Acceptable Use Policy

Build what you want, on infrastructure you are entitled to use, for purposes that are legal where you and your users are. Myso's agent runs real commands and provisions real servers, so the line that matters most is this one: point it at your own systems, never at anyone else's.

• Build, deploy and host applications, sites and APIs.
• Generate, refactor, review and document code.
• Automate DevOps work on servers you own or are authorised to administer.
• Run security testing against systems you own or have written permission to test.
• Use the API and SDK inside your own products, including for your own customers.

Against other people's systems

• Scan, test, attack or gain access to infrastructure you do not own or have permission to touch.
• Denial-of-service, credential stuffing, or mass scraping in breach of a site's terms.
• Build or distribute malware, ransomware, or exploits aimed at third parties.

Illegal and harmful content

• Child sexual abuse material. This is reported to the authorities and the account is closed immediately, with no warning.
• Content that incites violence or harasses, threatens or defames a person.
• Fraud, phishing pages, fake shops, or impersonating a person or organisation.
• Anything illegal where you or your users are located.

Against the platform

• Sharing API keys outside your organisation, or reselling raw model access as if it were your own.
• Working around rate limits, credit metering, or tenant isolation.
• Cryptocurrency mining, or any other use of provisioned hosting whose purpose is to consume compute rather than run an application.
• Using project workspaces or storage as a general file-sharing or backup service unrelated to a project.
• Attempting to extract another tenant's data, credentials or prompts.

The agent does what it is asked within the approvals you give it. Instructing it to do something on this list is a breach whether or not it succeeds, and whether or not you believed it would work. If you are testing something sensitive, do it against your own systems.

Where we can, we start small: a warning, or throttling the specific behaviour. Repeated or serious breaches lead to suspension and then closure. For the most serious categories — child sexual abuse material, credible threats to life, active attacks on third parties — we act immediately and without notice, and we report to the authorities where the law requires it.

What we do not do: we do not routinely read your prompts or your code. We act on automated abuse signals, provider reports, and reports from people affected.

If you believe we got it wrong, reply to the enforcement email. We would rather reverse a bad call than defend it.

Email [email protected] with the URL or account, what you observed, and timestamps. If you are reporting a security vulnerability in Myso itself, use [email protected] instead and give us a chance to fix it before publishing.