Acceptable Use Policy

Status: Founder approved. Version: 1.1 Effective date: October 7, 2026. Version 1.0 (September 14, 2026) is preserved at versions/aup-1.0-2026-09-14.md.

1. Purpose

This Acceptable Use Policy ("AUP") governs use of the AtlaSent service (the "Service") provided by AtlaSent Systems, Inc. ("AtlaSent"). It is incorporated by reference into the Master Services Agreement ("MSA") and the Terms of Service. Capitalized terms not defined here have the meaning given in the MSA.

The AUP exists to keep the Service reliable, lawful, and safe for every customer. AtlaSent reserves the right to update this AUP from time to time; material changes will be communicated to customers as set out in §7.

2. Customer responsibilities

Customer is responsible for (a) all use of the Service by Customer's users, Agents, and integrations; (b) maintaining the confidentiality of API keys and credentials; and (c) ensuring its use of the Service complies with applicable law and this AUP.

For purposes of this AUP, "Agent" includes any AI agent, automated process, bot, script, scheduled job, or third-party integration acting on Customer's behalf or with Customer's authorization. Customer is responsible for the acts and omissions of its Agents as if they were Customer's own.

Customer must promptly notify AtlaSent at security@atlasent.io of any actual or suspected compromise of credentials or any use of the Service that violates this AUP.

3. Prohibited content and use

Customer must not, and must not permit any third party (including an Agent acting on Customer's behalf) to, use the Service to:

3.1 Unlawful, harmful, or rights-infringing use

• Violate any applicable law, regulation, court order, or third-party right.
• Infringe any intellectual property, privacy, publicity, or contractual right of any person.
• Process data in violation of any data protection law applicable to Customer (including, where applicable, GDPR, UK GDPR, CCPA/CPRA, HIPAA, and the EU AI Act).
• Engage in or facilitate fraud, deceptive practices, harassment, defamation, or stalking.

3.2 Security and integrity

• Attempt to gain unauthorized access to the Service, to any other customer's data, or to any system or network connected to the Service.
• Probe, scan, or test the vulnerability of the Service or any related system, except as expressly authorized under AtlaSent's vulnerability disclosure policy (see SECURITY.md at the apex domain).
• Introduce malware, ransomware, or any code intended to disrupt, damage, or gain unauthorized access to any system.
• Interfere with or disrupt the Service, the servers hosting the Service, or networks connected to the Service.
• Circumvent or attempt to circumvent any access control, rate limit, authentication mechanism, billing system, or usage measurement of the Service.

3.3 Misuse of authorization decisions

• Use the Service to evaluate, authorize, or audit actions that the Customer is not lawfully entitled to take. AtlaSent's issuance of an allow decision does not constitute an independent legal authorization for the underlying action.
• Misrepresent the actor_id, action_type, environment, or context fields submitted to /v1-evaluate or /v1-verify-permit with intent to evade Customer's own policies or audit obligations.
• Use the Service in a manner intended to defeat the tamper-evident guarantees of the audit chain (e.g., forging permit tokens, falsifying hash-chain entries, or backdating decision records).
• Configure Agents or integrations to ignore deny or hold decisions returned by the Service. AtlaSent provides no warranty for outcomes where Customer's downstream systems do not honor decision results.

Customer's failure to honor a deny or hold decision, or Customer's misrepresentation of any input to /v1-evaluate or /v1-verify-permit, constitutes a violation of this AUP and is a Customer Claim within the meaning of §10.2 of the MSA.

3.4 Resale and scope

• Resell, sublicense, or commercially redistribute the Service without a written reseller agreement.
• Use the Service to build a competing authorization-decision product.
• Scrape, reverse-engineer, or extract data from the Service except as expressly permitted by the documentation. Without limiting the foregoing, Customer's use of (a) the audit-export API for Customer's own audit-chain content; (b) any Service feature exposed through documented API endpoints; (c) the atlasent verify CLI on Customer's exported bundles; and (d) any feature that AtlaSent expressly describes in the Documentation as a Customer data-export pathway, is not "scraping" or "extraction" for purposes of this §3.4.

3.5 High-risk uses without written agreement

• Use the Service to make decisions that directly control critical safety functions (e.g., medical-device firing logic, aircraft flight control, nuclear-plant control, life-support systems) without a written agreement that addresses the specific use case. The Service is designed as one control among many; it is not a substitute for safety-critical engineering controls.

Customer affirmatively represents, by use of the Service, that Customer is not using the Service to make decisions described in this §3.5 unless Customer has obtained AtlaSent's prior written acknowledgment of such use.

3.6 Regulated data without appropriate agreements

• Submit Protected Health Information (PHI) governed by HIPAA without an executed Business Associate Agreement (BAA) in place.
• Submit any cardholder data within the scope of PCI DSS, including full primary-account numbers, full magnetic-stripe or chip track data, CAV2/CVC2/CVV2/CID values, PIN values, EMV cryptograms, or any other sensitive authentication data. AtlaSent is not a PCI processor.
• Submit data subject to export controls (ITAR, EAR — certain classifications) without a written agreement covering the specific use case.

3.7 AI-specific prohibitions

The Service is designed to be invoked by AI agents and on their behalf. The following are prohibited:

• Using the Service to authorize, gate, or audit AI systems engaged in use cases prohibited by Article 5 of Regulation (EU) 2024/1689 (the EU AI Act), as amended from time to time and as interpreted by the European Artificial Intelligence Office (including social scoring, emotion recognition in workplaces or schools, real-time biometric identification in publicly accessible spaces, untargeted scraping of facial imagery, and predictive policing of individuals).
• Using the Service to authorize generation of CSAM, non-consensual intimate imagery, weapons-of-mass-destruction designs, or content that incites violence against any person or group.
• Embedding the Service in any system whose purpose is to deceive a user as to whether they are interacting with a human or an AI in jurisdictions where such disclosure is required.

Customer is responsible for compliance with applicable AI laws in jurisdictions where Customer or its End Users operate, including but not limited to Colorado's law on automated decision-making technology in consequential decisions (C.R.S. §§ 6-1-1701 to 6-1-1709, as repealed and reenacted by Senate Bill 26-189, effective January 1, 2027), California AB 2013, the EU AI Act, and any successor or analogous laws. AtlaSent does not, by virtue of permitting access to the Service, undertake to evaluate or monitor whether Customer's use complies with this §3.7; Customer is the sole judge of its own compliance and bears the burden of demonstrating compliance on AtlaSent's reasonable request.

3.8 Sanctions and restricted parties

Customer represents and warrants that (a) Customer is not located in, organized under the laws of, or ordinarily resident in any country or territory subject to comprehensive US, UK, EU, or UN sanctions; and (b) Customer is not, and no End User to whom Customer permits use of the Service is, listed on any US, UK, EU, or UN restricted-party list, including the OFAC Specially Designated Nationals and Blocked Persons list, the Entity List, the Denied Persons List, or the EU Consolidated List.

4. Reasonable use

The Service has rate limits and request-size limits documented in the product rate-limits page. Customer must not exceed those documented limits, or take actions that, with the exercise of reasonable diligence, Customer should have known would materially degrade Service performance for other customers. Burst traffic that fits within published limits is permitted.

5. Reporting

Report suspected AUP violations or abuse of the Service to abuse@atlasent.io. Reports should include the relevant request_id or audit_id if known. AtlaSent will acknowledge abuse reports within two (2) business days and provide a substantive response within fifteen (15) business days, subject to extension for complex investigations.

6. Enforcement

If AtlaSent reasonably believes Customer's use of the Service violates this AUP, AtlaSent may, after written notice and a reasonable opportunity to cure (except where immediate action is necessary to protect the Service or third parties):

1. Require Customer to suspend the violating activity.
2. Suspend or throttle the violating user, key, or organization.
3. In cases of unauthorized access, distribution of malware, or clear illegality, suspend the offending activity immediately and notify Customer.
4. In cases of repeated material violation, terminate the MSA in accordance with its termination provisions.

AtlaSent's exercise of remedies under this §6 will be (a) based on AtlaSent's good-faith assessment of the violation; (b) proportionate to the violation as known to AtlaSent at the time; and (c) preceded by reasonable notice to Customer except where (i) the violation involves unauthorized access, distribution of malware, distribution of clearly illegal content, or imminent risk to the Service or third parties, or (ii) notice is prohibited by law or court order, in which case AtlaSent will give notice as soon as reasonably practicable.

Cost reimbursement. AtlaSent's reasonable costs of investigating and remediating an AUP violation that is determined to be material may, at AtlaSent's option, be reimbursed by Customer at AtlaSent's then-current professional-services rates, subject to AtlaSent providing Customer with reasonable supporting documentation. This cost-reimbursement does not apply to Service-availability issues that AtlaSent later attributes to its own systems.

AtlaSent's exercise of remedies under this §6, or its forbearance from doing so, is not a waiver of any other right or remedy under the MSA or applicable law.

7. Changes

AtlaSent will give at least 30 days' notice of any material change to this AUP, except for changes (a) required by applicable law, (b) reasonably required to protect the security of the Service, or (c) materially in Customer's favor, which take effect on publication. Material changes will be summarized in the changelog at the bottom of this document and on https://trust.atlasent.io/legal/aup.

8. Changelog