Acceptable Use Policy

In plain language: use the Service for lawful work on systems you are entitled to act on, keep your agents within the authority you give them, do not abuse it, and do not misrepresent what a record proves.

2. Prohibited uses#

You may not use the Service, or an agent that you run through it, to:

2.1 Break the law or attack others#

• break the law, or help others do so;
• connect, scan, probe, read from, write to or act on systems, accounts or data that you have no right to access in that way, or give an agent a lease or mandate over them;
• attack, scan, probe or overload third-party systems, including by using agents, connectors, rehearsals, arenas or detection runs for port scanning, credential stuffing, denial of service or vulnerability scanning of networks you do not control;
• harvest credentials, or send spam, phishing or malware through agents, connectors or notifications;
• use a credential you are not entitled to use, or store such a credential with us.

2.2 Send unlawful or infringing content#

• send, store or have an agent produce content that is illegal, that sexually exploits children, that promotes violence or terrorism, or that infringes others' intellectual property or privacy rights;
• submit personal data you have no lawful basis to process, or put secrets, health, financial or contact details into readable fields such as agent names, labels, purposes or URLs.

2.3 Run agents lawfully and within their authority#

Because the Service makes agents' actions carry weight, you must:

• give an agent only the authority you are entitled to give it, through leases and mandates that are specific, time-bounded and approved by someone who may approve them;
• not use the Service to give an agent authority to act for a person or organization without that party's permission, or to impersonate a person, an organization or another agent;
• not use agents to deceive, manipulate or exploit people, to make decisions about people that the law does not allow to be made automatically, or to carry out any practice the EU AI Act or other law prohibits;
• tell people when the law requires you to say that they are dealing with an AI system;
• not conceal an agent from the Service, evade admission or enforcement points, tamper with the audit chain, the ledger or a ledger bundle, or use another workspace's agents or identities; and
• keep a human accountable for each agent, and halt or quarantine an agent that is acting outside its mandate.

When you keep records about people, such as approvers, subjects of a decision or users on whose behalf an agent acts, you must have a lawful basis, give any notice the law requires, and identify people by a pseudonymous identifier rather than by name, email address or other readable identifier in a label or reference field.

2.4 Misrepresent records#

• forge, alter or misrepresent records, admissions or ledger bundles, or imply that a record proves more than it does. This includes presenting a reported fact as one the Service decided or observed, presenting a record as legal advice or as an independent audit, or presenting a record or ledger bundle as proof of legal effect, compliance or conformity under any law, or as certified by a third party. See what a record does and does not prove in the Terms of Service, the Record Practice Statement and the Security model;
• claim that we endorse you, your product or your agents.

2.5 Use the API, the MCP server and the assistant properly#

• do not use more than one API key, account or MCP client identity to get around rate limits, allowances or seat limits;
• do not hand an MCP server or toolset address, or an API key, to a person or a system outside your organization, unless your plan and a written agreement allow it;
• do not use the assistant to generate abusive, unlawful or deceptive material, to probe for other customers' data, or to extract its instructions; do not submit secrets, special-category data or other people's personal data to it unnecessarily; and do not try to defeat its limits, which include per-address and per-conversation limits;
• do not use the Service or the assistant to build or train a competing service or a model.

2.6 Abuse the commercial model#

• circumvent allowances, rate limits or seat limits, including by creating accounts or keys to evade them;
• share one seat between several people or share keys beyond your organization;
• resell the Service, or offer ledger bundles, admissions or other records issued under your account to others as if they were your own signing or witness service, without our written agreement.

2.7 Interfere with the Service#

• probe, test or interfere with the Service, other customers' accounts, or our signing keys, except as allowed by our Responsible disclosure policy;
• bypass authentication, tenancy isolation, dual-control requirements or the filters that limit where the Service may connect;
• use the Service to reach internal or private network addresses you do not control, or to try to defeat an outbound request filter;
• use automated means to create accounts at scale, or defeat the bot checks on our sign-up and public forms.

3. Enforcement#

We monitor for abuse in limited ways: rate limits and quotas, bot checks on sign-up and public forms, detection of patterns that look like scanning or credential stuffing, and reports we receive. A signal only asks a person to look. Suspension of a customer is a human decision taken on evidence.

If you break this policy, we may, depending on severity:

1. warn you and ask you to fix the problem;
2. limit, revoke or suspend keys, or halt or quarantine an agent or a connector, or suspend a workspace or account, immediately where there is harm or risk to others, to the Service, or where the law requires;
3. end your access under the Terms of Service; and
4. preserve evidence, and report to law enforcement or other authorities where we believe a serious crime is involved, such as child sexual exploitation, or where the law requires, and cooperate with valid legal process.

We tell you why we acted, unless the law forbids it or telling you would put others at risk. That statement of reasons names what we restricted and for how long, the facts we relied on, whether automated detection was involved, and the clause of this policy or the law concerned. You may appeal a suspension through /support, quoting the appeal id if you have one. A person reads every appeal. We do not give a fixed turnaround time. Fees are not refunded for access suspended or ended because of a breach of this policy.

Rate limits and quotas are described in Errors, limits and 402 and Usage, quotas and limits.

4. Reporting#

4.1 Report abuse#

If you see the Service or an agent running through it used in a way that breaks this policy, use the abuse form or write to abuse@intramedial.com with what you saw, the time (UTC), any record id, URL or hostname involved, and how to reach you. If a system you operate is receiving unwanted requests from an agent running through the Service, include its hostname. We review reports and act under section 3, but we may not be able to tell you the outcome. If you report content that you believe is illegal under EU law, we tell you our decision about that content and how to challenge it, as described on the Digital Services Act page.

4.2 Report a vulnerability#

Found a vulnerability? Follow our Responsible disclosure policy, use the security report form or write to security@intramedial.com. Good-faith research that follows that policy is not a breach of this one.

5. Changes#

We may update this policy. For material changes we tell account owners by email at least 30 days ahead.

6. Contact#

support@intramedial.com, abuse@intramedial.com, security@intramedial.com.

EU notices

• Digital Services Act
• EU Data Act
• EU AI Act
• Right of withdrawal

Receipt practices

• Record Practice Statement
• Verifier Terms
• Key management
• Verifying ledger bundles
• Format versions and long-term verification
• Cryptographic agility and post-quantum status
• If Intramedial stops operating

Program terms

• Startup Program Terms
• Nonprofit Program Terms
• Education Program Terms
• Public Sector Program Terms