Acceptable Use Policy
This policy defines prohibited uses for public websites, applications, dashboards, APIs, prototypes, client services, and related systems.
Prohibited Conduct
- Illegal activity, fraud, impersonation, theft, infringement, or violation of others rights.
- Harassment, threats, stalking, doxxing, abuse, hate, defamation, targeted intimidation, or unsafe conduct.
- Spam, phishing, deceptive communications, credential attacks, password spraying, account takeover, or unauthorized access attempts.
- Malware, exploit delivery, botnets, destructive automation, unauthorized scanning, unauthorized scraping, or service interference.
- Attempts to bypass access controls, rate limits, authentication, authorization, logging, security controls, or content restrictions.
- Unauthorized vulnerability testing, penetration testing, stress testing, denial-of-service testing, or exploitation.
Health, Research, and Prototype Misuse
Do not use health, research, clinical, accessibility, or prototype systems to provide unauthorized diagnosis, treatment, emergency response, patient monitoring, clinical decisioning, or regulated professional services unless separately authorized in writing.
Do not upload PHI, protected research data, confidential records, or highly sensitive data unless an approved written agreement, security workflow, and any required BAA or DPA are in place.
Responsible Security Research
Good-faith security reports are welcome when they avoid harm. Do not access, modify, destroy, exfiltrate, or disclose data. Do not interrupt services, test third-party systems, or perform social engineering.
Report suspected vulnerabilities through the contact or support page, or by email at [email protected], with enough detail to reproduce the issue safely. Reports should avoid accessing data that is not yours, interrupting service, social engineering, or public disclosure before review.