.

9. Changes

We may update this AUP as the law, the product, or our providers' requirements change. We will post the updated version and, for material changes, give notice under Section 17.10 of the Terms.

What I need from you

Confirm the no-PHI and no-PCI position. If a healthcare customer appears, this needs a BAA and a lawyer, not an exception by email.
Set the published rate limits and the URL for them.
Set security@seros.dev and decide whether it is a real inbox or an alias.
Decide whether reselling is ever allowed, and on what terms.