Search policy
Print
View history
ACCEPTABLE USE POLICY
Use ZoikoSuite responsibly, securely, and lawfully.
This policy explains prohibited and restricted uses of ZoikoSuite, including account misuse, security abuse,
harmful conduct, fraud, privacy violations, unauthorized automation, and misuse of AI-enabled capabilities.
AT-A-GLANCE RULE MAP
Not everything is labeled "prohibited"
Rule category
Status
Example summary
Unauthorized access & account abuse
PROHIBITED
Do not access accounts, systems, or data without authorization or compromise credentials.
Security abuse & disruption
PROHIBITED
Do not introduce malware, exploit vulnerabilities maliciously, or evade security controls.
Fraud, deception & impersonation
PROHIBITED
Do not use the service to deceive, defraud, impersonate, or misrepresent authority.
Harassment, threats & exploitation
PROHIBITED
Do not use the service to threaten, exploit, harass, or facilitate severe harm.
Privacy & personal-data misuse
PROHIBITED /
CONTEXT-
DEPENDENT
Do not unlawfully collect, expose, sell, share, or misuse personal data.
Automated access, APIs & scraping
RESTRICTED /
PRODUCT-
LIMITED
Use approved interfaces and stay within documented authorization, rate, and extraction
rules.
Regulated / high-risk activity
APPROVAL MAY
BE REQUIRED
Certain sectors, workloads, or data classes may require contract, compliance, or product
review.
Security research
GOVERNED
ELSEWHERE
Use the Security Disclosure route and its authorized-research terms.
POLICY SCOPE & GOVERNING MODEL
How the AUP relates to your other agreements
Layer
Role
Conflict rule
Master / customer agreement
Commercial and contractual relationship.
Contract controls where it expressly overrides or supplements the AUP.
Terms of Service
General service terms.
Links to the AUP and enforcement rights.
Product / API limits
Operational quotas, rate limits, technical requirements.
Not automatically "policy violations" unless deliberate abuse/evasion is defined.
Security Disclosure
Authorized vulnerability reporting/research boundaries.
Good-faith research route takes precedence where an approved safe harbor applies.
Responsible AI
AI-specific governance and safety boundaries.
AUP governs abuse; Responsible AI governs product/system design and permitted AI capability boundaries.
ACCOUNT, IDENTITY & ACCESS INTEGRITY
Prohibited conduct affecting accounts and access
Rule
Prohibited examples
Enforcement note
Unauthorized access
Accessing accounts, workspaces, environments, records, or APIs without permission.
Accidental access is distinguished from deliberate exploitation; evidence preserved before remediation.
Credential abuse
Credential stuffing, password spraying, stolen tokens, sharing credentials contrary to policy.
Linked to MFA/identity guidance where relevant.
Impersonation
Misrepresenting identity, authority, legal entity, administrator status, or affiliation.
Legitimate delegated/admin use is allowed where documented.
Account farming / evasion
Creating accounts or tenants to evade suspension, quotas, or review.
Tied to actor/entity correlation with privacy controls.
SECURITY ABUSE, MALWARE & SERVICE INTEGRITY
Protecting shared infrastructure — without criminalizing good-faith research
Prohibits malicious code, ransomware, destructive payloads, unauthorized crypto-mining, botnet activity, exploit kits, command-and-control infrastructure, or deliberately harmful payload distribution.
Prohibits denial-of-service activity, intentional resource exhaustion, or deliberate interference with other customers or shared infrastructure.
Prohibits bypassing or defeating access controls, entitlement gates, security mechanisms, data-isolation boundaries, logging, or audit systems for abusive purposes.
Legitimate interoperability, accessibility, testing, or authorized security research is never phrased as automatically prohibited — it routes to the correct approved policy or contract.
Emergency containment may occur before full review where necessary to protect customers, people, infrastructure, or evidence — without promising a specific timeline.
AUTOMATION, APIS, SCRAPING & RESOURCE ABUSE
Documented use is welcome — evasion is not
Use case
Status
Required treatment
Documented API use
ALLOWED
Authenticate correctly; respect scope, quotas, and data permissions.
Approved automation / agents
ALLOWED
Actor/account remains responsible for actions and outputs.
Rate-limit evasion
PROHIBITED
Rotating accounts, tokens, IPs, or tenants to bypass limits is treated as evasion.
Unauthorized scraping / extraction
PROHIBITED / RESTRICTED
Do not access or extract data outside authorization or applicable terms.
Credential harvesting / probing
PROHIBITED
Security testing requires approved research authorization.
FRAUD, DECEPTION, SPAM & UNLAWFUL ACTIVITY
Preventing use designed to deceive or defraud
Category
Policy intent
Examples
Fraud / scams
Prevent use designed to obtain money, access, data, or advantage through deception.
Phishing, invoice fraud, fake approvals, fraudulent procurement.
Impersonation / misrepresentation
Prevent false identity or authority claims.
Pretending to be another person, entity, regulator, or trusted service.
Spam / unsolicited abuse
Prevent abusive messaging and notification behavior.
Bulk unsolicited messages, deceptive outreach, automated harassment.
Evasion / concealment
Prevent hiding abusive origin or bypassing controls.
Obfuscating actors, forging metadata, recreating suspended accounts.
HARMFUL CONDUCT, THREATS, EXPLOITATION & SAFETY
Precise, escalation-aware, specialist-handled
This section defines the content/behavior categories, operational handoffs, and UI needed for a mature abuse policy
— the final legal threshold is set by Legal/Trust, not invented here.
Category
Public policy treatment
Operational requirement
Credible threats / incitement to violence
Prohibited
Urgent safety escalation and evidence preservation.
Harassment / targeted abuse
Prohibited where severity/scope meets policy
Context review, repeat-behavior detection, reporter privacy.
Sexual exploitation / abuse material
Prohibited
Specialist handling, strict access, preservation/reporting obligations.
Human exploitation / trafficking facilitation
Prohibited
Specialist escalation and legal review.
PRIVACY, PERSONAL DATA & CONFIDENTIAL INFORMATION
Not every privacy complaint is an AUP violation
Prohibits unauthorized disclosure, collection, sale/share, enrichment, deanonymization, credential capture, doxxing, or misuse of personal data inconsistent with authorization, contract, or law.
Prohibits using customer data, employee data, applicant data, health/financial identifiers, or other restricted data outside the purpose and permissions granted to the actor.
Privacy-rights requests are kept separate from abuse reports, linked to the Privacy Policy and Consumer Rights Request.
Some issues belong to controller/customer governance or contract administration rather than being treated automatically as an AUP violation.
INTELLECTUAL PROPERTY & RIGHTS
Infringement and rights complaints
Topic
Requirement
Copyright / IP infringement
Users may not knowingly use the service to infringe third-party rights; notices route to Legal Notices / the designated complaint process.
Trademark / brand misuse
Cross-linked to Trademark Guidelines; prohibits misleading use suggesting endorsement or affiliation.
Licenses / open source
Cross-linked to Licenses — not every license dispute is treated as an AUP violation.
AI, AGENTS & AUTOMATED DECISION MISUSE
AI does not remove account responsibility
Control area
Policy requirement
Actor accountability
The account, organization, or integrator remains responsible for automated actions initiated through its authority.
Unauthorized decisions
AI/automation may not be used to bypass required human approval, delegated authority, segregation of duties, or mandatory review.
Deceptive AI use
Prohibits AI-enabled impersonation, fraud, phishing, fabricated evidence, or falsified approvals.
Source truth
AI outputs must not be used to overwrite authoritative records or evidence outside approved governed workflows.
RESTRICTED / REVIEW-REQUIRED USE
Lawful, but outside standard product assumptions
Trigger
Possible treatment
Copy discipline
Highly regulated data / workloads
Architecture or contract review.
"Requires review" unless Legal/Product has approved a specific availability claim.
Sovereign / customer-controlled deployment
Feasibility and scope review.
No blanket availability claim.
Automated high-impact decisions
Responsible AI + Legal/Compliance review.
Never implies regulatory approval or certification.
Security testing
Security Disclosure authorization.
Never relies on sales approval for research permission.
REPORTING SUSPECTED ABUSE
A structured, minimum-data-collection report
Report type
Account/access abuse
Reporter relationship
Affected user
Subject / URL / workspace / object
Description
Do not include unnecessary sensitive data.
Contact details (optional or required by category)
Urgent safety indicator
No
Submit report
ENFORCEMENT & REMEDIATION MODEL
Nine stages, from detection to closure
Detection / report
Issue detected by system, administrator, user, third party, or internal team.
Creates an evidence-linked case.
Triage
Assess scope, severity, credibility, affected services, immediate risk.
Severity + jurisdiction + customer context.
Containment
Temporary restriction may occur to protect people, data, systems, or evidence.
Emergency-action authority and audit event.
Decision
No violation / warning / remediation / restriction / suspension / termination / escalation.
Maker-checker for material actions.
Notice
Explains action and relevant policy basis where legally/operationally appropriate.
Avoids disclosing sensitive detection methods.
Appeal / review
Eligible users may request review where offered.
Independent reviewer for material actions where feasible.
Closure / retention
Records final state, rationale, and evidence retention.
Follows legal hold, privacy, and audit requirements.
ENFORCEMENT FACTORS
Severity of harm
People safety, customer data, financial loss, service integrity, legal exposure.
Intent / knowledge
Accidental misconfiguration vs. deliberate abuse or repeated evasion.
Scale / duration
Single event vs. repeated, automated, high-volume, or persistent behavior.
Customer/admin response
Prompt remediation and cooperation vs. obstruction or recurrence.
Prior history
Relevant prior warnings, sanctions, or validated incidents.
Contractual context
Enterprise agreement, negotiated terms, dedicated deployment, support obligations.
NOTICE, APPEAL & REVIEW
Not every decision is appealable — the notice explains what is
Experience
Required behavior
Action notice
States account/workspace, action taken, effective time, high-level reason, policy section, next step.
Security exception
May withhold details that would expose detection methods, vulnerabilities, or ongoing investigations.
Appeal eligibility
Driven by action type and policy/contract configuration — not every decision is appealable.
Reviewer separation
Material suspension/termination appeals are reviewed by a different authorized reviewer where operationally feasible.
No retaliation
Whistleblowing or protected reporting routes to the dedicated ethics/whistleblowing channel.
FREQUENTLY ASKED
Common questions
Does the AUP apply to APIs and integrations?
+
Can I run automated agents?
+
Can I perform security testing?
+
What happens if ZoikoSuite suspects abuse?
+
Can I appeal an enforcement action?
+
How does this apply to AI?
+