Acceptable Use Policy

Acceptable Use Policy

Draft pending counsel review — not legal advice, not in force until approved by the owner

This policy is a working draft for counsel review. Facts are drawn from the operator’s trust documents (ops/docs/trust/). Reviewed by: (pending) · Reviewed on: (pending).

1. Prohibited uses

You must not use the tcpsystems services to:

• break the law, or to process personal data you have no lawful basis to process;
• attack, probe or disrupt any host, service or network, including the services themselves and their upstream providers;
• bypass or weaken authentication, rate limits or other abuse controls; or
• submit content you have no right to submit, including credentials or secrets that belong to someone else.

Violation can lead to suspension of the API keys involved and, where the law requires it, referral to the relevant authority. Reports are handled under the abuse reporting procedure.

2. Agents acting on your behalf

Automated agents, scripts and other software that call the API with your API key act on your behalf, and their actions are treated as yours. The key id is the unit of attribution in the request metadata the router records (source: ops/docs/trust/DPA-subprocessors.md §2), so keep keys scoped to the agent they belong to and revoke a key when its agent is retired. You remain responsible for what your agents send, including prompts, tool output and retries.

3. Third-party model providers

Requests are routed by the acumen gateway to upstream inference providers. The provider receives the prompt and completion content in order to serve the request, and provider-level terms (not yet catalogued: see the open actions in the sub-processors register) govern what the provider does with that copy (source: ops/docs/trust/DPA-subprocessors.md §4 and §8). Do not send content through the API if you cannot accept that an upstream provider will process it, and ask for the provider list before committing to a regulated deal (source: ibid., §4).

4. Reporting violations

See abuse reporting. Security vulnerabilities have a separate channel: security@tcp.systems, published in /.well-known/security.txt.