Acceptable Use Policy

This Acceptable Use Policy governs your use of Necio, an AI security testing and behavioral compliance platform operated by Prompt SecOps, LLC. This policy is incorporated into our Terms of Service. If you do not agree to this policy, you may not use the Service.

Necio is intended only for lawful, authorized security testing. You must be at least 18 years old and must have legal authority for every system, application, API, model, endpoint, account, dataset, or digital asset you test.

AI Can Make Mistakes — Human Verification Required

Necio's prompts, grades, scores, verifications, and reports are produced by artificial intelligence and can be inaccurate, incomplete, or fabricated, even when more than one model agrees. Treat every result as a lead to be confirmed, not as an established fact.

Before you act on, escalate, publish, or share a Necio result — including reporting a vulnerability to a system owner, opening a ticket, blocking a release, or presenting findings to a customer, auditor, or regulator — a qualified human must review and independently verify it. You must not present Service output as a certification, attestation, audit result, or proof that a system is secure or compliant, and must not present it as a professional opinion you have not actually formed.

You are solely responsible for what you do with Service output. To the maximum extent permitted by applicable law, Prompt SecOps is not responsible or liable for decisions made or actions taken in reliance on it.

Handle Sensitive Findings Responsibly

Use synthetic or minimized test data where possible. Do not intentionally use Necio reports, analytics, notifications, logs, or exports to collect or distribute personal information or credentials exposed by a target. Do not bypass evidence masking or attempt to restore masked values in shared artifacts.

If testing exposes a live credential or personal information, restrict its use to your authorized investigation and follow your incident response and credential rotation procedures. Masking preserves investigation context while reducing secondary exposure; it does not authorize access to, use of, or disclosure of the underlying sensitive information.

1. Authorization and Ownership

You may only use Necio to test systems, applications, APIs, AI systems, LLM endpoints, chat interfaces, bots, channels, and digital assets that you:

• Own outright
• Have administrative control over and explicit written authorization from the legal owner to test
• Have explicit written authorization to test from the legal owner
• Are explicitly authorized in writing by the legal owner to test as part of your job responsibilities

Before any testing, you must obtain and maintain evidence of ownership or explicit written authorization from the legal owner, together with a documented testing scope. Evidence must identify the owner, the person granting permission and their authority, the tester, the specific targets, permitted activities and automation, limits, and testing period. Depending on your relationship to the target, this must include proof of ownership or a signed permission letter, contract, or scope-of-work document expressly authorizing the testing. Administrative access, credentials, or job responsibilities alone are not proof of authorization. Keep that evidence current for recurring scans and provide it to us on request; we may require it before a scan is permitted to begin or resume. Do not start or continue testing if evidence is missing, permission has expired or been withdrawn, or the activity exceeds the documented scope.

Necio records your authorization attestation at registration, each time you start a scan, and when you create a schedule. It does not collect or review your authorization evidence before each scan. Keeping that evidence is your obligation, and our not requesting it is not a determination that your testing is authorized.

Holding an account on a service is not authorization to attack it. Being a paying customer or a signed-in user of a chat product, workspace, or bot does not give you the right to run adversarial testing against it or to automate it. Authorization must come from the party that owns the system.

Testing unauthorized systems constitutes unauthorized access and may be prosecuted under computer crime laws, including the Computer Fraud and Abuse Act (18 U.S.C. § 1030), the UK Computer Misuse Act 1990, and equivalent laws in other jurisdictions.

2. Browser-Driven and Channel-Based Testing

Necio can test targets that are not APIs: a chat page it reaches by driving an automated browser session, or a bot it reaches through Discord, Slack, Telegram, or Microsoft Teams. These targets belong to somebody, and the obligations in Section 1 apply to them in full. In addition, you must:

• Only automate a chat interface you own or have permission to automate. A valid account does not override restrictions on automated access in the service terms.
• Use only credentials for an account you are entitled to use. Prefer a dedicated test account with the minimum required permissions. Never use another person's credentials.
• Accept that the automated session will accept cookie, consent, and terms-of-use dialogs on the target site in order to reach the chat, and take responsibility for whether you are entitled to accept them there
• Not use browser automation to bypass CAPTCHAs, bot detection, paywalls, geographic restrictions, or rate limits. Stop the run if the target presents one of these controls.
• Only create channels in, invite bots to, and send messages through a workspace, server, or account you administer or are authorized to test in
• Only test bots you own or have permission to test. A bot being reachable does not authorize adversarial testing.
• Respect the target platform's rate limits, automation rules, and developer terms, and accept responsibility for any enforcement action the platform takes against your account and for any claim it brings against Prompt SecOps arising from your testing, as provided in Section 11 of the Terms of Service

Prompts and replies for these target types transit the third-party platform or automation service involved. That platform keeps its own records under its own retention policy, which neither you nor Prompt SecOps can delete from within Necio. Factor that in before sending sensitive content through a channel-based test.

3. Lawful Use and Legal Compliance

You agree to comply with all applicable laws, regulations, contracts, and third-party terms, including:

• Computer Fraud and Abuse Act (CFAA) - 18 U.S.C. § 1030
• UK Computer Misuse Act 1990
• EU General Data Protection Regulation (GDPR)
• California Consumer Privacy Act and other state privacy laws
• State, local, and international cybersecurity and cybercrime laws
• The EU Artificial Intelligence Act and other AI-specific laws and regulations applicable to the systems you test
• Export control and sanctions regulations, including EAR, ITAR, OFAC, and equivalent restrictions
• The terms of service, developer terms, and automation and anti-scraping policies of any provider, chat service, or messaging platform you target

You may not use Necio in any jurisdiction, for any end use, or for any target where such use would violate applicable law, contract, sanctions, export controls, or authorization limits.

High-Risk Targets

You must not use Necio to scan, probe, or otherwise test government systems, critical infrastructure, systems operated by financial institutions, medical or healthcare systems, regulated AI systems, or systems subject to export controls. These target restrictions apply even if you own the system or have permission to test it. You must not test any target where the activity, transfer of technology or data, destination, end user, or end use would violate applicable export controls or sanctions. If you cannot determine whether a target falls within a restricted category, do not test it and contact us before proceeding.

4. Responsible Vulnerability Disclosure

When your testing identifies vulnerabilities or risky behavior, you are responsible for handling them under your authorization, your agreements with the system owner, applicable law, and your own professional standards, including to:

• Have a qualified human independently verify a finding before reporting it as a vulnerability — AI-generated findings can be false positives
• Report vulnerabilities to appropriate system owners promptly
• Provide reasonable time for remediation before public disclosure
• Not exploit vulnerabilities for malicious purposes
• Handle discovered sensitive information with appropriate care
• Follow coordinated vulnerability disclosure practices

These are your commitments, not a disclosure program that Prompt SecOps operates. We do not monitor, track, or enforce whether, when, or how you report or disclose findings, and we have no duty to detect a failure to follow these practices. A failure that comes to our attention is a violation of this policy that we may act on under Section 10.

5. Data Protection and Privacy

Security testing may reveal personal, confidential, regulated, or otherwise sensitive information. You are responsible for:

• Protecting any sensitive data discovered during testing
• Minimizing personal, confidential, and regulated data submitted to the Service to what is reasonably necessary for authorized testing
• Complying with applicable privacy and data protection laws
• Limiting access to test results and discovered information
• Not sharing, storing, copying, or misusing discovered personal or sensitive information
• Implementing appropriate safeguards for test data and reports
• Using appropriately scoped provider credentials, rotating API keys under your organization's credential-management policy, and replacing them immediately after actual or suspected exposure
• Not entering personal, confidential, or regulated third-party data into free-text fields (such as a target system's name or description) that may be sent to third-party web search providers when web-search features are enabled
• Attaching only files you have the right to submit. Limit personal, confidential, and regulated content to what the authorized test needs. Attached files are sent to the target with your prompt.

Necio automatically expires or minimizes test content and evidence according to our Privacy Policy; files you attach to test prompts are deleted 48 hours after upload. You must not rely on the Service as your sole archive for records you are legally or contractually required to preserve.

30-day availability and compliance storage. Prompt SecOps does not undertake responsibility for storing, retaining, or making scan data, scan results, or web chat image artifacts available beyond 30 days after creation, except as required by applicable law or a separate written agreement. This is not a guarantee that every record will be deleted on day 30; the Privacy Policy describes the applicable data-processing retention schedule. If you need records for longer than 30 days for compliance, you must configure a SIEM connection in Settings → SIEM Integration before the applicable availability period ends. You are responsible for verifying successful delivery and configuring retention and access controls in your SIEM. SIEM delivery does not extend Necio storage and may not include every field or image artifact; separately export and preserve any required records or artifacts not delivered by the integration. Uploaded prompt attachments remain subject to their shorter 48-hour deletion period.

If an existing scheduled job uses a provider API key, replace it from the Schedule page using Edit schedule. The replacement applies to future scheduled runs without changing the job's target, templates, or recorded testing authorization.

6. Generated Attack Content

Necio uses AI models, including open-weight models, to write adversarial prompts. These models are selected partly because they can produce realistic attack content. Use the output only to test systems you have permission to test.

• Use generated prompts only against targets covered by your testing authorization
• Restrict access to people who need the prompts for the testing engagement, as with other offensive security material
• Do not publish, resell, or redistribute them, and do not accumulate them into an attack toolkit or training dataset
• Do not use Necio to obtain restricted content for purposes other than authorized testing of your configured target. Do not use generation to bypass another provider's safety controls.
• Do not ask the Service to generate content that is prohibited under Section 7 regardless of the target, framing, or stated testing purpose

A model's willingness to write a payload says nothing about whether sending it is lawful. That judgment is yours, and the authorization requirements in Sections 1 and 2 govern it.

7. Prohibited Uses

Definition of Abusive Use

“Abusive use” means any use, attempted use, or preparation using the Service that violates this policy, exceeds authorization, evades platform safeguards or enforcement, or is intended to enable unauthorized access, exploitation, data theft, disruption, fraud, harassment, or other harm. This includes generating or obtaining payloads to facilitate prohibited activity, concealing the true target or purpose, misrepresenting authorization, and testing boundaries to prepare a later attack. Describing an activity as research, experimentation, education, or a proof of concept does not excuse abusive use. You must verify ownership and authorization before testing; uncertainty about who owns a target is not permission.

Abusive use is prohibited, including attempting, preparing, or helping another person carry out prohibited activity, whether or not the intended harm occurs.

You must not use Necio to:

• Conduct unauthorized penetration testing, hacking, scanning, probing, scraping, or exploitation
• Launch attacks against systems you do not own, control, or have written authorization to test
• Steal, modify, destroy, exfiltrate, or misuse data without authorization
• Disrupt services, degrade systems, overload infrastructure, or cause malicious downtime
• Bypass authentication, rate limits, access controls, safety controls, or security measures for malicious purposes
• Defeat CAPTCHAs, bot detection, paywalls, or anti-automation measures on a target you are not authorized to automate
• Submit credentials belonging to another person, or credentials you are not entitled to use
• Generate jailbreaks, attack payloads, or other adversarial content for use outside authorized testing of systems you control
• Submit, request, generate, test, store, distribute, or attempt to obtain child sexual abuse material (CSAM), child sexual exploitation material, sexual content involving minors, or instructions involving exploitation of minors
• Create, facilitate, or conceal sexual exploitation, non-consensual sexual imagery, trafficking, grooming, extortion, harassment, doxxing, credential theft, phishing, malware deployment, unlawful surveillance, or other criminal activity
• Plan, facilitate, or promote terrorism or violent extremism; develop, acquire, or deploy chemical, biological, radiological, or nuclear weapons; or attack, disrupt, or compromise critical infrastructure
• Violate export controls, sanctions, embargoes, or restrictions on prohibited end users, jurisdictions, or end uses
• Use the Service to harass, intimidate, threaten, or harm individuals or organizations
• Test, probe, scan, or attack Necio itself, or bypass its authentication, rate limits, or security controls without prior written authorization from Prompt SecOps. Report suspected vulnerabilities to [email protected]
• Evade token metering or credit deductions, manipulate credit balances or payment confirmations, bypass insufficient-credit controls or automatic top-up consent, or use payment methods without authorization. Purchasing credits does not expand your testing authorization or exempt you from this policy.
• Share, resell, or transfer account access, create accounts by automated means, or use the Service to send spam, mine cryptocurrency, or otherwise abuse platform resources
• Copy, extract, or reuse Necio's proprietary prompt templates, scoring methodology, or outputs to develop, train, or market a competing product or service

8. User Responsibility and Legal Liability

You are solely responsible for all prompts, uploads, targets, outputs, testing activity, and account activity associated with your use of Necio. Prompt SecOps does not authorize, direct, control, endorse, or assume responsibility for user-generated prompts, user-selected targets, or illegal use of the Service.

Prompt SecOps does not monitor, pre-screen, or review your prompts, targets, schedules, or results for compliance with this policy, and has no duty to do so or to warn any third party. Any review or enforcement we undertake under Section 10 is discretionary and creates no duty to you or to any third party. See Role of the Service in our Terms of Service.

If you submit, request, generate, test, store, or distribute CSAM, child sexual exploitation material, sexual content involving minors, or other illegal sexual content, you may be reported to law enforcement and are solely responsible for any civil, criminal, regulatory, or other legal consequences.

9. Professional and Ethical Standards

• Act with integrity and professionalism
• Apply your own professional judgment to AI-generated findings rather than forwarding, publishing, or acting on them unverified
• Respect the privacy, safety, and rights of others
• Use Necio only for legitimate security and compliance purposes
• Maintain confidentiality of discovered vulnerabilities
• Cooperate with legitimate security investigations
• Report suspected misuse or abuse of the platform

10. Enforcement

Violation of this policy may result in immediate account suspension or termination, removal of access to the Service, preservation of relevant records, reporting to affected service providers or system owners, reporting to law enforcement or regulatory authorities, and civil or criminal legal action.

We may act proactively when specific facts or activity give us a reasonable basis to suspect abusive use, malicious intent, insufficient authorization, or a material risk to the Service or third parties. We may throttle suspicious activity, block or stop scans before they begin or complete, restrict features, deny service to high-risk users, require proof of ownership and written authorization before allowing or resuming testing, and suspend or terminate access. We may take these steps without prior notice and before completing an investigation or confirming a violation; actual harm or a completed attack is not required. We may consider attempted activity, patterns of behavior, misrepresentations, and efforts to evade safeguards when assessing intent. Lawful, authorized adversarial testing within this policy is not abusive merely because it uses attack-like prompts.

Do not bypass a cancellation, suspension, pause, or other platform control by starting replacement jobs, switching accounts, or using internal endpoints. We may keep testing blocked until requested evidence is provided and reviewed. Our review does not grant permission to test, certify legality, relieve you of your obligations, or create any duty to you or to a third party. If you believe an enforcement decision is mistaken, contact [email protected] with relevant authorization evidence. We handle evidence and investigation records as described in our Privacy Policy.

11. Reporting Abuse

To report suspected misuse, abuse, unauthorized testing, or illegal activity involving Necio, contact us at [email protected].