Policy

Acceptable use policy

This Acceptable Use Policy (AUP) defines the boundaries for using Nautillo Pro's platform. It supplements our Terms of Service and is designed to protect authorized security research while safeguarding customers, their assets, and the wider internet community.

Version 1.2.0 | Last updated 2026-06-23

Authorization Only

  • You must have documented permission from the asset owner before launching any attack simulation.
  • We may request proof of authorization at any time and reserve the right to suspend accounts that cannot provide it.
  • Testing public-sector, critical infrastructure, healthcare, financial institutions, or military systems requires explicit written authorization that we can verify.
  • Typed authorization for high-impact techniques must be provided by an authorized operator and accurately reflect the approved scope.

Strict Prohibited Activities

  • No denial-of-service, traffic flooding, network stress, or any activity designed to degrade availability.
  • No exploitation of vulnerabilities beyond controlled proof-of-concept validation. Data exfiltration, lateral movement, or privilege escalation in production is forbidden.
  • No malware distribution, ransomware activity, phishing campaigns, or social engineering using our infrastructure.

Jurisdiction & Export Compliance

  • You may not use the platform in violation of applicable export control laws, including ITAR and EAR restrictions.
  • We prohibit usage from, or on behalf of, individuals and entities located in embargoed countries as maintained by OFAC, BIS, or similar authorities.
  • US users must comply with the Computer Fraud and Abuse Act (CFAA). EU users must comply with Directive 2013/40/EU on attacks against information systems. All users must comply with the applicable cybersecurity and computer misuse laws in their jurisdiction.
  • It is your responsibility to determine whether your target environment is subject to local restrictions on security work or requires advance notification to regulators.

Data Handling Responsibilities

  • Do not upload personal data, payment card data, or other regulated data sets to the platform unless a Data Processing Agreement (DPA) is in place.
  • Do not store customer secrets, clear-text credentials, or production database dumps inside custom payloads or evidence uploads.
  • Immediately notify us if you believe credentials or sensitive material were accidentally uploaded so that we can purge the data.

Platform Integrity

  • Do not tamper with, probe, or attempt to gain unauthorized access to the Nautillo Pro platform, APIs, or infrastructure.
  • Automated integrations must honor documented rate limits and include accurate user-agent identifiers when available.
  • Do not share accounts, API keys, vaulted credentials, or access tokens. Each user must have a unique login.
  • Do not attempt to bypass typed consent capture, audit logging, rate limiting, or any other safeguards built into the platform.

Consequences of Violations

  • Violations may result in immediate suspension, termination, and notification to affected asset owners or regulators.
  • We may disclose account information and activity logs if compelled by law or required to protect against fraud, abuse, or imminent harm.
  • Serious violations can trigger contractual penalties, incident response cost recovery, and law-enforcement referral.

Operational guidelines

Simulation Boundaries

  • Limit every attack simulation to the asset(s) you explicitly listed during configuration. Adding new domains or subnets requires fresh authorization and may trigger additional verification.
  • Respect robots.txt, rate-limiting hints, and out-of-scope instructions supplied by the asset owner.

Safe Proof of Concept (PoC)

  • PoCs must capture sufficient evidence for remediation while avoiding destructive payloads. Do not weaponize exploits, deploy shells, or alter production data.
  • Where possible, request that the asset owner provide a staging environment for high-impact techniques.

Credential Management

  • Use the platform's built-in credential vault for any credentials needed during authenticated simulations. Credentials are encrypted with AES-256-GCM, stored with a maximum 24-hour TTL from scan start, and purged automatically — you do not need to remove them manually.
  • Only use credential attack dictionaries or password lists that have been explicitly authorized by the asset owner.
  • If you suspect credential compromise, rotate them and inform the asset owner without delay.

Reporting Obligations

  • Report material findings to asset owners promptly and coordinate remediation windows in line with responsible disclosure expectations.
  • Do not publicly disclose vulnerabilities without following the asset owner's disclosure policy or obtaining written consent.

Government & Regulated Targets

  • Testing government agencies, critical infrastructure, or entities subject to sector-specific regulation may require additional contracts or approvals.
  • You are responsible for securing any necessary waivers before scheduling attack simulations that could affect regulated production systems.

Engagement rules

Accountability

You are responsible for all activity conducted under your account. Sharing logins or reselling access is strictly prohibited.

Notification Duties

If your simulation inadvertently impacts availability or exposes sensitive data, you must notify both the asset owner and Nautillo Pro support immediately.

Audit & Cooperation

We reserve the right to audit simulation activity for compliance. Customers must cooperate with reasonable requests for logs, authorization letters, and remediation evidence.

Policy Updates

We may revise this Acceptable Use Policy to reflect legal or operational changes. Continued use of the platform after updates constitutes acceptance of the revised terms.

Reporting policy violations

Please report suspected AUP violations or security incidents involving platform misuse to support@nautillo.pro with all relevant context. We investigate every report and will coordinate with affected asset owners and regulators as required.