Acceptable use policy

You may use the Service only for lawful purposes. You may not use it to:

1. plan, facilitate, or carry out any illegal activity;
2. infringe any third party's intellectual-property, privacy, or other right;
3. violate any applicable export-control, sanctions, anti-bribery, or anti-money-laundering law;
4. process data of natural persons under the age of 16 except where you have a lawful basis to do so;
5. misrepresent yourself, your organisation, or the source of your content.

[Placeholder — counsel to add: jurisdiction-specific prohibitions, OFAC SDN screening commitments, dual-use export carve-outs.]

You may not use the Service — directly or as part of an automated workflow — to generate, host, store, transmit, or disseminate any of the following:

1. Child sexual abuse material (CSAM) or any content that sexually exploits or endangers minors. Zero tolerance. We report apparent CSAM to the National Center for Missing & Exploited Children (NCMEC) and equivalent authorities and preserve evidence as required by law.
2. Non-consensual intimate imagery, including AI-generated or synthesised imagery depicting real people without their consent.
3. Content that promotes terrorism, mass violence, or genocide, or that incites imminent lawless action against identifiable persons or groups.
4. Operational instructions for weapons of mass destruction — chemical, biological, radiological, or nuclear — including synthesis pathways, delivery mechanisms, or evasion of detection.
5. Cyber-attack preparation in violation of applicable law, including malware authoring, ransomware operation, exploit development for unauthorised systems, credential stuffing, or evasion of CISA-listed defensive measures (where applicable to the Customer).
6. Content that targets individuals for harassment, doxing, or swatting.
7. Fraudulent or deceptive content, including phishing kits, scam-bait scripts, fabricated identity documents, or synthesised media intended to deceive (e.g. deepfakes for fraud or election interference).
8. Content that depicts gratuitous, real-world violence or torturefor entertainment.
9. Hate content that promotes discrimination or violence against protected groups (race, ethnicity, religion, gender, sexual orientation, disability, etc.).

High-stakes domains.Without a separate written agreement, you may not rely on the Service for legally-binding decisions in healthcare, criminal justice, employment, immigration, education, social benefits, or insurance. The Service's outputs are model-generated and may be incorrect, biased, or unsuitable for these contexts.

[Placeholder — counsel to confirm: enforceable definitions per item, the Trust & Safety adjudication ladder, NCMEC reporting workflow, EU AI Act prohibited-use article (Art. 5) overlay, and content-policy version history.]

You may not:

1. probe, scan, or test the vulnerability of the Service or any system or network connected to it, except under the safe-harbour terms of our responsible-disclosure programme;
2. attempt to bypass authentication, access controls, rate limits, quotas, or billing mechanisms;
3. introduce malware, viruses, or other malicious code into the Service;
4. interfere with or disrupt the Service or any User's use of it (e.g. DoS, DDoS, resource exhaustion);
5. scrape, crawl, or use any non-public interface in a manner inconsistent with documented usage;
6. reverse-engineer, decompile, or otherwise attempt to extract the source code, models, or weights underlying the Service.

[Placeholder — counsel to add: explicit list of prohibited security actions, bot-mitigation controls reference, fraud-prevention provisions.]

You may not:

1. resell, sublicense, or rent the Service except under an authorised reseller agreement;
2. use the Service to develop, train, or fine-tune a model or product that competes with Osyra;
3. send unsolicited bulk communications (spam) or content that violates the CAN-SPAM Act, CASL, or equivalent laws;
4. create accounts by automated means or use false identities to circumvent enforcement;
5. share credentials, API keys, or tokens across organisational boundaries;
6. generate synthetic engagement (fake reviews, follower counts, etc.).

Rate limits and quotas. The Service enforces rate limits and Plan-level quotas. Repeated attempts to circumvent or exceed limits without authorisation may result in throttling, suspension, or termination. Where you exceed soft limits on Enterprise Plans, we will reach out to align on capacity — we do not silently block.

[Placeholder — counsel to add anti-circumvention and reseller carve-outs.]

Each upstream model provider (OpenAI, Anthropic, Google, Mistral, Cohere, etc.) has its own usage policy. Your use of a model via Osyra is also governed by the provider's policy, which may be more restrictive than this AUP for certain use cases. The provider's terms are available in our Model Provider Catalogue and on each provider's website. [Placeholder — counsel to confirm flow-down language and disclosure of any provider-specific carve-outs.]

If we identify or are notified of a suspected breach, our enforcement ladder is:

1. Warning.For first-time, low-severity breaches we contact the Customer's administrator with notice and an opportunity to remediate.
2. Suspension. For repeated, ongoing, or higher-severity breaches we may suspend the affected workspace or feature with notice and a remediation window.
3. Termination. For material, uncured, or egregious breaches we may terminate the account in accordance with the Terms.

For breaches involving CSAM, imminent threat of physical harm, or active cyber-attack, we may suspend or terminate without prior notice and report to law enforcement as required.

Appeals. Customers may appeal an enforcement action by emailing appeals@osyra.ai with the workspace identifier and a written statement. We respond within five business days.

[Placeholder — counsel to confirm: full appeal procedure, timing of refunds on termination, retention of evidence for legal proceedings, third-party-notice obligations under EU DSA where applicable.]

Report suspected AUP violations to abuse@osyra.ai. When possible, include:

1. the workspace identifier (if known);
2. the relevant request identifier(s) or receipt ID(s) from the dashboard or our receipts feed;
3. a description of the suspected violation and any supporting evidence.

Reports of CSAM should be sent immediately to abuse@osyra.ai with subject “CSAM report”. Do not include sample content; describe the location only.

We acknowledge AUP reports within one business day and complete triage within five business days. We do not disclose the identity of the reporter to the affected Customer except where required by law.

[Placeholder — counsel to confirm reporter-protection commitments, EU DSA trusted-flagger procedures, retention of report evidence.]

We may update this AUP. Material changes are notified to the primary account contact at least 30 days before they take effect, and posted here with a new “Last updated” date. Where a change is required to comply with new law or to address an imminent harm, we may update on shorter notice. [Placeholder — counsel to confirm version-archive policy.]