Acceptable Use Policy

1. Scope

This Acceptable Use Policy ("AUP") forms part of your agreement with MIOSA and binds:

• Account holders. The organization or individual that owns the MIOSA account.
• Users. Anyone who accesses the platform through your account, including members of your organization or workspace.
• Your end users. If you build on MIOSA as a platform or white-label provider, anyone you provision services for is covered by this policy as well.

It applies to every MIOSA service and to any workload you run on it, including Sandboxes, Computers, Agents, App Engine deployments, Databases and Storage. Where this policy and your agreement differ on acceptable use, this policy controls. Terms used but not defined here have the meaning given in our Terms of Service.

2. Prohibited content

Do not use the platform to store, transmit, publish or distribute any of the following:

• Illegal content. Anything that violates applicable law in the jurisdiction where it is created, stored or accessed.
• Child sexual abuse material. Any content that sexually exploits or depicts minors. We report this to the appropriate authorities.
• Harassment and threats. Content intended to threaten, stalk, defame or incite violence against a person or group.
• Infringing content. Material that infringes copyright, trademark, trade secret or other intellectual property rights, or that you have no right to use.
• Malware and ransomware. Viruses, worms, trojans, ransomware, spyware, botnet payloads and any other code designed to harm, disable or gain unauthorised access to systems or data.
• Fraudulent and phishing content. Deceptive pages, messages or applications designed to obtain money, credentials or personal data under false pretences.

3. Prohibited activities

Regardless of the content involved, do not use the platform to:

• Mine cryptocurrency unless we have expressly authorised it for your account.
• Attack networks. Do not run port scans, vulnerability scans, brute-force attempts or exploitation against systems or networks you do not own or have written permission to test.
• Send spam or any unsolicited bulk or commercial messaging, including through email, APIs or automated agents.
• Conduct phishing or social-engineering campaigns against any person or organization.
• Run credential stuffing or any attempt to use stolen or guessed credentials to access accounts.
• Launch denial-of-service attacks. Do not direct volumetric or application-layer floods, or any activity whose purpose is to degrade another system's availability.
• Send bulk unsolicited messaging through any channel, whether or not the content is otherwise lawful.
• Circumvent limits. Do not take steps intended to avoid quotas, rate limits, metering or billing, including creating multiple accounts to evade a limit.
• Resell the platform or provide it to third parties without a platform or white-label agreement that authorises you to do so.
• Evade isolation. Do not attempt to break out of your workload's microVM isolation, reach another customer's workload, data or network, or defeat any authentication, access-control, rate-limiting or security mechanism.

4. AI-specific rules

Agents and automated workloads are subject to the same rules as any other use, with additional responsibilities because they act at machine speed and scale:

• No prohibited content. Do not configure or prompt an agent to generate content that this policy prohibits.
• No automated abuse at scale. Do not use agents or automation for scraping, spam, harassment, or the mass creation of misleading or deceptive content.
• Keep a human in the loop. Do not run autonomous agents that take actions with material real-world consequences, such as financial transactions, legal filings or destructive changes to third-party systems, without meaningful human oversight.
• You are responsible. You are accountable for the actions of the agents you run and for the model provider API keys they use. Provision keys with the narrowest scope that works, and rotate them if they are exposed.

5. Security research

Good-faith security research is welcome when it follows our Vulnerability Disclosure Policy. When you test the platform:

• Test only against accounts and workloads you own or have explicit permission to test.
• Do not access, copy, modify or delete data that is not yours, and do not exfiltrate data to demonstrate an issue.
• Do not run denial-of-service or volumetric attacks, and do not degrade the platform for other customers.
• Report what you find privately and give us reasonable time to fix it before public disclosure.

6. Resource abuse and fair use

Plans include quotas for compute, storage, bandwidth and API usage. Use the platform within your allocation and do not design workloads to sit at maximum capacity or maximum concurrency on a sustained basis purely to consume more than your plan provides.

Where your usage threatens platform stability or the experience of other customers, we may throttle the offending workloads, apply a rate limit, or ask you to move to a plan that fits your usage. Sustained abuse of the fair-use limits is a breach of this policy.

7. Your end users

If you use MIOSA as a platform or white-label provider, you are responsible for the conduct of the end users you provision for. You must:

• Require your end users to comply with terms at least as protective as this policy.
• Not permit your end users to do anything that this policy prohibits.
• Respond to abuse reports concerning your end users, and act on them promptly.

This responsibility is yours and is not transferred to MIOSA by the fact that your end users access the platform through your account.

8. Enforcement

If we believe this policy has been violated, we may investigate, including by reviewing usage records and content associated with the affected account. Depending on severity, we may:

• Throttle or suspend the offending workloads or account, with or without notice.
• Terminate your access to the platform for serious or repeated violations.
• Remove content that violates this policy or applicable law.
• Escalate to law enforcement or another authority where the law requires or permits it.

9. Reporting abuse

If you become aware of use of the platform that violates this policy, report it to abuse@miosa.ai. Please include the affected account or workload, the nature of the abuse, and any evidence you can share. For general help with your own account, contact support@miosa.ai.

10. Changes to this policy

We may update this policy as the platform and its services evolve. When we make a material change, we will update this page and, where the change is significant, notify account holders by email or in the product. Continuing to use the platform after a change takes effect means you accept the updated policy.