Acceptable Use Policy (AUP)

Provider: Strictus GK, trading as Keelson (the “Company”).

This Acceptable Use Policy (the “AUP”) sets out prohibited uses of Keelson (the “Service”) and how violations are handled. Its purpose is to maintain the Service’s safety and reliability and protect Users and third parties.

This AUP supplements Article 11 (Prohibited Activities) of the Terms of Service and forms part of those Terms. The purpose and scope of internal use are governed by Article 9 of the Terms.

This AUP governs the details of prohibited activities and the selection of measures and procedures for addressing violations. Liability and indemnification are governed by Articles 15 and 19 of the Terms, and data handling is governed by Article 20 and the Privacy Policy. In all other cases, the Terms take precedence if they conflict with this AUP.

1. Definitions

Unless otherwise defined here, terms used in this AUP have the same meanings as in the Terms of Service.

• “User App”: An application the User deploys and runs on the Service, including associated scheduled tasks and background processing.
• “Service Infrastructure”: Systems, networks, authentication features, shared domains, and other infrastructure operated by the Company to provide the Service.

2. Prohibited Activities

The User must not use the Service to carry out, or have a third party carry out, any of the following activities.

2.1 Unauthorized Security Testing and Intrusion

The following activities are prohibited, except for research within the scope and conditions of the Company’s published Vulnerability Research and Reporting Policy, or research separately authorized by the Company in writing. Authorization from the Company does not constitute authorization to test systems managed by third parties.

• Vulnerability scanning, port scanning, penetration testing, credential brute-force attempts, or similar activities targeting the Service Infrastructure, other Users’ apps, or third-party services used by the Service.
• Breaking out of an isolated runtime, gaining privileges without authorization, or attempting unauthorized access to other Workspaces.
• Bypassing, disabling, or improperly modifying authentication, access controls, usage limits, audit records, or other security features.
• Deliberately evading or interfering with abuse detection or monitoring.

The User may test apps it manages for vulnerabilities in accordance with the policy above. Testing that adversely affects service availability, other Users’ data, or third-party systems is not permitted.

2.2 Resource Abuse, Mining, and Public Relay Services

• Mining cryptocurrency, participating in mining pools, or providing computing resources for mining.
• Reselling or otherwise providing the Service’s computing resources, bandwidth, or storage to third parties without the Company’s consent.
• Occupying computing or other resources by evading usage limits or billing, or deliberately creating excessive load that interferes with other Users’ use of the Service.
• Creating or using multiple accounts or Workspaces, or falsifying registration details, to circumvent free trial conditions, usage limits, billing, or suspension measures.
• Providing publicly accessible anonymizing or traffic relay services, such as Tor exit nodes, open proxies, public VPN relay servers, open DNS resolvers, or open mail relays.

Business reporting and batch processing, integrations with external systems, access-restricted internal API relays, and data anonymization are not, in themselves, prohibited by this section, provided they comply with Article 9 of the Terms and the conditions of the User’s subscription plan.

The Service is primarily intended for internal business applications. If sustained high-volume traffic, prolonged resource-intensive processing, or other unusually heavy resource consumption, assessed in light of the subscription plan’s conditions, interferes or threatens to interfere with reliable service delivery or other Users’ use of the Service, the Company may request changes to how the Service is used, a reduction in processing volume, adjustments to execution frequency, or similar measures, regardless of whether the impact is intentional.

If the issue cannot readily be resolved or urgent action is needed, the Company may restrict or suspend the affected processing or app to the extent necessary and proportionate, in accordance with Section 5.

2.3 Spam, Phishing, and Malware

• Sending unwanted bulk email, SMS, messages, push notifications, webhooks, or similar communications without the consent of the recipient or the administrator of the receiving system.
• Operating phishing sites, creating forms that trick people into revealing credentials, or otherwise obtaining information through deception.
• Distributing, storing, or running malicious software such as malware, ransomware, or spyware, or operating servers used to remotely control infected devices.
• Using spam to manipulate search results, generating fake reviews or fraudulent accounts, providing services that bypass CAPTCHA or other abuse-prevention features, or using automation to facilitate fraud or other abuse.

Email sent from a User App must be limited to business notifications, confirmations, and other messages to that app’s users (the User’s officers, employees, and other related parties within the scope of internal use under Article 9 of the Terms). Marketing campaigns, sending to purchased or other third-party address lists, and sending to people who do not use the app are prohibited. Apps that send recurring notifications must provide a way for recipients to stop receiving them.

2.4 Launching or Relaying Attacks

• Deliberately overloading third-party systems, including through DoS or DDoS attacks.
• Conducting port scans, credential brute-force attempts, or login attempts using leaked credentials without permission from the target system’s administrator.
• Accessing systems without authorization, obtaining privileges without authorization, stealing data, or using the Service as a platform for those activities.
• Communicating with malicious systems to control or distribute malware, participate in attacks, or serve similar purposes.

2.5 Illegal Content and Infringement of Third-Party Rights

• Distributing, storing, or processing content in violation of applicable law, including content involving illegal drug trading, illegal gambling, child sexual abuse material, or the incitement or facilitation of terrorism.
• Infringing third-party intellectual property, privacy, image rights, reputation, or other rights.
• Collecting, using, or disclosing personal information in violation of law.
• Publishing personal information to harass, threaten, or harm someone, facilitating stalking, or handling content intended to discriminate against or harass others.
• Using the Service in violation of export control or economic sanctions laws.

2.6 Fraud, Financial Crime, and Misrepresentation

• Operating or soliciting participation in fraudulent schemes, such as pyramid or Ponzi schemes.
• Deceiving the Company or third parties through false registration information, impersonation, payment fraud, improper payment reversal claims, or similar conduct.
• Carrying out or facilitating money laundering, terrorist financing, or sanctions evasion.

2.7 Interference with Service Operations

• Deliberately disrupting the normal operation of the Service Infrastructure through excessive requests, unauthorized operations, or similar conduct.
• Engaging in phishing, spam, malware distribution, or other abuse that disrupts other Users or the Service’s operations, including by causing shared domains such as *.keelson.run or networks used by the Service to be blocked or restricted.

3. User Management Responsibilities

The User must properly manage its apps, data, and credentials, and implement necessary access controls, updates, and other safeguards. It must handle User Data lawfully and obtain any necessary rights, permissions, and consents.

The User must ensure that its officers, employees, contractors, and others it authorizes to use the Service comply with this AUP. If it becomes aware that a User App has been misused through account compromise, exploitation of a vulnerability, or similar means, it must take steps to prevent further harm, such as revoking credentials, stopping the app, or fixing vulnerabilities, and promptly notify the Company.

The Company may take measures under Section 5 to prevent harm even before the cause of the abuse or responsibility for it has been established. The User’s and the Company’s liability and indemnification obligations are governed by Articles 15 and 19 of the Terms.

4. Reporting Abuse and Cooperating with Investigations

Anyone, whether or not they are a User, may report suspected violations of this AUP to [email protected]. Please provide the affected URL, the date and time including time zone, what you observed, and other information needed for the investigation, to the extent available. Do not include credentials or personal or confidential information that is unnecessary for the investigation.

If the Company asks the User about a suspected violation involving its account or apps, the User must reasonably cooperate with the investigation to the extent necessary to establish the facts or prevent harm.

5. Measures in Response to Violations

5.1 Choosing Appropriate Measures

If there is a violation of this AUP or reasonable grounds to suspect one, the Company may take any of the following measures, alone or in combination, to the extent necessary and proportionate. It will consider the nature of the violation, its impact, urgency, and any corrective action taken.

1. Request information, issue a warning, or ask the User to remedy the issue.
2. Restrict or suspend affected apps, scheduled tasks, background processing, builds, or outbound traffic.
3. Suspend use of the affected account, Workspace, or apps within that Workspace.
4. Delete or disable access to affected content or deployed apps.
5. Revoke API keys, access tokens, database credentials, or other credentials managed by the Company.
6. Cancel the User’s registration and terminate the Service Agreement in cases such as serious or repeated violations or failure to remedy an issue.
7. Refuse re-registration intended to circumvent suspension or termination.

Where possible, the Company will notify the User and provide an opportunity to remedy the issue before taking action. However, prior notice or a demand to remedy the issue is not required in cases such as serious violations or the emergencies described below.

5.2 Emergency Action

In the following circumstances, the Company may take the measures above without waiting for the usual investigation to conclude and without prior notice or a demand to remedy the issue, to the extent necessary to prevent harm or comply with legal requirements:

• There is a risk of harm or further harm to a third party.
• The Service’s operation or other Users’ use of it is being disrupted, or there is an imminent risk of such disruption.
• Action is required by law, a judicial or administrative order, or the contractual conditions of an external provider used to deliver the Service.

5.3 Notice and Reconsideration

When the Company takes action, it will notify the User of the measures and reasons through the registered email address or another channel, to the extent that doing so does not compromise the investigation, harm prevention, or compliance with law.

If the User believes a measure is based on a factual error, or has remedied the issue, it may explain the circumstances to [email protected] and request reconsideration. The Company will review the information provided, the corrective action taken, and the risk of recurrence, among other factors, to decide whether to maintain, change, or lift the measure. A request for reconsideration does not guarantee that restrictions will be lifted or data restored.

5.4 Responsibility and Liability

Except for obligations imposed by law, this section does not require the Company to monitor for or detect every violation, or to take any particular measure. The Company’s liability for damages relating to measures under this AUP is governed by Article 15 of the Terms.

A decision not to act on a particular violation does not waive the Company’s right to act on future violations.

5.5 Data Handling and Disclosure to Relevant Parties

Data handling in connection with suspension, termination, or deletion is governed by Article 20 of the Terms and the Privacy Policy. The Company may retain records needed to investigate violations, resolve disputes, or meet legal obligations, only to the extent and for as long as necessary.

The Company will address requests to export lawful User Data on a case-by-case basis, to the extent this does not facilitate further abuse or harm or violate the law. Depending on the nature and urgency of the violation, the Company may suspend access, delete data, or take other measures without first providing an opportunity to export data.

Where necessary to investigate abuse, prevent harm, or meet legal obligations, the Company may share information with relevant authorities or organizations, professional advisers, or external providers involved in delivering the Service, only to the extent necessary and in accordance with law and the Privacy Policy. This AUP does not authorize disclosures beyond what law and the Privacy Policy permit.

6. Changes

The Company may change this AUP in response to operational circumstances, patterns of abuse, changes in law, changes to the contractual conditions of external providers used to deliver the Service, or similar developments. The conditions for changes, notice methods, effective dates, and any required consent are governed by Article 22 of the Terms.

7. Contact

• Abuse reports and questions about measures taken: [email protected]
• Security reports: [email protected]
• Other inquiries: Contact page

---

End