Acceptable Use Policy

Last updated: [DATE]

Read this before you scan anything. Security testing without authorization may be a criminal offence in many jurisdictions (e.g. the US Computer Fraud and Abuse Act, the UK Computer Misuse Act, and equivalents). This is a template — have counsel review it.

This Acceptable Use Policy ("AUP") is part of your Terms of Service and applies to everyone who uses Bastionize.

1. Authorization is mandatory

You may use Bastionize only to test systems that you own or for which you have explicit, documented authorization from the owner. By submitting a target you attest that you hold that authorization. For active (intrusive) testing you must additionally verify control of the target through the ownership-verification challenge. We record who authorized each scan.

2. Prohibited uses

Scanning, probing, or testing any system without authorization.
Using the Service to attack, disrupt, or gain unauthorized access to any system, or to exfiltrate data.
Attempting to bypass, disable, or defeat the Service's authorization, ownership-verification, or safety controls (including the SSRF guard and rate limits).
Testing systems on denylisted, government, or third-party infrastructure you do not control.
Reselling, sublicensing, or providing the Service to others to conduct unauthorized testing.
Uploading unlawful content, infringing intellectual property, or violating others' privacy.
Interfering with the integrity, performance, or security of the Service itself.

3. Testing conduct

Bastionize is designed to be non-intrusive and non-destructive. You must not attempt to use it — or combine it with other tools — to perform denial-of-service, credential brute-forcing, exploitation, or data-destructive actions. Respect the scope and rules of engagement you record for each assessment.

4. Your responsibility

You are solely responsible for ensuring your testing is lawful and authorized in every applicable jurisdiction. Bastionize provides tooling; it does not grant you permission to test any particular system. When in doubt, get written authorization first.

5. Reporting misuse

Report suspected abuse of the Service to abuse@bastionize.com.

6. Enforcement

We may investigate suspected violations and may suspend or terminate access, remove content, and cooperate with law enforcement. Violations may also breach the Terms of Service.